Slashdot Log In
Firefox 's Ping Attribute: Useful or Spyware?
Posted by
CmdrTaco
on Wed Jan 18, 2006 10:00 AM
from the wear-your-foil-hats dept.
from the wear-your-foil-hats dept.
An anonymous reader writes "The Mozilla Team has quietly enabled a new feature in Firefox that parses 'ping' attributes to anchor tags in HTML. Now links can have a 'ping' attribute that contains a list of servers to notify when you click on a link. Although link tracking has been done using redirects and Javascript, this new "feature" allows notification of an unlimited and uncontrollable number of servers for every click, and it is not noticeable without examining the source code for a link before clicking it."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Firefox's Ping Attribute: Useful AND Spyware (Score:5, Insightful)
It's simply the user's choice as to whether or not the pros outweigh the cons. And I'm sure the massive response that ensues on Slashdot will reveal that everyone values these pros and cons differently.
Doesn't seem to be much argument other than I think they should have a very simple way to disable this if the user so chooses. As with the iTunes fiasco [slashdot.org], I would recommend Firefox be distributed with this option disabled.
Re:Firefox's Ping Attribute: Useful AND Spyware (Score:5, Funny)
Parent
Re:Firefox's Ping Attribute: Useful AND Spyware (Score:4, Insightful)
Parent
Re:Firefox's Ping Attribute: Useful AND Spyware (Score:4, Insightful)
Parent
Re:Don't like Firefox spyware? Use Konqueror (Score:5, Insightful)
Acid2 only measures the particular edgecasitis that the Acid2 authors managed to think of - web developers seem capable of introducing many more. What's needed isn't more acid tests but a W3-approved regression suite.
Parent
Re:Don't like Firefox spyware? Use Konqueror (Score:5, Interesting)
Think of it this way - if you had a popup every time a local application wanted to communicate with the hard disk, how quickly would you become angry?
Parent
Re:Firefox's Ping Attribute: Useful AND Spyware (Score:5, Insightful)
Parent
RTA (Score:5, Informative)
Parent
Re:RTA (Score:5, Informative)
Parent
Re:RTA (Score:5, Informative)
Sure your one redirect query may not effect you much but tens of thousands of people doing it could slow a server right down.
Parent
You can already do this with Javascript (Score:5, Interesting)
Are you also recommending that Firefox be distributed with Javascript disabled? Because this ping functionality is easy enough to implement in javascript. If ping is disabled by default, then nobody will have it enabled, which means that web developers will continue to do it the old fashioned way, and the ability to disable ping will be worthless.
Doug Moen.
Parent
Re:You can already do this with Javascript (Score:4, Informative)
Use the Firefox NoScript extension and you can be selective about what javascript you run on a per-site basis.
Parent
Re:You can already do this with Javascript (Score:4, Interesting)
I know that I HAVE JavaScript disabled (using the NoScript extension) for this and other reasons, and I don't want to have that functionality back whithout me noticing.
Hurga
Parent
Re:You can already do this with Javascript (Score:5, Insightful)
Bypassed? That may demand definition, for example,
Where does http://tinyurl.com/161 [tinyurl.com] go?
How about http://freshmeat.net/redir/cexec/57387/url_homepa
How do you know without making a URL connection?
Oh sure, you can ignore links that look like that, and even block them. Nobody's suggesting that you cannot block PING-requested URLs.
But bypassed? What exactly could you mean by this?
Parent
Re:You can already do this with Javascript (Score:5, Interesting)
Parent
it's all about Google adwords (Score:5, Interesting)
I think the main developer who would want to use it is Google with their adwords program. They're probably trying to minimize the bandwidth those redirects consume for all the clicking that happens on their ads. This is on top of the bandwidth of every page view requesting the ads to be embedded in the first place, which can't be avoided...
Even if Google can shave off 6% of unneccessary redirects (all Firefox users), that's a big bandwidth savings.
Seth
Parent
Re:it's all about Google adwords (Score:4, Interesting)
Google gets paid for those clicks on their ads. They don't need to be altering my browser to help their business anyway. As bender would say, Google can bite my shiney metal 4$$. Hopefully distros will patch firefox, so their users won't need to fret about this. Just those windows users who get it straight from the firefox site.
