Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I’ve banned query strings

chrismorgan.info

Post reply on HN
Print view View original

301–310 of 317 posts

Re: I’ve banned query strings

#301

Post by nofriend »

chii wrote: post #220
nofriend wrote: post #164

Earlier quoted context omitted.

>It’s possible that the teams you work with expect fuzzy behaviour from the website but that’s a choice, not a practice. This is how the vast majority of websites work. The practical reason is obvious: when we model the behaviour our code depends on, we want to create the simplest possible model that allows our code to work as expected. Placing requirements on it that our code doesn't actually depend on is useless, u…

> there is no security benefit to filtering out unneeded url parameters. there is - security in depth. If a url parameter would've been a vulnerability because something lower down the stack misinterprets it (and the param wasn't necessary for your app in the first place), then you've just left a window open for the exploit. If the set of url params are known ahead of time (which i claim should be true), then you cou…

>If a url parameter would've been a vulnerability because something lower down the stack misinterprets it

By assumption, you are using this url parameter. So you have a bug where you've forgotten to allow this parameter, which will quickly be discovered in your logs and fixed. Then the vulnerability, which you are thus far unaware of, will quickly be exposed. Those url parameters you are not using cannot hurt you.

Re: I’ve banned query strings

#302

Post by chrismorgan »

fragmede wrote: post #291
chrismorgan wrote: post #247

Earlier quoted context omitted.

I started writing a follow-up half an hour before you posted, since the parent comment has been unusually highly voted. I dropped it again, but now you’ve given me something to respond to. I say I’m broadly anti-tracking. I think it’s clear by this point to anyone with a skerrick of wisdom that the logical extreme of tracking is bad. But for a long way it seems innocuous. So how far do you go before declaring it unac…

> C’est la vie. I’ll survive. Will you? You made a widget and you're trying to sell it. You've taken out a second mortgage on your house, and used up all your savings. You're down to your last $10,000. If you don't start making sales soon, you're sunk. Where do you spend that $10,000? Facebook? Instagram? Google? TikTok? If you don't know where your leads are coming from, how do you know where to spend your marketing…

I can’t imagine myself ending up in your scenario: I’m not interested in unbridled growth, if I sell things I want to be able to at least broadly know my customers, so I’ll know where they are in that situation. Besides which I’m never going to be doing that kind of advertising, cost-per-click and such—I consider it a blight on society wholly devoid of virtue, so I’ll not be a hypocrite and use it for my own gain.

It’s an unconventional pathway, but I have complete faith that it will work out. Not always in the ways I expect or prefer, but it will work out.

(Even humanly speaking, your protagonist sounds incompetent—just throwing money at marketing is very ineffective, you want to target and approach different platforms differently, and if you don’t know which of Facebook, Instagram, Google or TikTok will be the best venue to spend your last coins, I think you deserve to fail.)

More generally, these three snippets from the Bible accurately convey my attitude:

> The LORD will provide. — Genesis 22:14

> I have been young, and now am old, yet I have not seen the righteous forsaken, nor his children begging for bread. — Psalm 37:25

> We walk by faith, not by sight. — 2 Corinthians 5:7

This genuinely is how I try to live my life. I’ve seen it work in my parents before me and in a few others’ lives, in anecdotes of grand- and great-grandparents and beyond. (It’s even why I, an Australian by birth, now live in India.)

Re: I’ve banned query strings

#303

Post by cobbzilla »

losvedir wrote: post #251
cobbzilla wrote: post #83

Earlier quoted context omitted.

Maybe dumb question: how does the server “decide” anything other than what file to serve? Today we have many choices but back in the day CGI was the first standard way to do it. So yes query parameters existed before CGI but to use them you had to hack your server to do something with them (iirc NCSA web servers had some magic hacks for queries). CGI drove standardization.

TCP has been around a long time. Listen, read, send, you're good to go. It's just software so you can make it do anything. But you're asking about the relationship between popular primarily file serving servers like Apache and their relationship to high level code to create custom responses? Yeah, CGI was the first big standard there that I remember, though it was a bit before my time. But that's only one possible ar…

I was responding to:

> Query strings existed before CGI did… There's nothing wrong about having things decided by the server

Sure, but there is also no standard for how to format/parse the query string. And also no server plugin frameworks. So you are inventing your own standard and extending some HTTP server for which you have source. Until CGI forces a standard, bad as it might be; it’s a common ground.

Re: I’ve banned query strings

#304

Post by rswail »

tacitusarc wrote: post #260
rswail wrote: post #228

Earlier quoted context omitted.

204 No Content for nothing found is both not an error (because 2xx code) but also indicates there was nothing found to match the request. If it's an API, a 200 with an empty JSON object or array in the body is legitimate as well, but a 204 is explicit.

This too is not spec compliant. 204 means the request was successful but no body is being returned in the response.

Which is the equivalent of nothing found matching the request in a collection.

The alternate is basically 200 OK

followed by a JSON body of:

[]

Re: I’ve banned query strings

#305

Post by SebastianKra »

fragmede wrote: post #290
SebastianKra wrote: post #262

Earlier quoted context omitted.

Textbook marketing speak: “Don't you want more relevant ads?”. It assumes that “ads” = useful information, but that's rare at best. Most ads focus on stealing your attention and creating a fear of missing out. NordVPN isn't educating you. They just manufacture a need and then hope that you won't invest time in researching a better option. Why would I give them more leverage to do that?

Is it that rare? Sure, there's no advertising profile for "hates VPN ads" but eg an adult male doesn't want ads for women's period pain medication and similarly an adult woman doesn't want ads for male testosterone or other male-coded enhancements ads. Then you get into niche interests like fishing or sewing or 3d printing.

