5 ms·

Upcoming changes in Google’s HTTP Referrer

38 points by cleverjake 15y ago

ck2 15y ago
Why on earth are people still allowing their referers to be sent to third party websites? It should be the first thing you disable. If a site insists on referers use an automatic spoofing plugin like RefControl.
- untog 15y ago
  Why on earth are people still allowing their referers to be sent to third party websites? Because they don't care? You might consider it a privacy must but plenty don't. I, for one, don't have a huge problem with sites knowing where I came from.
  - coderdude 15y ago
    ck2 has 11K+ karma but a blank about section, which leads me to believe that he probably has exaggerated privacy expectations to begin with. Almost nobody outside of this vocal 'minerdity' cares about things like this.
    - ceol 15y ago
      I wouldn't consider any privacy expectations to be exaggerated— you can't have too much. I'm also sad to see you used ck2's karma/profile page to discredit their argument. ck2 could have phrased their post better (it came off somewhat condescending), but the meat of it is solid: Disabling referrer headers should be the first thing a privacy-minded person does.
      - coderdude 15y ago
        I didn't use his karma and profile to discredit his argument. I used his (perceived) exaggerated expectations of privacy -- which I garnered from both reading his comment and looking at his profile -- to discredit his argument. You are free to agree with him that you should disable your HTTP referrer header but it breaks the Web and is probably a sign of paranoia on some level or another. It really is quite innocuous.
        ceol 15y ago
        > I didn't use his karma and profile to discredit his argument. I used his (perceived) exaggerated expectations of privacy -- which I garnered from both reading his comment and looking at his profile -- to discredit his argument. You assumed the type of person ck2 was from their karma and profile page and then discredited their comment because of that assumption; specifically, you called them a "vocal minerdity". To be honest, your reply to ck2 was little more than verbose name-calling and offered nothing of substance to the discussion. My apologies to the other HN readers for this derail. edit: That came off kind of harsh. I'm sure you meant well by your comment, but I don't think an appropriate reply to ck2 was to point to their profile and call them paranoid.
        coderdude 15y ago
        I don't mean any disparage on ck2, though I do completely disagree with him. "minerdity" (which I thought was rather clever, actually) is perfect for describing the minority of highly technical users that have deep-seated privacy issues. That determination didn't come from his profile. His comment said it all. He makes it sound like you'd have to be nuts or ignorant to not block the referrer and that's simply not the case. Sometimes you have to look at the person doing the talking and determine if they are biased or not. Like when someone with "I hate Microsoft" in their about is in a thread about Microsoft trying to explain to you why Windows is dying off. That was my determination, for better or for worse, I can't take it back now.
    - AgentConundrum 15y ago
      What does having a blank about section have to do with privacy. I've got less karma, ~2k or so, and my about section is blank as well. It's not a privacy thing, it's just that I'm not all that interesting.
      - coderdude 15y ago
        He's a top 100 user and he has a blank profile. You don't have to dig too deep to figure out why I believe that's unusual. Take a glance at the leaderboard and see how many people spend huge chunks of their days on here but don't even mention a Twitter account or name. Which is fine. I don't want this to turn into some thing where people think I'm bashing the guy for his profile.
  - parfe 15y ago