I've been thinking it's time for a firefox fork that drops the MPL. The dual licensing is preventing integration of other GPLed work - like a built in PDF viewer so we can avoid Adobe. A GPL only fork would help prevent folks like Google from creating their own branded browser with stupid features no user would ever want.
Parent
Possible fix (Score:5, Interesting)
Parent
Re:Possible fix (Score:5, Informative)
Did you read the article, or the WHATWG spec?
It specifically mentions:
FWIW, this really seems dead in the water. First, not too many users will have it enabled (or even available, for that matter). Second, this information is already being reliably collected with cookies, mod_usertrack [apache.org], javascript, and page redirect tricks -- mostly with no knowledge of the enduser.
Why go with a little-available, easily disable mechanisim when the tried-and-true method is already available?
Parent
Re:You can already do this with Javascript (Score:5, Insightful)
Parent
Re:Firefox's Ping Attribute: Useful AND Spyware (Score:5, Insightful)
Because of this, and it being mozilla-specific for now, websites that currently use tracking URL's will see no value in switching over.
As for privacy concerns, it's already quite easy to track people on the web. Those who avoid it now are more in the know and would probably just add this to the list of things to disable.
Parent
Re:Firefox's Ping Attribute: Useful AND Spyware (Score:5, Informative)
Take a look at the HTML source on Fark -- you'll see javascript to overwrite the status line so it doesn't show it's tracking you
Parent
Re:Firefox's Ping Attribute: Useful AND Spyware (Score:5, Insightful)
Today, ad or other link tracking is generally handled like this: The link target specifies a tracking page and passes in a magic word or number that specifies the campaign or other info (e.g., "go.php?id=123" or "click.asp?campaign=A1254S"). That page logs the click in some database and issues a redirect to the actual destination page. Sometimes the web server log acts as the "database" and the click stats are processed from the logs.
With this new scheme, idea is supposed to be that the href target would be the actual destination and there would be no need for the time-consuming redirect. The separate ping attribute would take care of notifying the server similar to what happens today. But now the target page is out in the open for the client to see, and it is not essential to use the ping URL at all! Once users start blocking ping URLs, as they inevitably will, this transparency means that click stats will be very unreliable.
Since a lot of revenue depends on click numbers, this outcome is bad for commercial web sites. Therefore, very few money links will ever use this scheme and will instead stay with the tried-and-true redirect pages.
Parent
Consider what may happen (Score:5, Insightful)
Re:Consider what may happen (Score:3, Insightful)
Re:Consider what may happen (Score:3, Interesting)
Required! (Score:5, Funny)
Coming soon to a browser near you: (Score:5, Insightful)
Very useful (Score:5, Interesting)
Sure it can be abused -- I don't see why more of these abusive features can't be set up in a whitelist fashion. I'm already shocked that web browsers make it so difficult to white lists sites you feel are safe (or don't mind giving up some information to make your experience better).
That comes to the point of this post -- how about a standard "setup" logo/button committee that helps create a "setup" web profile that sites can use to give the users options on how they want to be configured? We've got some standard buttons already (RSS feed, etc), why not one that users could be familiar with so that they can white list or opt-in to certain additional "anti-privacy" features?
I know many websites (including a few of mine) could use more user information, and I don't see why we can't work to just setting a standard for how to do it.
Not very useful (Score:3, Insightful)
2. Now you alienate any user using another browser
3. Mozilla team is pulling an IE (implementing their own extensions... read the blog... "w3c doesn't have to make all the rules"
Re:Not very useful (Score:5, Informative)
WHATWG != Mozilla
Mozilla is attempting an implementation of a standard set by an independent standards body. No, they're not the W3C, but like you pseudo-quoted out of context, "w3c doesn't have to make all the rules."
Parent
Extension (Score:5, Interesting)
It's great! (Score:3, Insightful)
Submitter is a melodramatic idiot (Score:5, Informative)
Check out: https://bugzilla.mozilla.org/show_bug.cgi?id=31936 8 [mozilla.org]
userContent.css to the rescue (Score:5, Informative)
Re:userContent.css to the rescue (Score:5, Informative)
Parent
they're watching.... (Score:3, Funny)
Give me aping. One ping only, please (Score:5, Funny)
How is this an issue? (Score:5, Insightful)
It's a C-O-N-spiracy (Score:5, Insightful)
Not literally a ping... (Score:3, Insightful)
My first thought was "How can you track clicks with a ping?". After RTFA, it's not literally a ping to some server, it's a request to a URI, most probably an HTTP request that will contain request parameters indicating what link was clicked.
