2mo ago

Mastodon Now Sends Referer Headers! Hurrah!

shkspr.mobi Mastodon Now Sends Referer Headers! Hurrah!

Back in 2022, I wrote this rather grumpy post on Mastodon, the federated social media platform. @Edent@mastodon.socialTerence EdenMastodon enforces a "noreferrer" on all external links.I have mixed feelings about that.As a blogger, I want to see *where* visitors are coming from. I also like to see (...

37 comments

That doesn't sound good? They are privacy invasive.
- FWIW they should be configurable in your browser, either directly or with a plug-in.
  The post makes a pretty reasonable argument as to why it's a good idea.
  
  Yeah, browser vendors think the same thing, since they are part of the commercial web. Anyway, at minimum, sending referer should be opt-in rather than opt-out.
- It's the instance admins' decision whether they want it or not.
  Talk to your admins or move to another instance if you disagree with them
  
  I'm not personally affected since I don't use Mastodon. That doesn't make it a good idea.
- Unfortunatly its a cost we must accept since the justification makes it worth it.
  
  Unfortunatly its a cost we must accept since the justification makes it worth it.
  That's for the user to decide. The devs should not presume to make it on the users' behalf.

I thought the fediverse was a way to give back the power to the users. This doesn't seem great. I don't want mastodon to be famous because it's useful to companies but because it's useful to people.
I don't know the details but hopefully they do something similar to firefox https://blog.mozilla.org/security/2021/03/22/firefox-87-trims-http-referrers-by-default-to-protect-user-privacy/
- Read the article. It is a configurable thing and each mastodon server admin has to activate it in order to send a referer.
  
  I read the article but I'm worried about the implementation which you won't be able to choose and while you can change server realistically not many people will even know this happened.
  I hope the focus is privacy and people and this change dowsn't have people in mind.
- The fediverse is a place where websites automatically share content. What people do with that is wide open.

Oh neat! Is there any way to check if my instance has opted into this?
- That PR is not even merged and deployed yet. When it gets released: simply ask your instance admin, I guess. (I think looking into the source code might also tell you but no idea where to search exactly)
  
  Ah, gotcha. Thank you!
  Probably I should go learn who my admin actually is 😅

Great!

I want to see where visitors are coming from. I also like to see (and sometimes join in) with the conversations they're having.
Imagine this guy contacting you about your bounce rate.

Turning that on is probably a GDPR violation for those in Europe.
ETA: Don't shoot the messenger. I won't be suing.

37 comments