    I recommend anyone interested in learning about online tracking to install Mozilla Collusion http://www.mozilla.org/en-US/collusion/ http://www.mozilla.org/en-US/collusion/ After seeing the amount of seemingly disparate information certain organizations can track (Google/Doubeclick, Discuss, Facebook, Twitter, etc) consider installing Ghostery http://www.ghostery.com/ http://www.ghostery.com/ Collusion takes seconds to install and you can forget about it for months while it builds an interactive web of tracking. Ghostery protects your privacy by blocking a large list of web spies.
    - coderdude 15y ago
      I've checked this out. It was pretty crazy to see how many domains get pinged when I visit a site. Just remember, o consumer of things but blocker of ads yet payer of nothing, that when enough people are gyping site owners out of what little revenue you even can earn from advertising you will cease to get your freebies but the agencies will not stop gathering your information.
      - ColdAsIce 15y ago
        Because fuck advertising. Site owners are not advertising companies.
    - abhaga 15y ago
      Is something similar to collusion available for Chrome?
      - jmilkbal 15y ago
        No, but a privacy conscious user would prefer to use Chromium which doesn't come with the Google privacy invasion built-in.
- jonknee 15y ago
  It's generally good for the web to know where traffic is coming from. For example, it would be quite frustrating to be linked on say Hacker News and not know it but still see your server sending out thousands and thousands of additional page views an hour.
- dchuk 15y ago
  that's like parking a mile away from a mcdonalds so no one knows where you came from. There's privacy and then there's paranoia...
  - Terretta 15y ago
    You can park by the door, it still doesn't tell them where you came from.
  - simcop2387 15y ago
    That's why I park at the wendy's across the street. That way no one knows I went to McDonalds.
- cpeterso 15y ago
  How often do you run into third-party websites that break without referer header?
  - ordinary 15y ago
    In the 3 or so years I've used RefControl, I've added 5 exceptions. Sourceforge used to break (but not any more). NYT relies on the referrer to determine whether you're allowed through the paywall. Some image hosts use the referrer to detect hotlinking (and subsequently block the image). I regularly use a webshop that uses a payment processor that relies on the referrer to do something (I'm not sure what). So it's fairly rare, but it happens, on occasion.
- gcb 15y ago
  Because if it will make one site invest better in market after I gladly used its content for free, why not? I couldn't care less. Now, let's talk about sites that uses it, and other user inputs, for security...
craze3 15y ago
For those with SEO concerns: "This change will only affect the subset of SSL search referrers which already didn’t include the query terms. Non-HTTPS referrals will continue to behave as they do today." Scrape away my friends, scrape away.
AznHisoka 15y ago
Anyone know why Google doesn't show the referrer if you're logged in and it's organic result, but they do show it if they click on Adwords?
- adgar 15y ago
  > nyone know why Google doesn't show the referrer if you're logged in and it's organic result, but they do show it if they click on Adwords? Disclaimer: I'm a google engineer but don't know the answer at all and am just making a completely shot in the dark: maybe our new privacy policy has something to do with it? But yeah, since when you're logged in in the US you use SSL search, the current state of affairs is that you won't send referrers to organic results since you're on SSL. This change will make it so you send referrer data in both cases.
- gojomo 15y ago
  AdWords customers paid to get it.
gcb 15y ago
The refereer header is So important for google that 1) they actively removed 4 attempts to disable it chromium (the open source project, not their build of chrome) 2) they are now eliminating competition on their new analytics market by monopolizing it

