5 ms·

Why do we still have referrers? They don't allow us to do anything that we wouldn't be able to do without them. If Mozilla and Google made a statement today say

Why do we still have referrers? They don't allow us to do anything that we wouldn't be able to do without them. If Mozilla and Google made a statement today saying, "We'll be removing referrers from cross site requests in 6 months time for Chrome and Firefox.", the tiny tiny proportion of sites that are using them for real functionality will have plenty of time to update. Of course, as a web developer, it's useful to be able to see where people came from. But we don't have any right to that information. As an end-user, why the hell is my browser giving you this information for no reason when it doesn't have to? I've been using RefControl for Firefox for years now. It fakes the referrer, setting it to the root of the domain being requested. This hasn't ever caused me any problems, so there can't be that many sites that rely on it. I don't give a shit about your analytics or how much money you think you'll lose from referrers disappearing. Privacy is more important.

leephillips 13y ago
You ask, "Why do we still have referrers?", but then you answer your question: "as a web developer, it's useful to be able to see where people came from." You are of course correct that we don't have a "right" to this information. But I've discovered, many times, through the referrers in my logs, links to my pages from some very interesting places that I might not have discovered otherwise (because the link information that Google discloses is woefully incomplete). Any user who wants to hide referrer information can easily to do in a variety of ways. For example, I wrote a bookmarklet that does this for you: http://lee-phillips.org/norefBookmarklet/ http://lee-phillips.org/norefBookmarklet/
- mike-cardwell 13y ago
  Defaults are important. Most users of the web don't know referrers exist. It's irrelevant how useful you find the information. You'd probably find it useful to know the name and email address of everyone that visits your site too... So?
JohnTHaller 13y ago
For lots of us using basic CDN services, we enable referrer checks to ensure that folks aren't hotlinking images or direct linking downloads from other sites. These CDNs allow basic blocking based on referrers. You usually set it to only permit when there is a referrer from your own domain as well as blank referrers (if the CDN supports it) since most privacy conscious folks will disable referrer rather than fake it. We don't actually care that you don't provide a referrer, we just don't want other sites using our images in their own pages (leeching our bandwidth we pay for) or direct linking to binary downloads (bypassing our site with our advertising or revenue possibilities or branding but using our bandwidth).
- chavesn 13y ago
  I can think of one more; some sites use referrer to allow you to bypass a paywall if (and only if) you came from search results. The problem is, all of these "features" allowed by referrers are user-hostile actions. If referrers went away tomorrow, users wouldn't notice the difference or care. Publishers would get angry and think "we can't milk our content/visitors for as much money anymore!" But that doesn't really change the relationship with the customers who value your product or business so I personally can't believe it will make a sizable difference in the end.
  - JohnTHaller 13y ago
    It's only hostile to sites that try and steal bandwidth resources by hotlinking/leeching images or direct linking downloads. It's not about milking visitors. It's about preventing unethical behavior by other sites. I've spent 10s of thousands of dollars hosting free and open source software for millions of people over the years and I make sure to prevent bandwidth theft from other sites that cut into my ability to provide that service. Ad revenue (all responsible ads... no popups, no sound, etc) doesn't cover the cost of hosting and bandwidth even when sites are prevented from being unethical. Take away referrers and it will be replaced by more complicated technology that serves the same purpose. CDN providers have secure links, for instance, that use an API to allow sites to generate a one-time use or limited time window link for a download from the CDN of a given file. It's more complex, but it's what I'd switch to tomorrow for downloads if referrers went away.
j_s 13y ago
Google is already killing referrer on search results (by redirecting), to force people to pay for Analytics
- ceejayoz 13y ago
  I'd pay for an intermediate level of GA in a heartbeat. Right now, once you hit 10M pageviews a month you either have to sample or pay $150k/year for Premium. I don't need support, an account manager, four-hour turnaround on data, an SLA, etc. I just need more pageviews sometimes.
  - richbradshaw 13y ago
    Set up 2 GA accounts, then in your embed give even IP addresses version 1, and odd ones version 2, then you can track 20M pageviews. Admittedly it's a little rubbish. Guess you could use the API to combine them again for your own backend use.
    - ceejayoz 13y ago
      Clients aren't huge fans of the "check both of these accounts and sum them together" approach, and ours like direct access so the API isn't a great solution. I've heard that running a $10/month AdWords campaign gets you higher caps, but it may be an internet old wives tale.
  - dangayle 13y ago
    Hate to burst your bubble, but even the premium GA uses samples. They don't give you a firehose of real data.
    - ceejayoz 13y ago
      Some of the reports, yes, but not overall pageviews. Per their capabilities page: > 1 billion hits per month > Up to 3 million rows of data in unsampled reports If you're doing conversion tracking etc. you're going to start getting sampled data at some point, but it's the pageviews our folks care for.
reginaldjcooper 13y ago
I use a RefControl and just don't send the header, although I feel that's close to being the least of my worries. I just thought I'm already using NoScript, AdBlock, RequestPolicy, BetterPrivacy, Cookie Monster, Blender, and HTTPS-Everywhere; might as well go all-in.

