I think it helps in conveying the fact that it is a vulnerability not a feature.

So any website (even your own company's internal one) can check stuff like this. And you can't do anything about it. Other than always using private browsing for anything you don't want your company/anyone else to know about.

I mean, if somebody is logged into YouPorn from work, that's not a problem I expect the developer of a tool like this to solve. What I expect the developer of a tool like this to do is not create problems by just arbitrarily making HTTP requests to porn sites without a prompt or a chance to opt out. That's a dick move.

When I first read that it was making these requests here in the comments, my reaction was similar. But then upon reflection, I don't think there's a problem for the author here. Why? Because all I did was click the link. Meaning if I was behind a corporate firewall or the like, this sort of thing could be happening all the time and unless I was always tracing requests in my browser or via MITM or logging DNS, I'd have no way of knowing.

Personally I view this as a browser and/or protocol issue (the kind that has trickled down from the origins of the web) and really can't fault the author for it. In fact I think it's appropriate the author left these requests in as it reflects an actual attack scenario better perhaps.

The point I'm making is that it's not necessary to hit a porn site in order to get the point across, and there are HN users whose organizations observe and don't care for that kind of thing.

Then how can such organizations handle other people randomly putting references to porn sites on their websites? With today's Internet being what it is, you can't assume that a request to YouPorn means someone is browsing porn at work. For all you know, the request could have been sent by an ad.

Then again, businesses in general aren't exactly paragons of intelligence either, so I wouldn't be surprised if someone made a fuss about it...

Absolutely!... If your company is doing web filtering, it will report an attempted hit from your browser to the YP site.

Yet another inequality to throw in the hopper

In bird culture, this is considered a dick move.

I believe using private browsing wouldn't matter. The IP I'm browsing from is still going to try pinging all those porn servers, and that's what's getting logged in the filter, not my browser history.

In my second paragraph, I was actually talking about your company sending such requests to know what you are logged into. Doesn't matter if you're using it right now. If you're logged in from days before, your cookies will be there. In incognito they won't be.

Privacy Badger will stop that tool if you edit the settings.

What a surprising problem. If the boss mistakenly accuses you of watching porn - why not explain why they're wrong and show them the site? If they won't accept that, then it means you're in danger with any web surfing you do at work and should already not be clicking random links. It's not the site's fault, it's your company's fault and your own for not protecting yourself against breaking their rules.

Personally, the idea that there's a network my traffic flows over, where that traffic is sniffed such that its content could potentially result in things like me losing my job, is just debilitating to me.

If I worked for such a company, all my traffic would be flowing over a VPN, full-stop.

> If I worked for such a company, all my traffic would be flowing over a VPN, full-stop.

When you work for such a company, all VPNs are blocked and prohibited, full-stop.

Source: worked for such a company

Pretty standard in any reasonably secure financial services org.

All direct Internet access is blocked and prohibited, with all attempts to access the Internet (tcp/80, tcp/443) transparently proxied via Bluecoat/Websense/Forcepoint/etc proxies, which filter based on URL categorisation. WSS generally doesn't work in this kind of environment. Everything else is dropped.

Any attempts to bypass filtering is a violation of IT policy and is sackable. Visiting sites that are blocked gets logged, doesn't generally get flagged up unless is a daily occurrence, and the first assumption is usually malware.

Source: Worked for several such companies, was responsible for perimeter security in some.