Mastodon Now Sends Referer Headers! Hurrah!

submitted by Rimu

shkspr.mobi/blog/2024/12/mastodon-now-sends-ref…

Log in to comment

38 Comments

solrize

That doesn't sound good? They are privacy invasive.

sbv

FWIW they should be configurable in your browser, either directly or with a plug-in.

The post makes a pretty reasonable argument as to why it's a good idea.

solrize

Yeah, browser vendors think the same thing, since they are part of the commercial web. Anyway, at minimum, sending referer should be opt-in rather than opt-out.

cabbage

According to ths post it will be opt-in, on the instance side.

So smaller instances where there-might be risks associated will be opted out by default, while large instances that might want the attention and where individual users stand out less can opt in.

mitram2

It's the instance admins' decision whether they want it or not.

Talk to your admins or move to another instance if you disagree with them

solrize

I'm not personally affected since I don't use Mastodon. That doesn't make it a good idea.

Kichae

I guess it depends on what you want. If you want to be totally anonymous on the internet, then it's a bad idea. If you want people to use Mastodon, then it's probably an OK one, since the way people use microblogging is to follow famous people, and famous people aren't using Mastodon unless there's evidence that there's an audience there for them to play to.

solrize

It's less a matter of anonymity as wanting to maintain some basic privacy. If you want to tell someone where you learned about something, that's great, go ahead and tell them. To have them extract the info from you without your knowledge is dystopian. Referers should have been banned as soon as the web became commercial.

nasi_goreng

Having info "65 people visit this site from Lemmy.world" doesn't seem to be that invasive tho.

I can see blogger and other creator utilize this to connect with community.

Unfortunatly its a cost we must accept since the justification makes it worth it.

solrize

Unfortunatly its a cost we must accept since the justification makes it worth it.

That's for the user to decide. The devs should not presume to make it on the users' behalf.

Chozo

Is that not how this is already being implemented?

solrize

It's not entirely clear, but it appears to be up to the instance operator.

barsoap , edited

Users can disable referer headers in their browser settings which overrides anything the instance operators can do.

solrize

Better ask whose benefit the system is being run for in that case. If I want a system run by Elon Musk then I already know where to find one.

Cris

Oh neat! Is there any way to check if my instance has opted into this?

Microw

That PR is not even merged and deployed yet. When it gets released: simply ask your instance admin, I guess. (I think looking into the source code might also tell you but no idea where to search exactly)

Cris

Ah, gotcha. Thank you!

Probably I should go learn who my admin actually is πŸ˜…

x00z

I want to see *where* visitors are coming from. I also like to see (and sometimes join in) with the conversations they're having.

Imagine this guy contacting you about your bounce rate.

Blaze (he/him)

Great!

4Robato

I thought the fediverse was a way to give back the power to the users. This doesn't seem great. I don't want mastodon to be famous because it's useful to companies but because it's useful to people.

I don't know the details but hopefully they do something similar to firefox https://blog.mozilla.org/security/2021/03/22/firefox-87-trims-http-referrers-by-default-to-protect-user-privacy/

Kichae

The fediverse is a place where websites automatically share content. What people do with that is wide open.

Microw

Read the article. It is a configurable thing and each mastodon server admin has to activate it in order to send a referer.

4Robato

I read the article but I'm worried about the implementation which you won't be able to choose and while you can change server realistically not many people will even know this happened.

I hope the focus is privacy and people and this change dowsn't have people in mind.

Microw

Well, I don't know how you could implement that from a website that would enable people to choose? Not sure that is technically possible.

And of course if you simply telll your browser not to send referer info in headers you won't.

Skull giver

Mastodon is federated and there are thousands of sites. Even if they all opted-in, their statistics will be fragmented.

Surely this alone defeats the benefits for bloggers and other content hosters.

Good for mastodon admins that want the feature to be enabled, I guess, but I don't see why anyone would do that.

General_Effort , edited

Turning that on is probably a GDPR violation for those in Europe.

ETA: Don't shoot the messenger. I won't be suing.