Hacker News Reader

Note the "clear browser cache when idle" option aggravates a referrer logging side channel for sites embedding Google Ajax libs or Analytics.

That aside, I'm in love!

View on HN

Can you explain why?

Nuking those scripts from the cache means that they get re-requested more often, and the request has its referrer sent to the server hosting the tracking script which means the referrer+ip pair can be logged.

And that's where RequestPolicy comes in: https://addons.mozilla.org/en-US/firefox/addon/requestpolicy...

I already use No-Script. I tried addeding RequestPolicy but the combination is just too much work for normal browsing.

You can use something like https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ to control who gets your referer. I default to no one and make exceptions for poorly coded websites.

Reply on news.ycombinator.com