38 points by cleverjake 15y ago

ck2 15y ago

Why on earth are people still allowing their referers to be sent to third party websites? It should be the first thing you disable. If a site insists on referers use an automatic spoofing plugin like RefControl.

untog 15y ago
Why on earth are people still allowing their referers to be sent to third party websites? Because they don't care? You might consider it a privacy must but plenty don't. I, for one, don't have a huge problem with sites knowing where I came from.
- coderdude 15y ago
  ck2 has 11K+ karma but a blank about section, which leads me to believe that he probably has exaggerated privacy expectations to begin with. Almost nobody outside of this vocal 'minerdity' cares about things like this.
  - ceol 15y ago
    I wouldn't consider any privacy expectations to be exaggerated— you can't have too much. I'm also sad to see you used ck2's karma/profile page to discredit their argument. ck2 could have phrased their post better (it came off somewhat condescending), but the meat of it is solid: Disabling referrer headers should be the first thing a privacy-minded person does.
    - coderdude 15y ago
      I didn't use his karma and profile to discredit his argument. I used his (perceived) exaggerated expectations of privacy -- which I garnered from both reading his comment and looking at his profile -- to discredit his argument. You are free to agree with him that you should disable your HTTP referrer header but it breaks the Web and is probably a sign of paranoia on some level or another. It really is quite innocuous.
      - ceol 15y ago
        > I didn't use his karma and profile to discredit his argument. I used his (perceived) exaggerated expectations of privacy -- which I garnered from both reading his comment and looking at his profile -- to discredit his argument. You assumed the type of person ck2 was from their karma and profile page and then discredited their comment because of that assumption; specifically, you called them a "vocal minerdity". To be honest, your reply to ck2 was little more than verbose name-calling and offered nothing of substance to the discussion. My apologies to the other HN readers for this derail. edit: That came off kind of harsh. I'm sure you meant well by your comment, but I don't think an appropriate reply to ck2 was to point to their profile and call them paranoid.
        coderdude 15y ago
        I don't mean any disparage on ck2, though I do completely disagree with him. "minerdity" (which I thought was rather clever, actually) is perfect for describing the minority of highly technical users that have deep-seated privacy issues. That determination didn't come from his profile. His comment said it all. He makes it sound like you'd have to be nuts or ignorant to not block the referrer and that's simply not the case. Sometimes you have to look at the person doing the talking and determine if they are biased or not. Like when someone with "I hate Microsoft" in their about is in a thread about Microsoft trying to explain to you why Windows is dying off. That was my determination, for better or for worse, I can't take it back now.
  - AgentConundrum 15y ago
    What does having a blank about section have to do with privacy. I've got less karma, ~2k or so, and my about section is blank as well. It's not a privacy thing, it's just that I'm not all that interesting.
    - coderdude 15y ago
      He's a top 100 user and he has a blank profile. You don't have to dig too deep to figure out why I believe that's unusual. Take a glance at the leaderboard and see how many people spend huge chunks of their days on here but don't even mention a Twitter account or name. Which is fine. I don't want this to turn into some thing where people think I'm bashing the guy for his profile.
- parfe 15y ago
  I recommend anyone interested in learning about online tracking to install Mozilla Collusion http://www.mozilla.org/en-US/collusion/ http://www.mozilla.org/en-US/collusion/ After seeing the amount of seemingly disparate information certain organizations can track (Google/Doubeclick, Discuss, Facebook, Twitter, etc) consider installing Ghostery http://www.ghostery.com/ http://www.ghostery.com/ Collusion takes seconds to install and you can forget about it for months while it builds an interactive web of tracking. Ghostery protects your privacy by blocking a large list of web spies.
  - coderdude 15y ago
    I've checked this out. It was pretty crazy to see how many domains get pinged when I visit a site. Just remember, o consumer of things but blocker of ads yet payer of nothing, that when enough people are gyping site owners out of what little revenue you even can earn from advertising you will cease to get your freebies but the agencies will not stop gathering your information.
    - ColdAsIce 15y ago
      Because fuck advertising. Site owners are not advertising companies.
  - abhaga 15y ago
    Is something similar to collusion available for Chrome?
    - jmilkbal 15y ago
      No, but a privacy conscious user would prefer to use Chromium which doesn't come with the Google privacy invasion built-in.
jonknee 15y ago
It's generally good for the web to know where traffic is coming from. For example, it would be quite frustrating to be linked on say Hacker News and not know it but still see your server sending out thousands and thousands of additional page views an hour.
dchuk 15y ago
that's like parking a mile away from a mcdonalds so no one knows where you came from. There's privacy and then there's paranoia...
- Terretta 15y ago
  You can park by the door, it still doesn't tell them where you came from.
- simcop2387 15y ago
  That's why I park at the wendy's across the street. That way no one knows I went to McDonalds.
cpeterso 15y ago
How often do you run into third-party websites that break without referer header?
- ordinary 15y ago
  In the 3 or so years I've used RefControl, I've added 5 exceptions. Sourceforge used to break (but not any more). NYT relies on the referrer to determine whether you're allowed through the paywall. Some image hosts use the referrer to detect hotlinking (and subsequently block the image). I regularly use a webshop that uses a payment processor that relies on the referrer to do something (I'm not sure what). So it's fairly rare, but it happens, on occasion.
gcb 15y ago
Because if it will make one site invest better in market after I gladly used its content for free, why not? I couldn't care less. Now, let's talk about sites that uses it, and other user inputs, for security...

craze3 15y ago

For those with SEO concerns: "This change will only affect the subset of SSL search referrers which already didn’t include the query terms. Non-HTTPS referrals will continue to behave as they do today." Scrape away my friends, scrape away.

AznHisoka 15y ago

Anyone know why Google doesn't show the referrer if you're logged in and it's organic result, but they do show it if they click on Adwords?

adgar 15y ago
> nyone know why Google doesn't show the referrer if you're logged in and it's organic result, but they do show it if they click on Adwords? Disclaimer: I'm a google engineer but don't know the answer at all and am just making a completely shot in the dark: maybe our new privacy policy has something to do with it? But yeah, since when you're logged in in the US you use SSL search, the current state of affairs is that you won't send referrers to organic results since you're on SSL. This change will make it so you send referrer data in both cases.
gojomo 15y ago
AdWords customers paid to get it.

gcb 15y ago

The refereer header is So important for google that 1) they actively removed 4 attempts to disable it chromium (the open source project, not their build of chrome) 2) they are now eliminating competition on their new analytics market by monopolizing it