referers and W3 (fwd)

A friend who webmasters a large site that is implementing referer-specific
content sent me this when I mentioned the cpunks/cryptography thread of a
few months back. I basically agree with the W3C. While user education on the
potential privacy threat is essential, I do not believe that Netscape should
violate published technical standards. There are also privacy and property
issues from the server's perspective.

---------- Forwarded message ----------
Subject: referers and W3

The following text was added to W3's page on HTML on May 8.  If nobody 
else has noticed this, you might wish to share it with the cypherpunks, I 
don't know.

   HTML, Hypertext Links and Referer URLs
   
   In a vacuum, semantically neutral technology attracts meaning. If
   neutral technology is useful, commerce -- abhorring a vacuum --
   uses technology in often-unforeseen ways to build new markets.
   Over the past year we have seen attempts to create meaning for
   HTML references where none existed before. Links have been argued
   to mean revenue streams, approval, a source of liability,
   endorsement, and ownership.
   
   The Web depends on hypertext links between resources. Links can
   act as references, or to embed material, both of which are
   concepts that have been around for a long long time. Whats new
   with the Web is the ability to follow links quickly.
   
   When a user clicks on a link, the URL of the page containing the
   link is passed to the server along with the requested URL. This
   gives Web sites the opportunity to customize the response
   according to the page the user clicked on.
   
   If someone jumps into a Web site without entering via the home
   page, a content provider may choose to turn them away or to
   redirect them to the home page. A smarter Web site could use
   partial string matches on the Referer and Requested URLs to
   customize the page it returns.
   
   One reason for doing this is to ensure visitors see the banner ads
   and promotions, a site is using to create revenue; another is to
   avoid broken links when people (or indexing engines) bookmark
   transitory Web pages.
   
   The Referer URL can also be used to determine how to honor
   requests for images or applets. For instance, you might decide to
   only provide images to sites which have signed a license agreement
   with you.

http://www.w3.org/pub/WWW/MarkUp/

Rich Graves wrote:
> 
> A friend who webmasters a large site that is implementing
> referer-specific content sent me this when I mentioned the
> cpunks/cryptography thread of a few months back. I basically agree
> with the W3C. While user education on the potential privacy threat is
> essential, I do not believe that Netscape should violate published
> technical standards. There are also privacy and property issues from
> the server's perspective.

Just in case someone hasn't heard about this yet, we support a stealth
preference in 4.0 to turn of referer headers.  If you wish to disable
referer, you can place the following line in your prefs.js file:

pref("network.sendRefererHeader", false);

There is no UI checkbox for this preference because it was added after
we froze the UI.

-- 
You should only break rules of style if you can    | Tom Weinstein
coherently explain what you gain by so doing.      | tomw@netscape.com

Yes, I'm aware of that. I don't think it's a good idea. If you don't agree
with the standard, work within the W3C to change it. Especially if it's an
undocumented cypherpunk-only feature, that bugs me.

-rich

On Sun, 18 May 1997, Tom Weinstein wrote:

> Rich Graves wrote:
> > 
> > A friend who webmasters a large site that is implementing
> > referer-specific content sent me this when I mentioned the
> > cpunks/cryptography thread of a few months back. I basically agree
> > with the W3C. While user education on the potential privacy threat is
> > essential, I do not believe that Netscape should violate published
> > technical standards. There are also privacy and property issues from
> > the server's perspective.
> 
> Just in case someone hasn't heard about this yet, we support a stealth
> preference in 4.0 to turn of referer headers.  If you wish to disable
> referer, you can place the following line in your prefs.js file:
> 
> pref("network.sendRefererHeader", false);
> 
> There is no UI checkbox for this preference because it was added after
> we froze the UI.
> 
> -- 
> You should only break rules of style if you can    | Tom Weinstein
> coherently explain what you gain by so doing.      | tomw@netscape.com