Why wouldn't it be okay? This is a link on their own website, they can control it how they want.

That's the point. It is okay as long as they play nice with HTTP headers and other info which needs to be passed downstream.

Quora don't "need" to do anything. You just want them to.

On sites where there's private information in the URLs + links to external sites, overriding the referrer is necessary in order to protect users' privacy / identity. See https://www.facebook.com/notes/facebook-engineering/protecti... for why we do this at Facebook (I work on that system).

Quora 's question pages are community-built public pages. If they have private urls in account pages, they should limit referral protection to them. Also, i wonder, doesn't the 200 OK code confuse search bots?

Indeed, referers are useful information in some cases. For bookmarking apps like http://noteplz.com one useful thing is that along with the bookmark, they also store the referer, so you can later go back to the google search result where you found that bookmark.

On the other hand, with https and url shorteners,referers are a dying breed. The situation with URL shorteners is absurdly funny now, because twitter double-shortens the shortened urls, since most popular sites have their own shortener.

I don't think url shorteners really hurt referrers at all. They typically use 301 or 302 redirects, which preserve the original referrer.

... however since twitter is under https, all of them end up being "t.co". And even if it wasn't https, a double redirect would lose the referrer

Tracking helps you build great analytics. I, as a developer, would have otherwise no idea of what's happening in my app.

Do it client-side. Don't break the web.

Doing it client side has a couple issues.

1. you need to block the click event until you get a response from your analytics endpoint. Google suggests doing this by adding a 100ms delay: http://support.google.com/googleanalytics/bin/answer.py?hl=e...

2. you might get holes in your data for a number of reasons: the user has JS turned off; 100ms isn't long enough for the request to go through; or the user might click off before your script can attach itself to the onclick event.

You definitely don't want to get yourself in a situation where you go down and all outbound links stop working, but if you can fail gracefully, replacing the link makes a lot more sense.

Not to mention that your analytics code won't fire if the user opens a link by any means other than a standard left-click (e.g. middle-click, right-click -> open in new window/tab, or keyboard navigation)

Why does the delay matter? They have to wait for a response regardless of whether it's an AJAX request or a full browser redirect to the record/redirect URL.