5 ms·

I noticed the URL was updated for this post. Previously it linked to asahilinux.org which showed an anti-HN manifesto from the HN referral. Curious as I haven’t

I noticed the URL was updated for this post. Previously it linked to asahilinux.org which showed an anti-HN manifesto from the HN referral. Curious as I haven’t seen this before. Seems it has been covered by previous commenters: https://news.ycombinator.com/item?id=36227103 https://news.ycombinator.com/item?id=36227103

ginko 2y ago
How can the site even detect where a user is coming from? Browsers leaking this information seems like a huge privacy issue to me.
- robin_reala 2y ago
  Referer (misspelled in the spec) has been a part of HTTP from day 1.
  - ginko 2y ago
    Feels crazy this isn’t disabled by default
    - Smar 2y ago
      There is little hope to get it disabled when an ad company is running running the most popular ad platf... Erm, the world wide web browser.
      - jsheard 2y ago
        The Referrer-Policy header lets a server tell the browser how much referrer information to pass on when following links, all the way down to nothing at all if desired. Chrome does respect that, and they also followed other browsers in changing the default to "strict-origin-when-cross-origin" a few years ago which truncates the referrer path when leaving to a different domain, so they only see the domain the visitor came from rather than the specific page like they used to. Can't really fault Google in this case. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
    - paraboul 2y ago
      This is part of the web DNA. Pages linking pages and being aware about it. Origin can still disable it.
    - mananaysiempre 2y ago
      See[1] the Referrer-Policy header, <meta name="referrer">, <a referrerpolicy> and <a rel="noreferrer">. But generally, webmasters have found it useful to know who caused their server to fall over^W^W^W^W^W^W is linking to their pages. This was even used as a predecessor to pingbacks once upon a time, but turned out to be too spammable (yes, even more so than pingbacks). After the HN operators started adding rel=noreferrer to links to the Asahi Linux website, Marcan responded[2] by excluding anyone who has the HN submit form in their browser history, which feels like a legitimate attack on the browser’s security model—I don’t know how it’d be possible to do that. (Cross-origin isolation is supposed to prevent cross-site tracking of this exact kind, and concerns about such privacy violations are why SRI has not been turned into a caching mechanism along the lines of Want-Content-Digest, and so on and so forth.) ETA: This is no longer in place, it seems. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re... [2] https://social.treehouse.systems/@marcan/110503331622393719 https://social.treehouse.systems/@marcan/110503331622393719
      - miki123211 2y ago
        > I don’t know how it’d be possible to do that It isn't, at least not in the way you think. Visited links have always looked different from unvisited ones, and the moment you could customize how links looked via CSS, browsers also had to implement styling for visited links specifically. Modern browsers put a lot of care into making the changes to those styles observable to the user, but not to Javascript. This is an extremely hard problem, and browsers have had a lot of security issues related to this behavior. Nowadays, you can only apply a very limited subset of CSS properties to those styles, to avoid side-channel timing attacks and such. This means you can display a banner to anybody who has a certain URL in their browser history, but you can't observe whether that banner actually shows up with JS or transmit that information to your server.
        mananaysiempre 2y ago
        Ah. Ahhh[1]. I see. <!doctype html> <style>a { color: white; background-color: white; } a:visited { color: black; }</style> <body><a href="https://example.com/abracadabra" onclick="return false">you are a bad person</a> [1] https://developer.mozilla.org/en-US/docs/Web/CSS/:visited#privacy_restrictions https://developer.mozilla.org/en-US/docs/Web/CSS/:visited#pr...
    - bigstrat2003 2y ago
      Referer does have legitimate uses. For example, back in the day people would use it to detect if someone embedded an image from their site on another site. SomethingAwful famously used to respond to any such requests with goatse, and forums I was on had very strict "don't link to SA images" rules as a result. I think that using referer to try to deliver manifestos to users of another site is kinda childish, but so it goes. Every tool can be put to good or bad uses.
      - dylan604 2y ago
        It's only slightly less childish than the current WP drama.
    - npteljes 2y ago
      There's a handy addon for Firefox called Privacy Settings that can take care of that. Explicitly adds and option to have the referers be not sent, and a quick way of re-enabling it, in case it breaks a website. Because of course that happens too.
stepupmakeup 2y ago
The manifesto is longer than the content...
- tkel 2y ago
  [flagged]
fullstop 2y ago
It's almost as bad as jzw's website: https://cdn.jwz.org/images/2016/hn.png https://cdn.jwz.org/images/2016/hn.png (nsfw)
- hentrep 2y ago
  He does the same redirect whenever someone links to his DNA Lounge: https://dnalounge.com https://dnalounge.com (NSFW)
- justin66 2y ago
  It’s completely different. Jwz’s is funny.
deleted 2y ago
[deleted]
dang 2y ago
The URL wasn't updated. You're thinking of https://news.ycombinator.com/item?id=41799011 https://news.ycombinator.com/item?id=41799011, which was a separate post.
- hentrep 2y ago
  Ah, thanks for clarifying!

