21–30 of 56 posts
This feature allows a trivial DDOS attack to be constructed https://securityaffairs.co/wordpress/83890/hacking/ddos-html... https://www.nsaneforums.com/topic/341522-hyperlink-auditing-... you can always downgrade your FF version and turn off auto updates, or go to a custom palemoon, then have a chat with mozilla about why you did so.
> "We don’t believe that offering an option to disable this feature alone will have any meaningful improvement in the user privacy, since website can (and often already do) detect the various supported mechanisms for hyperlink auditing in each browser and disabling the more user friendly mechanisms will cause them to fall back to the less user friendly ones, without actually disabling the hyperlink auditing functiona…
Concerns about this were also the reason why toggling the sending of the DNT header was removed for example.
> "We don’t believe that offering an option to disable this feature alone will have any meaningful improvement in the user privacy, since website can (and often already do) detect the various supported mechanisms for hyperlink auditing in each browser and disabling the more user friendly mechanisms will cause them to fall back to the less user friendly ones, without actually disabling the hyperlink auditing functiona…
By making it possible to disable it, you are adding fingerprintable bits of entropy to your browser. Concerns about this were also the reason why toggling the sending of the DNT header was removed for example.
Probably good for the reasons you mention considering DNT is dead anyway.
The only legitimate reason to add this is that if some browsers have it and some don't usability will be better on some browsers than on others.
This is a prisoner's dilemma. Or was.
> "We don’t believe that offering an option to disable this feature alone will have any meaningful improvement in the user privacy, since website can (and often already do) detect the various supported mechanisms for hyperlink auditing in each browser and disabling the more user friendly mechanisms will cause them to fall back to the less user friendly ones, without actually disabling the hyperlink auditing functiona…
The browser still reports “ping” as usable so no blocking of the user or expensive (resource wise) js alternatives, but when you click the link the URL is evaluated as being blocked and safari does nothing relating to the ping.
This isn’t theory, I’ve tested it and it works.
I don’t know enough about blocking capabilities in Firefox to theorise how it would work there.
As explained in the article, the same data is already being collected without the use of 'ping', so refusing to support ping is nothing but privacy theater (a la "security theater") --- at the cost of user experience. I'm disappointed to see Brave playing that game.
As explained in the article, the same data is already being collected without the use of 'ping', so refusing to support ping is nothing but privacy theater (a la "security theater") --- at the cost of user experience. I'm disappointed to see Brave playing that game.
Not supporting it means sites without tracking have better user experience. Now tracking is natively supported, everyone can just start doing tracking without any of the disadvantages.
This feature allows a trivial DDOS attack to be constructed https://securityaffairs.co/wordpress/83890/hacking/ddos-html... https://www.nsaneforums.com/topic/341522-hyperlink-auditing-... you can always downgrade your FF version and turn off auto updates, or go to a custom palemoon, then have a chat with mozilla about why you did so.
If it does have an advantage, it's probably just something incidental like particular HTTP proxies being configured to let pings through, or something like that.
The ping attribute replaces redirects and JavaScript that already allow (and are very widely used for) less performant ways of doing exactly the same tracking. An explicit ping attribute makes it easier for content blockers; with a redirect there's nothing you can do but with a declarative attribute it's clear what to block. This seems very clearly better to me.
Does anyone want the ping attribute? It seems like JS-based trackers using sendBeacon are the better option for analytics.
I implement these kinds of trackers, and right now, my choices look like this:
1. Use a redirect:
link
2. Use JavaScript:
link
3. Use CSS:
a:active{background-image:url(trackingurl) !important;};
4. Use ping:
link
However I appreciate to some people "anyone" might not include the people who write the content you're reading -- after all, if you don't care about them, then surely there isn't "anyone" who wants this, but this is immature. These are most certainly people, and these are the people that want this: People who know about other methods and have thought about the risk/reward of using them.