leephillips 13y ago

You ask, "Why do we still have referrers?", but then you answer your question: "as a web developer, it's useful to be able to see where people came from." You are of course correct that we don't have a "right" to this information. But I've discovered, many times, through the referrers in my logs, links to my pages from some very interesting places that I might not have discovered otherwise (because the link information that Google discloses is woefully incomplete). Any user who wants to hide referrer information can easily to do in a variety of ways. For example, I wrote a bookmarklet that does this for you: http://lee-phillips.org/norefBookmarklet/ http://lee-phillips.org/norefBookmarklet/

mike-cardwell 13y ago
Defaults are important. Most users of the web don't know referrers exist. It's irrelevant how useful you find the information. You'd probably find it useful to know the name and email address of everyone that visits your site too... So?

JohnTHaller 13y ago

For lots of us using basic CDN services, we enable referrer checks to ensure that folks aren't hotlinking images or direct linking downloads from other sites. These CDNs allow basic blocking based on referrers. You usually set it to only permit when there is a referrer from your own domain as well as blank referrers (if the CDN supports it) since most privacy conscious folks will disable referrer rather than fake it. We don't actually care that you don't provide a referrer, we just don't want other sites using our images in their own pages (leeching our bandwidth we pay for) or direct linking to binary downloads (bypassing our site with our advertising or revenue possibilities or branding but using our bandwidth).

chavesn 13y ago
I can think of one more; some sites use referrer to allow you to bypass a paywall if (and only if) you came from search results. The problem is, all of these "features" allowed by referrers are user-hostile actions. If referrers went away tomorrow, users wouldn't notice the difference or care. Publishers would get angry and think "we can't milk our content/visitors for as much money anymore!" But that doesn't really change the relationship with the customers who value your product or business so I personally can't believe it will make a sizable difference in the end.
- JohnTHaller 13y ago
  It's only hostile to sites that try and steal bandwidth resources by hotlinking/leeching images or direct linking downloads. It's not about milking visitors. It's about preventing unethical behavior by other sites. I've spent 10s of thousands of dollars hosting free and open source software for millions of people over the years and I make sure to prevent bandwidth theft from other sites that cut into my ability to provide that service. Ad revenue (all responsible ads... no popups, no sound, etc) doesn't cover the cost of hosting and bandwidth even when sites are prevented from being unethical. Take away referrers and it will be replaced by more complicated technology that serves the same purpose. CDN providers have secure links, for instance, that use an API to allow sites to generate a one-time use or limited time window link for a download from the CDN of a given file. It's more complex, but it's what I'd switch to tomorrow for downloads if referrers went away.

j_s 13y ago

Google is already killing referrer on search results (by redirecting), to force people to pay for Analytics

ceejayoz 13y ago
I'd pay for an intermediate level of GA in a heartbeat. Right now, once you hit 10M pageviews a month you either have to sample or pay $150k/year for Premium. I don't need support, an account manager, four-hour turnaround on data, an SLA, etc. I just need more pageviews sometimes.
- richbradshaw 13y ago
  Set up 2 GA accounts, then in your embed give even IP addresses version 1, and odd ones version 2, then you can track 20M pageviews. Admittedly it's a little rubbish. Guess you could use the API to combine them again for your own backend use.
  - ceejayoz 13y ago
    Clients aren't huge fans of the "check both of these accounts and sum them together" approach, and ours like direct access so the API isn't a great solution. I've heard that running a $10/month AdWords campaign gets you higher caps, but it may be an internet old wives tale.
- dangayle 13y ago
  Hate to burst your bubble, but even the premium GA uses samples. They don't give you a firehose of real data.
  - ceejayoz 13y ago
    Some of the reports, yes, but not overall pageviews. Per their capabilities page: > 1 billion hits per month > Up to 3 million rows of data in unsampled reports If you're doing conversion tracking etc. you're going to start getting sampled data at some point, but it's the pageviews our folks care for.

reginaldjcooper 13y ago

I use a RefControl and just don't send the header, although I feel that's close to being the least of my worries. I just thought I'm already using NoScript, AdBlock, RequestPolicy, BetterPrivacy, Cookie Monster, Blender, and HTTPS-Everywhere; might as well go all-in.