Hacker News Reader

Comment by nuker | Hacker News Reader

Next fonts and jquery stuff, please. These requests have Referrer in them. And can we have it for MacOS too?

If you’re worried about the Referer header leaking information, Firefox has numerous config settings to control the value sent.

https://wiki.mozilla.org/Security/Referrer

Nice, thanks, but I use Safari

https://marketingland.com/apples-latest-itp-updates-what-mar... suggests that "When a user loads a web page with embedded content from another domain, as in a tracking pixel, the request header referrer for the tracking domain will no longer contain the full web address of the host page, only the domain name." This is the case when "Prevent cross-site tracking" is turned on.

Not the same thing as hiding your IP and the domain name, but we're getting closer to full privacy, slowly. The problem with proxying is that it would only work with a small list of third-party asset hosts, and it would break the ability for CDNs to work unless it was a distributed proxy... that sounds like more headache than its worth except maybe as a new type of browser extension, something similar to a content filter but instead loads cached or proxied copies.

But at that point it's worth considering VPN or compression proxy services for content compression as Chrome and Opera Mini might do, and MITM everything the browser loads so nobody gets your IP except Apple. I imagine folks might pay for an Apple VPN service, I'm just not sure Apple wants any headaches that might go along with it yet. :)

> the request header referrer for the tracking domain will no longer contain the full web address of the host page, only the domain name

Why not just remove referrer header for all 3rd party requests? Or remove it in Private browsing mode. VPNs nice, im using one, but other VPN companies are not, such a cutthroat business :) And you can not self-host VPN, it defeats the hide my IP feature.

As a developer, you can already use https://www.w3.org/TR/referrer-policy/

https://caniuse.com/referrer-policy

Hoping the defaults for sending such metadata will change eventually

I've seen some browser extensions that use local copies of the usual CDN scripts and such. I wonder how much better that could be if it was a proper browser feature coupled with some sort of a privacy proxy? Though I imagine that the same local cache fingerprinting issues might still apply here.

Decentraleyes

Better look at LocalCDN instead as it gets updated more often:

https://www.localcdn.org/

Oh, you mean localcdn is not yet ready?

Sorry, I reworded my comment. I meant that Decentraleyes isn't getting updated.

Don't all browsers cache ( common, like jQuery) js and css stuff locally?

Most browsers changed that to a site-based cache instead of a global one.

https://www.zdnet.com/article/firefox-to-ship-network-partit...

They might cache it if the server allows them to cache it.

But evil servers don't.

Example: gravatar.com gives an expiration time of 5 minutes.

curl -q -i --output - https://www.gravatar.com/avatar/70d9b050bfe39350c234d710fadf... | grep -a xpires

expires: Fri, 12 Feb 2021 11:54:40 GMT

I suspected it, thanks for confirming. What about fonts.googleapis.com, is it cached client side?

There is no sane reason to load external scripts from a CDN rather than your own host.

There used to be performance improvements since it would be cached already.

Only if cached. Otherwise you had (or have) TCP+TLS overhead, which I doubt is faster than the already established connection.

Browser extensions like LocalCDN protect against this sort of things.

This article is about iOS. How are you going to use LocalCDN on iOS?

With Firefox

Can you use extensions on Firefox for iOS? Browsers on iOS can't use their own engine. They're essentially Safari with a different skin on top.

I think you're right, wasn't aware of that.

Reply on news.ycombinator.com