Do not direct link to jwz.org from HN. Here's a click-safe link:

https://dereferer.me/?https%3A//www.jwz.org/hacks/youtubedow...

It genuinely shocks me that there are still people who don't disable sending the referer header cross-origin in the browser: I have not encountered a single website that breaks when setting `network.http.referer.XOriginPolicy` to 1 in Firefox, and only 2 or 3 sites that break when setting it all the way to 2.

It not only completely prevents stuff like this, it profoundly increases your privacy on the web by preventing sites from tracking which domain you came from. There is no good reason any site needs to know that. I am surprised that Mozilla hasn't simply made this the default setting for all users.

> I am surprised that Mozilla hasn't simply made this the default setting for all users.

I was under the impression it was, I doubt I'm the only one, so thanks for drawing attention to it.

>> `network.http.referer.XOriginPolicy` to 1 in Firefox

Thanks! Just checked and it is at zero for the default. Reviewed https://wiki.mozilla.org/Security/Referrer and learned something new.

There is also `network.http.referer.spoofSource`, which I have used instead of that.

This breaks in the case that the endpoint actually does use the referer for something. I have actually encountered plenty of cases where a site will use the referer internally, i.e. on the same origin, to check something.

Yeah that's fair, but I haven't really noticed it for myself, but then again, I disable javascript by default and have compiled a lot of other stuff into the netwerk module that probably breaks sites even more to the degree if its noticeable, i just don't use the site.

The Wayback Machine interface breaks.

Do you have an example of this? What exactly breaks? I use Wayback all the time and have had no obvious problems.

Has been the case for a bunch of people with them turned off for a while now:

https://old.reddit.com/r/WaybackMachine/comments/kzvzxl/fail...

Unless I'm mistaken, you've misunderstood the issue. From your link:

> it happened to me and I figured out it started when I disabled website.referrersEnabled

So if you completely disable sending the referer header, it breaks. This would probably also happen if you set `network.http.sendRefererHeader` to 0 or 1.

But that's not what I suggested! I only suggested disabling sending the header externally, to other sites, when the host domain (*.example.org) changes. In fact, someone in the thread you linked says that doing this instead of disabling it completely fixed the issue for them:

> ok I left network.http.sendRefererHeader on 2 (had it on 1), and changing network.http.referer.XOriginPolicy to 2 it works

I think people don’t know about it. I’m going to do this now that I do. Thank you!

> Do not direct link to jwz.org from HN

Why?

Because the admin detects HN referer explicitly and presents a joke page.

Perhaps I’m in the minority, but I find this kind of subversion amusing. Like all good jokes, it’s pretty close to the mark.

I agree, so it’s a safe bet you are in the minority.

I've since noticed...

Just copy the link to not send any referrer information.

Does not work either because apparently bit.ly's 301 preserves the Referer.

Weird, I had tested it. I’ve updated to a de-referrer site instead.

Might be a browser difference (firefox here). Thanks for the update, it works better.

oooohhhhhhh. The "egg". My bad.

How often do you update it ? Because it seems to have seen quite a few update from the beginning of 2022.

Every time I go to use it I grab a fresh copy.