“YouTube-dl” and “Pirate Bay” back on DDG

Re:“YouTube-dl” and “Pirate Bay” back on DDG by bscphil on Sunday April 17, 2022 @06:39PM (#31065205)

It genuinely shocks me that there are still people who don't disable sending the referer header cross-origin in the browser: I have not encountered a single website that breaks when setting `network.http.referer.XOriginPolicy` to 1 in Firefox, and only 2 or 3 sites that break when setting it all the way to 2.

It not only completely prevents stuff like this, it profoundly increases your privacy on the web by preventing sites from tracking which domain you came from. There is no good reason any site needs to know that. I am surprised that Mozilla hasn't simply made this the default setting for all users.

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by brigandish on Sunday April 17, 2022 @10:20PM (#31066607)

> I am surprised that Mozilla hasn't simply made this the default setting for all users.

I was under the impression it was, I doubt I'm the only one, so thanks for drawing attention to it.

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by ReallyOldLurker on Tuesday April 19, 2022 @08:04PM (#31091055)

>> `network.http.referer.XOriginPolicy` to 1 in Firefox

Thanks! Just checked and it is at zero for the default. Reviewed https://wiki.mozilla.org/Security/Referrer and learned something new.

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by cinquemb on Monday April 18, 2022 @03:00AM (#31068135)

There is also `network.http.referer.spoofSource`, which I have used instead of that.

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by bscphil on Monday April 18, 2022 @08:03PM (#31078283)

This breaks in the case that the endpoint actually does use the referer for something. I have actually encountered plenty of cases where a site will use the referer internally, i.e. on the same origin, to check something.

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by cinquemb on Monday April 18, 2022 @11:05PM (#31079401)

Yeah that's fair, but I haven't really noticed it for myself, but then again, I disable javascript by default and have compiled a lot of other stuff into the netwerk module that probably breaks sites even more to the degree if its noticeable, i just don't use the site.

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by caslon on Sunday April 17, 2022 @11:22PM (#31067000)

The Wayback Machine interface breaks.

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by bscphil on Monday April 18, 2022 @12:44AM (#31067518)

Do you have an example of this? What exactly breaks? I use Wayback all the time and have had no obvious problems.

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by caslon on Monday April 18, 2022 @06:40PM (#31077569)

Has been the case for a bunch of people with them turned off for a while now:

https://old.reddit.com/r/WaybackMachine/comments/kzvzxl/fail...

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by bscphil on Monday April 18, 2022 @08:07PM (#31078315)

Unless I'm mistaken, you've misunderstood the issue. From your link:

> it happened to me and I figured out it started when I disabled website.referrersEnabled

So if you completely disable sending the referer header, it breaks. This would probably also happen if you set `network.http.sendRefererHeader` to 0 or 1.

But that's not what I suggested! I only suggested disabling sending the header externally, to other sites, when the host domain (*.example.org) changes. In fact, someone in the thread you linked says that doing this instead of disabling it completely fixed the issue for them:

> ok I left network.http.sendRefererHeader on 2 (had it on 1), and changing network.http.referer.XOriginPolicy to 2 it works

[ Parent | on HN ]

Re:“YouTube-dl” and “Pirate Bay” back on DDG by postingposts on Sunday April 17, 2022 @07:50PM (#31065697)

I think people don’t know about it. I’m going to do this now that I do. Thank you!

[ Parent | on HN ]