3 ms·

This a very good intro. Readable, fun and concise. Something that caught my eye though: links now have a rel="noreferrer" option. This sounds like a pretty ba

by mustpax 17y ago

This a very good intro. Readable, fun and concise. Something that caught my eye though: links now have a rel="noreferrer" option. This sounds like a pretty bad idea. It's not supported by any browsers yet, but if it worked it would blank out the referrer field on HTTP requests you make after clicking on a link. There are only two use cases I can imagine: 1. You have some super-secret URL's that are not protected by any other authentication method, you want to avoid others sniffing them out from the referrer field. Verdict: your security is broken and cannot be saved by any standards body. 2. You're hosting a site with malicious XSS-loaded links and want to hide your tracks. OR you are executing CSRF attacks and want to hide your tracks. Verdict: this rel value is perfect for you.

subwindow 17y ago
A lot of forums and blogs would prefer that some sites not know that they are talking about them. I've come across it several times and doesn't seem like such a bad thing.
- mustpax 17y ago
  From the vagueness of your statement, it sounds like these forums fall into the second category of being up to no good in the first place.
  - dwiel 17y ago
    aka: "if you aren't doing anything wrong, what've you got to hide"
    - bd 17y ago
      Not necessarily "wrong". For example, you could have an internal company wiki which would include links to competitor's site.
    - mustpax 17y ago
      Unfortunately, public protocols like HTTP need to manage communication between parties that do not trust each other. This is not a legal matter, so there is no necessity to establish motives or plausibility. A secure protocol is charged with limiting the damage any malicious party using the protocol might do. This addition to the spec is contrary to that fact. Allowing a site to scrub its outgoing connections assumes a certain level of trust, which on the web ought not exist by default.

by mustpax 17y ago

subwindow 17y ago

A lot of forums and blogs would prefer that some sites not know that they are talking about them. I've come across it several times and doesn't seem like such a bad thing.

mustpax 17y ago
From the vagueness of your statement, it sounds like these forums fall into the second category of being up to no good in the first place.
- dwiel 17y ago
  aka: "if you aren't doing anything wrong, what've you got to hide"
  - bd 17y ago
    Not necessarily "wrong". For example, you could have an internal company wiki which would include links to competitor's site.
  - mustpax 17y ago
    Unfortunately, public protocols like HTTP need to manage communication between parties that do not trust each other. This is not a legal matter, so there is no necessity to establish motives or plausibility. A secure protocol is charged with limiting the damage any malicious party using the protocol might do. This addition to the spec is contrary to that fact. Allowing a site to scrub its outgoing connections assumes a certain level of trust, which on the web ought not exist by default.