Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 59 to strip path information from referrer values for 3rd parties

blog.mozilla.org

Post reply on HN
Print view View original

221–230 of 236 posts

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#221

Post by taneq »

girvo wrote: post #175
taneq wrote: post #121

Earlier quoted context omitted.

If I can go through your underpants drawer then I'll know the right kind of underpants to try and sell you. That means it's OK, right?

(Tangent, but I’ve never found this particular example compelling. All that’s in my underwear drawer is underwear... and I don’t find that particularly embarrassing? I think I’m missing some cultural context for it)

It's a mild, nonspecific stand-in for whatever it is that you really don't want people knowing. Whether that's your weird fetish or your embarrassing hobby or the fact that you worked as a pianist in a brothel or whatever.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#222

Post by Sylos »

jacquesm wrote: post #195
Fnoord wrote: post #174

Earlier quoted context omitted.

Agreed, but the short-term loser of this change is the non-technical customer who's workflow is suddenly broken, and only in Firefox, and only in version 59. Apparently only in Private Mode though which makes my use case probably less common. Thing is, do you remember the uproar about addons being broken in Firefox 57? It was for good (security) reasons but many non-technical users don't understand or respect the pro…

Even I as a technical user saw my workflow broken and to this day it hasn't been resolved. So point taken. Also: I'm not convinced that the FF57 reasons were as good as stated, it seemed mostly a case of 'we can therefore we do and here are some reasons to make you feel good'. A backwards compatibility switch to override the change would have been the least. Only Microsoft seems to really understand backwards compati…

> A backwards compatibility switch to override the change would have been the least.

They changed so much in the code base which broke compatibility with the old system that they would have pretty much had to do a hard fork and include both Firefox versions into the download in order to provide this; pretty much doubling maintenance cost as well.

On the flip side, they do now actually have an actual extension API, abstracting away from that code base, making it much more unlikely that such a breakage will be necessary in the future, and it especially also prevents those frequent smaller breakages that were commonplace with every new Firefox release up until 57.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#223

Post by Sylos »

ecthiender wrote: post #165

Why is this being only implemented in private browsing mode and not in the normal mode? IMO, this should be the default.

1) It breaks some webpages, so they probably only want to have it where it's relatively clear that users will prefer their privacy over not having breakages.

2) It pisses off webpage owners, as it hampers their analytics and probably ad revenue. If webpage owners are too pissed off by Firefox or simply don't make enough revenue from it, they'll stop testing/building their webpage against it, which leads to broken webpages in this way as well.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#225

Post by rkagerer »

This might be a dumb question but does whether a site uses SSL have any impact on browser behavior concerning query strings?

Seems counterproductive my browser is taking so much care to encrypt my querystrings then leaking them to any host from which the site I'm visiting happens to pull content.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#226

Post by sologoub »

Feniks wrote: post #201
sologoub wrote: post #144

Earlier quoted context omitted.

If only it was true... quite the opposite is the case at least in US: https://medium.com/@philipn/want-to-see-something-crazy-open...

Oh yeah the US is a lost case.

Don’t give up so easily. Anything can be changed, provided enough people want to change it. Most undesirable practices only happen because they operate in the shadow of general ignorance and/or oblivion to their existence.

As generations that understand this tech implicitly come to power, things will change. To someone that does everything digitally the meaning of these words will be quite different than the currently accepted interpretation:

“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#227

Post by cptn_brittish »

ryandrake wrote: post #63
danso wrote: post #37

Earlier quoted context omitted.

In the U.S., apparently both "Phillip" and "Philip" are equally popular: https://www.ssa.gov/oact/babynames/ Edit: I'm glad you made this comment. I only know people with the name "Phillip" but I constantly find myself double-checking how their name is spelt before I refer to them (in text). I chalked it up to me being a bad friend but I guess it doesn't help that I might be seeing enough of the "Philip" variation to…

Popularity and correctness are often confused, especially online :)

Except spelling is a popularity contest with the one in largest use being considered the way to spell it.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#228

Post by Sylos »

staunch wrote: post #67
StavrosK wrote: post #62

Earlier quoted context omitted.

You mean like the "tracking blocker" that is built-in to Firefox?

No. I obviously mean real ad blocking that users are currently required to install as a third-party Firefox extension. You don't find it curious that Mozilla has made the decision not to implement the most user-demanded browser feature for over a decade? https://addons.mozilla.org/en-US/firefox/

Webpage owners need a way to make money. A whole class of webpages, those that are financed by ad revenue, would stop being tested/built against Firefox. They might even block Firefox users from accessing their webpage, so that people switch to other browsers which do make them money. They have no real reason not to block them.

There's a whole load of politics like this in being a browser vendor. Just because users demand a change, does not mean that it's the best for users. Users want broken webpages even less than they want ads, they are just too short-sighted to realize that blocking ads will lead to that.

And Mozilla really is already gambling hard with such things as Tracking Protection or this referrer blocking when Chrome has no such restrictions in place and has the majority market share. For many webpage owners, blocking Firefox users would probably not even drop their revenue by 10%. Leaving it unmaintained much less so, in the short term.

So, unless Mozilla manages to create perfect compatibility with Chrome, they cannot afford to block revenue from webpages. And creating perfect compatibility with Chrome would also mean blindly following all of Chrome's webstandard choices, ingraining tracking- and ad-supporting technologies into the web, which again would be shit for users in the long run. And really, just use a Chromium-fork, if this is what you're looking for. You don't need Firefox for that.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#229

Post by Sylos »

ospider wrote: post #105

This feature should be easily implemented by a extension for Google Chrome using the webRequest API

Well, yeah, the feature itself is not a particular accomplishment, really it's been in Firefox for years, you just had to enable it with some about:config-flag.

The big news is them enabling it by default in some fashion (that is when you're in Private Browsing), meaning that all users now have this, not just the 0.1% who understand referrers (and have not forgotten to enable this the last time they installed Firefox).

As a power user who knew about this, you might not particularly care, but for users in general it's great, while it pisses off webpage owners.

Then again, even as a power user it's impossible for you to know about all of these sort of config options, so you might care to use a browser which tries to help its users out while having to keep an eye on not pissing off webpage owners too much, rather than a browser that tries to maximize revenue for webpage owners while trying its best to hide all the ways it infringes privacy from its users.

Re: Firefox 59 to strip path information from referrer values for 3rd parties

#230

Post by fulafel »

JepZ wrote: post #22
weinzierl wrote: post #2

> To help prevent third party data leakage while browsing privately , Firefox Private Browsing Mode will remove path information from referrers sent to third parties starting in Firefox 59. Emphasis mine. It only does it in private mode. I experimented with the referrer options mentioned in the article with mixed success. Not sending the referer header breaks some sites and often in a non-obvious way. EDIT: referrer…

Well, probably I would be fine if they would remove the referrer completely (if it has a different domain than the current site, otherwise they might notice the tampering). After all the referrer is useful for the site owner, not for the browser user.

Referrer checking is a standard way to avoid CSRF vulnerabilities.

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(...

Post reply on HN