Second of all, this is not any more of a privacy intrusion than previously existed. It was always possible to track clicks within a single website via cookies, and clicks on external links (i.e. banner ads) by using a redirect first. If the author of the website wants to track what you're doing, he's already got the means, and he's had them for years.
Don't worry yet (Score:5, Interesting)
We should try and do an experimental implementation of , to see if there are any unexpected real-world problems.
That's what nightlies are for! We now see that it's a controversial tag (and they're probably already well-aware), so they're giving it a shot. Would you rather them just say "no, we don't like that potential standard [whatwg.org], so we're not going to try implementing it"?Mmm, okay, is this bad? (Score:3, Interesting)
It could enable a user comments vs people who actuall RTFA statistic. Knowing slashdot it would crash on a divide by zero error offcourse.
But wait a minute, a infinite number of pings? So the story submitter himself can also add his pings? Knowing the quality of slashdot editors (HA!) any story submitter would know who read what links in his article. Do I want him to know?
Imagine that someone puts a goatse.cx link on a forum. You don't of course admit that you been tricked but the next post is a record of all the pings the link submitter received proving that all of slashdot wanks to the goatse man.
The abuse of this feature is clear and the benefits? If slashdot really cared to know wich external links are followed or not then that is their business isn't it?
Do I really want websites to know wich external links I follow? I think this is a solution looking for a problem and in the few cases where a website needs to know the users need for privacy is superior.
Bad mozilla. This is something I would have expected of MS or the old Netscape. Now go sit in a corner and don't come out until you stop adding crap features that tattle on me without informing me.
Facts of the matter (Score:5, Insightful)
From a technical POV it's actually nicely thought out, as it separates logically the intended action and the "log."
I'm sure that Google, Yahoo, and others are BEGGING for this. I've worked in Design and Dev at two of the biggest travel sites - it's a huge problem tracking clicks. If we could remove our tracking javascript then users would get a MUCH snappier web site.
But we can't because our advertisers specify that we must have third party click/view audits that "verify" our intended audience numbers.
On the one hand, I know (having designed and built some of the auditing and log analysis systems) that we're tracking every click on our sites. We do use cookies. And the tag would bring it all out in the open instead of buried 3 layers deep in javascript.
But from an individual POV, it's like acknowledging that they really ARE watching me. And I am now consenting to that.
Solution: In my mind, the big(and little) sites could offer users the "option" of using the ping tag for a nicer user experience. It would be disabled by default, and a web site would have to specifically request and get permission from the user before the browser would "unlock"
Just me $0.02
Will sites really use this? (Score:5, Insightful)
Highlighting links that have a ping attribute (Score:5, Informative)
a[ping] {
color: green !important;
}
You could also do something like this:
a[ping] {
-moz-opacity: 0.5 !important;
}
a[ping]:hover {
-moz-opacity: 1 !important;
}
so that the links would be transparent until you hover over them
Re:With or without your consent? (Score:5, Interesting)
No.
Can you not opt-out of it?
Disable the feature. Easy.
It's not spyware by your definition. It has the added benefit of giving the user some control instead of being secretly tracked by the server side.
Parent
Re:With or without your consent? (Score:4, Insightful)
This kind of misses the point. If Firefox is to become a mainstream internet browser, it needs to be anti-spyware and usable from a clean install onwards. Making it the ideal browser for the tweakers, where it's at its most usable after multiple options have been changed and several extensions installed, is not going to make it the browser of choice for the general public.
As far as grabbing market share goes, it's the default settings that make the difference.
Parent
Re:Out of control (Score:3, Interesting)
Create a link with an image to a story site. Embed that link with this. You could slashdot The big sites with this. Go Open Source innovation.
Re:How is this different from (Score:5, Interesting)
It's different because web server logs only record what you ask that server for. Web server logs don't record what you ask other servers for.
This is essentially what the Referer header does, except in reverse. Instead of telling a new server where you have come from, it tells the old server where you are going.
This is already possible with Javascript, and it was possible with CSS too - I'm not sure if it still is, but the technique was basically to suggest a local background image to style :active links - so when the link becomes :active (when it gets clicked on), the browser downloads the background image and you know the link was clicked.
Parent