Major Browsers to Prevent Disabling of Click Tracking Privacy Risk (BleepingComputer)

This is clever, as it allows (very) “dumb” UA to still work, and tracks only those who can follow redirect; but have the good side-effect of offering a tracking-free experience.

Of course, this is all with Javascript disabled (NoScript). Not quite a standard user setup, I admit.

It's actually the opposite situation. It's impossible for users to distinguish tracking redirects from other kinds of redirects, if they notice the redirect at all. On the other hand, with "ping" a single line of user CSS (e.g. delivered by a browser extension) will show you which links are tracked --- before you click on them:

a[ping]::before { content: "(tracked) "; }

> Forcing redirects on the service, makes them pay more for tracking (to handle more requests or to proxy requests) which discourages tracking.

Using redirects or "ping", the site has to handle the same number of requests. There is almost no difference in server work required. There is no evidence disabling "ping" discourages tracking in practice.

> It also makes it more obvious to the user if they have redirects blocked or needing approval.

Essentially nobody blocks redirects. Redirects are used for many things, many of which are essential to the function of sites (e.g. OAuth), so blocking them breaks the Web. "ping" on the other hand is a much narrower feature which makes far more sense to block.

> Mozilla doesn't do the right things because they get a lot of money from a company that wants tracking to be easier.

As someone who worked there for a long time but doesn't now: this is just not true. You don't have any evidence for such a connection, and you are just making stuff up.

> Arguably ping shouldn't have been implemented at all, because almost all sites that want that information don't want to let people opt out of it, so need to do it server side instead of client side anyway, leaving very few users of the feature.

That may have been true up to now, but now that Safari and Chrome prevent disabling "ping" I expect sites to use UA-sniffing to use "ping" instead of redirects for those browsers ... leaving Firefox users with a worse user experience for no privacy benefit.

The cost to the site operator is actually identical for redirects and ping. However, for the user, pings are cheaper, because the ping and the request to the link target can be done simultaneously while for redirects the client needs to wait for the first response to know the real target. Add to that the cost of the Javascript. Add to that the issue of broken link copying.

I doubt disabling redirects in general is actually feasible. Redirects are a core concept of HTTP and disabling them would break countless legitimate use cases (asking for permission would be quite annoying).

> Oh veh. Mozilla. I wanna love you -- I gotta hate you.

So, uh, how is lynx these days? Less snarkily, what is the alternative you've chosen?

Remember, the real culprit here is Google for disabling the ability to not send the ping. Though I suppose an extension could do it as well if it really wanted to, it's just not an in-browser setting anymore.

I was afraid someone could mistakenly enable ping= in other tags like <img ... >, not just <a ...>, so that it might have effect
even where alt text is being rendered by a text-only presenter of html -- depending of course on where the presenter's html parser
comes from and what the implementers of that parser decided to do with ping= if seen in <any ...>.