You're conflating correctly targeted ads and useful information.

If you sell gambling ads to an addicted gambler, the gambler doesn't get useful information.

Niche interests might get a pass. But then again: if I’m getting an ad for a 3D printing product on a 3D printing review site, its very likely that the advertised product wasn’t actually the best and is just artificially pushed on me.

Re: I’ve banned query strings

#306

Post by mb2100 »

wongarsu wrote: post #63
jedimastert wrote: post #20

You know I was actually really curious about this so I went back to the HTML and URL W3C standards and surprisingly they don't actually have any definitions of format other than being percent encoded. One might conflate query strings with "form-urlencoded"[0] query strings, which is one potential interoperability format, but in general a queries string is just any percent encoded string following a "?" in a url[1], a…

Back in the day it was reasonably common for CMSs and forums to only have an index.php, and routing entirely by query string (in form-urlencoded form, people were not savages). So you would have index.php?p=home and index.php?p=shop. Or index.php?action=showthread&forum=42&thread=17976. It should be immediately obvious that in that scheme 404 is indeed the correct answer to unknown query parameters In fact lots of si…

That's because Apache is basically what today's JS crowd would call a "file-based router", and then the app implements the actual routing in that index.php file. Just like early SPA stored the route in a hash. It's funny how history repeats itself.

I've gone back and forth on file-based vs programmatic routing. But each has pros and cons, so in the end I implemented both in Mastro: https://mastrojs.github.io/docs/routing/

Re: I’ve banned query strings

#307

Post by tedbradley »

chrismorgan wrote: post #247
tedbradley wrote: post #244

Earlier quoted context omitted.

I understand being for privacy, but on the flip side, information about you can result in a better experience. E.g. in the case of tracking where a person comes from, that can help those two websites improve by coordinating with each other in some way. Or your ads might actually show you something you didn't know you existed that you end up buying. That's probably better than seeing ads you likely have zero interest…

I started writing a follow-up half an hour before you posted, since the parent comment has been unusually highly voted. I dropped it again, but now you’ve given me something to respond to. I say I’m broadly anti-tracking. I think it’s clear by this point to anyone with a skerrick of wisdom that the logical extreme of tracking is bad. But for a long way it seems innocuous. So how far do you go before declaring it unac…

What would you consider the "extreme of tracking?" Anyway, I feel like we're dealing with Sorites paradox here, which is something my brother always freaks out over whenever there is a continuum of choices in something like a political argument. E.g. "Tax the rich" → "What is rich?!?" When someone says, "Tax the rich," they generally mean people with dozens of millions in net worth growing fast all the way up to the people who have hundreds of billions. I don't understand why that conversation repeatedly comes up with him. He's also into the slippery slope where, if you like the idea of a wealth tax, he cries bloody murder since income tax started out only on the richest salaries in the nation. So he reasons that... everyone will eventually have a wealth tax instead of it just being the people with billions of dollars who have paid like 1% tax per year due to their net worth being tied up in unsold stocks.

So if I'm going to pick your brain, what would a realistic extreme of tracking look like? You have to log in with your state-issued identity to enter the internet, and systems track absolutely everything you do? Sure, that sounds bad. I can admit that. But I don't feel like having a "?=example.com" is anywhere near that, if you get what I mean.

Do you find it moral to block ads? By that point, you are using free services without paying as intended. Or do you mean you buy YT premium and Twitch Turbo and Spotify premium and all those monthly bills that both block ads while sustaining the services you apparently enjoy using?

Re: I’ve banned query strings

#308

Post by cx42net »

wodenokoto wrote: post #154

So my understanding is, he is annoyed that other website adds a query string such as "?ref=origin.com" to links pointing to authors website. How does this benefit the other website? How does this hurt the authors website? I am completely confused about the behavior of both side here. I get that when I run an ad-campaing I want google to add a utm-query string, so I can track which campaign users arrived from - but th…

I agree with you here, this is an odd reaction to a non-problem.

A real-life scenario would be to refuse your snail mail because someone added an extra line in your address.

The only plausible reason would be to avoid polluting the data (like faking the ref= for marketing purpose) but that would assume you are already tracking the ref value for other services, so in a way, you either need it or not, but you can't have both.

If you don't actively track query strings, having them or not has no impact.

Re: I’ve banned query strings

#309

Post by greybeard69 »

rswail wrote: post #228
Semiapies wrote: post #84

Earlier quoted context omitted.

If you're routing like it's 1999, sure, 404. On the other hand, if it's a CRUD app and you're filtering a list of entities by various field values? Returning that no items matched your selection (or an empty list, if an API) makes more sense than a 404, which would more appropriate for an attempt to pull up a nonexistent entity URI.

204 No Content for nothing found is both not an error (because 2xx code) but also indicates there was nothing found to match the request. If it's an API, a 200 with an empty JSON object or array in the body is legitimate as well, but a 204 is explicit.

My rule of thumb is that if you want to keep your code clean, always returning an empty collection is preferable to returning an empty response on that branch. You don't need a guard clause to null/undef-check before consuming the result. The rule applies whether we're consuming the response from a repository or an http request.

Re: I’ve banned query strings

#310

Post by miguel-muniz »

I've created a bookmarklet that just appends a date query string (?date=05112026) to my current tab's URL. My bookmark manager Raindrop will recognize this as a completely different page, so I can easily create a duplicate entries for the same page. I don't think many people mention it, but Raindrop creates archives of every entry, so I end up with sort of my own personal Wayback Machine. The author has successful thwarted me though.
Post reply on HN