ginko 2y ago

How can the site even detect where a user is coming from? Browsers leaking this information seems like a huge privacy issue to me.

robin_reala 2y ago
Referer (misspelled in the spec) has been a part of HTTP from day 1.
- ginko 2y ago
  Feels crazy this isn’t disabled by default
  - Smar 2y ago
    There is little hope to get it disabled when an ad company is running running the most popular ad platf... Erm, the world wide web browser.
    - jsheard 2y ago
      The Referrer-Policy header lets a server tell the browser how much referrer information to pass on when following links, all the way down to nothing at all if desired. Chrome does respect that, and they also followed other browsers in changing the default to "strict-origin-when-cross-origin" a few years ago which truncates the referrer path when leaving to a different domain, so they only see the domain the visitor came from rather than the specific page like they used to. Can't really fault Google in this case. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...
  - paraboul 2y ago
    This is part of the web DNA. Pages linking pages and being aware about it. Origin can still disable it.
  - mananaysiempre 2y ago
    See[1] the Referrer-Policy header, <meta name="referrer">, <a referrerpolicy> and <a rel="noreferrer">. But generally, webmasters have found it useful to know who caused their server to fall over^W^W^W^W^W^W is linking to their pages. This was even used as a predecessor to pingbacks once upon a time, but turned out to be too spammable (yes, even more so than pingbacks). After the HN operators started adding rel=noreferrer to links to the Asahi Linux website, Marcan responded[2] by excluding anyone who has the HN submit form in their browser history, which feels like a legitimate attack on the browser’s security model—I don’t know how it’d be possible to do that. (Cross-origin isolation is supposed to prevent cross-site tracking of this exact kind, and concerns about such privacy violations are why SRI has not been turned into a caching mechanism along the lines of Want-Content-Digest, and so on and so forth.) ETA: This is no longer in place, it seems. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re... [2] https://social.treehouse.systems/@marcan/110503331622393719 https://social.treehouse.systems/@marcan/110503331622393719
    - miki123211 2y ago
      > I don’t know how it’d be possible to do that It isn't, at least not in the way you think. Visited links have always looked different from unvisited ones, and the moment you could customize how links looked via CSS, browsers also had to implement styling for visited links specifically. Modern browsers put a lot of care into making the changes to those styles observable to the user, but not to Javascript. This is an extremely hard problem, and browsers have had a lot of security issues related to this behavior. Nowadays, you can only apply a very limited subset of CSS properties to those styles, to avoid side-channel timing attacks and such. This means you can display a banner to anybody who has a certain URL in their browser history, but you can't observe whether that banner actually shows up with JS or transmit that information to your server.
      - mananaysiempre 2y ago
        Ah. Ahhh[1]. I see. <!doctype html> <style>a { color: white; background-color: white; } a:visited { color: black; }</style> <body><a href="https://example.com/abracadabra" onclick="return false">you are a bad person</a> [1] https://developer.mozilla.org/en-US/docs/Web/CSS/:visited#privacy_restrictions https://developer.mozilla.org/en-US/docs/Web/CSS/:visited#pr...
  - bigstrat2003 2y ago
    Referer does have legitimate uses. For example, back in the day people would use it to detect if someone embedded an image from their site on another site. SomethingAwful famously used to respond to any such requests with goatse, and forums I was on had very strict "don't link to SA images" rules as a result. I think that using referer to try to deliver manifestos to users of another site is kinda childish, but so it goes. Every tool can be put to good or bad uses.
    - dylan604 2y ago
      It's only slightly less childish than the current WP drama.
  - npteljes 2y ago
    There's a handy addon for Firefox called Privacy Settings that can take care of that. Explicitly adds and option to have the referers be not sent, and a quick way of re-enabling it, in case it breaks a website. Because of course that happens too.

stepupmakeup 2y ago

The manifesto is longer than the content...

tkel 2y ago
[flagged]

fullstop 2y ago

It's almost as bad as jzw's website: https://cdn.jwz.org/images/2016/hn.png https://cdn.jwz.org/images/2016/hn.png (nsfw)

hentrep 2y ago
He does the same redirect whenever someone links to his DNA Lounge: https://dnalounge.com https://dnalounge.com (NSFW)
justin66 2y ago
It’s completely different. Jwz’s is funny.

deleted 2y ago

[deleted]

dang 2y ago

The URL wasn't updated. You're thinking of https://news.ycombinator.com/item?id=41799011 https://news.ycombinator.com/item?id=41799011, which was a separate post.

hentrep 2y ago
Ah, thanks for clarifying!