Firefox 's Ping Attribute: Useful or Spyware?

An anonymous reader writes "The Mozilla Team has quietly enabled a new feature in Firefox that parses 'ping' attributes to anchor tags in HTML. Now links can have a 'ping' attribute that contains a list of servers to notify when you click on a link. Although link tracking has been done using redirects and Javascript, this new "feature" allows notification of an unlimited and uncontrollable number of servers for every click, and it is not noticeable without examining the source code for a link before clicking it."

Comments

Submitter is a melodramatic idiot

[grahams]

1. You are talking about a feature just added to a development tree, not something in a released version of Firefox.
2. This feature can already be disabled (if you happen to be running a development version) using the 'browser.send_pings' preference.
3. They didn't "quietly enable" a feature, they did it in front of everyone interested. There are plenty of bugs in bugzilla talking about the implementation of this feature. If you are running a development version of Firefox and can't be bothered to keep up with what is going on in the development community, that's your problem.

Check out: https://bugzilla.mozilla.org/show_bug.cgi?id=31936 8

// check prefs to see if pings are enabled
nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
if (prefs) {
PRBool allow = PR_TRUE;
prefs->GetBoolPref("browser.send_pings", &allow);
if (!allow)
return;
}

userContent.css to the rescue

[Matt Perry]

Add this to your userContent.css file to make links with the ping attribute have a green border when hovered:

a:hover[ping]
{
-moz-outline: 1px solid green;
}

Re:userContent.css to the rescue

[booch]

That should be:

a:hover[ping] { -moz-outline: 1px solid green !important; }

in order to keep the web site from overriding your setting.

Re:RTA

[nicklott]

but they're not expensive to the user. No website can use this as a primary mechanism in a process as less than 1% of their users will have it enabled. So, it can only be used for things that are optional to the website, for example user tracking. And in this case it actually generates more traffic, as now you just parse your logs (or put an image in, wherein we have a mechanism that does exactly the same thing anyway).

Re:Possible fix

[RevDobbs]

Did you read the article, or the WHATWG spec?

It specifically mentions:

1. Links with the "ping" attribute should be diffrentiated from other links.
2. There should client-side options to control "ping" behavior, similar to current cookie options: "respond to all", "ignore 3rd party", "ignore all".

FWIW, this really seems dead in the water. First, not too many users will have it enabled (or even available, for that matter). Second, this information is already being reliably collected with cookies, mod_usertrack, javascript, and page redirect tricks -- mostly with no knowledge of the enduser.

Why go with a little-available, easily disable mechanisim when the tried-and-true method is already available?

Re:RTA

[malsdavis]

Firstly they are expensive to the user, as you have to wait for the response to come back before being able to move onto the next page and secondly being expensive for the web server does indirectly effect users.

Sure your one redirect query may not effect you much but tens of thousands of people doing it could slow a server right down.

Highlighting links that have a ping attribute

[CTho9305]

If you add this to your userContent.css, links that have a ping attribute will be green:

a[ping] {
    color: green !important;
}

You could also do something like this:

a[ping] {
    -moz-opacity: 0.5 !important;
}
a[ping]:hover {
    -moz-opacity: 1 !important;
}

so that the links would be transparent until you hover over them