Why use noreferrer instead of banning the domain, out of curiosity?

Banning the domain actually doesn't work because people see that the domain is banned, observe that there's nothing wrong with the domain, and then accuse us of being unfair and hostile to the author/site. In doing that they usually jump to the most uncharitable, horrible reasons they can imagine for why we might have done so.

It doesn't work to say "but they asked us to ban their site" because there's no reliable way to get that message to people.

Sounds like a good opportunity for a distinction between banning and opting out, or at a note field where mods can put some text pertaining to the reasoning behind it. I feel like you and the community will be better served with some nuance around banning domains.

On a side note, I think HN had a long history of non-toxic behavior but I'm starting to see a shift. It reminds me of when Reddit grew and the crowd became more and more unruly. Has the community grown quickly recently or have moderation priorities changed? Sorry I don't have any evidence lined up for this, just an anecdotal observation for now. Seems apropos to this issue in particular.

If a group of users here are disrespectful enough to attack creators for personal reasons and it's boiling over like this, that's a really bad sign.

"In doing that they usually jump to the most uncharitable, horrible reasons they can imagine for why we might have done so."

So you do understand why one wouldn't want to deal with a significant part of the user base here given that they behave in such ways, and thus why one might want to avoid any traffic coming from here, but feel that it's not your job to deal with those users, because then their behavior would affect you? I really hope you'll reflect on that...

I didn't see any evidence for the claims made.

I haven't expressed myself clearly enough if that's a possible response to what I tried to say there.

Unfortunately I'm at a workshop today and not free to take the hours I normally would to go over the explanation until it's completely clear and understandable. I only have a few minutes of break time. Perhaps it would have been better not to try in the first place, under such circumstnaces; but I'm not going to delete my GP comment now.

I've read it a couple times and it's hard for me to disagree with them. It sounds an awful lot like you're saying 'if we ban the domain, people will yell at me and get mad,' with the implication of 'and I would rather they yell and get mad at someone else.'

Please don't and just keep the noreferrer, but if you do insist on banning the domain then you could perhaps add an explanation that it was at the request of the site author. Preferably with a link to this post or something else showcasing the insanity.

Why is it that you characterize their view as 'insanity'?

They think they get to control who visits their website without putting up authentication controls, and choose to fight this battle by breaking Google's rules for deceptive websites (white text on white background).

Google, despite their best efforts, does not yet own the internet.

IMHO banning links to such sites, as you've done for other example(s?) for a long time, was the way better policy.

Don't budge; noreferrer is absolutely the right call.

I would go further: noreferrer should be the default. Alternatively, let each user configure it, as a privacy option.

On one hand, social media sites tend to want to tell the target site "we brought you there" for some pretty traffic statistics and monetization. On the other hand, I seriously doubt HN, the news site of a VC company, actually takes any money from that.

It's probably good to not allow redirects or targeted content to users, and those are valid complaints. I totally shouldn't get link redirected, sent to a shady site, or displayed offensive content, different than what the submitter might have seen since they didn't have a referrer, because the other side of the link is hostile to users here. That said, I think a "banned link" list for submissions might serve this purpose better and more neutrally, if you're wanting to please both sides. I don't think you were out to "go after" anybody at all though, I think you were just blindsided by something you didn't think as deeply about as some of the folks on the other side expected. From that perspective, I feel for ya and don't blame you for getting stuck in the spot you ended up in at all.

From the above though, I'd say an opt-in (either via moderator here or site owner request) ban-list on top of a general all-link "noreferrer" policy would be my preferred solution as a users. Heck, an "ultra technical" answer would be let robots.txt filter a HN bot agent which checks when the submission is polled, way less manual. Others may disagree, and it does come with the downside sites won't be able to tell where the sudden burst of traffic originates, but that's my 2 cents.

You're missing the point. Site owners shouldn't be allowed to say "people aren't allowed to talk about my site on Hacker News".

People shouldn't post bad comments on HN either, but HN still needs to ban users and handle spam anyways. The point is about what can realistically be done, not each of us lamenting a different "how the world should be".

The analogy isn't being able to ban users and handle spam. It'd be more like adding a feature with the sole purpose of making it easier to post bad comments.

A clearer relation to how preventing hairy-ball responses, like JWZ has, is like making it easier to post bad comments would be appreciated, I'm having trouble following the relation.

Note: sites can still detect HN users and modify content without the referer. E.g., using the CSS styling for if "news.ycombinator.com" is a visited link. If not visited, content hidden. If visited, content shown. Based on the status the site can also trigger a redirect via JS at that point. My comment was that it seems better to let the site just opt out directly, not about what site operators should or shouldn't be doing.

> Based on the status the site can also trigger a redirect via JS at that point.

Thankfully no it can't, because browser vendors already know about that vulnerability and have fixed it. Visited link styling can only affect color now, and isn't reflected in getComputedStyle, exactly to prevent that kind of thing.

Shows how up to date I am on the web :). Did this change prevent all custom messages from being displayable or just triggered actions such as the redirect?

You can display custom messages still, by making the unvisited and visited colors different, and then making the background color the same as the unvisited color, but you can't do anything more elaborate than that.

For my 2c I'd say either doing nothing or blocking links makes the most sense. They've sent a clear message they don't want HN traffic, and I don't see a lot of value in posting links to sites that explicitly don't want it.

It's absolutely super gross to selectively apply noreferer to links only to Asahi Linux or JWZ's blog, because it's obvious you're doing it specifically to spite the people running those sites. If you applied it to every link, that might be different. I mean, the receipts are still out there, people still know what's up. But at least you're not being openly prejudicial.

> because it's obvious you're doing it specifically to spite the people running those sites. If you applied it to every link, that might be different.

It's not to spite those people. It's because only those sites abuse the information. Applying it to all links would almost be collective punishment.

I don't think there is any reason it's "obvious" it's being done specifically out of spite. I think trying to solve the user complaints but not thinking deeply enough about the solution is a far more reasonable story.

Aren't the people selectively doing stuff on their websites for people with a HN referer header doing it out of spite?

Super gross? Grow up.

Spite? You might be projecting.

Hacker News serves the interests of its users, not the interests of the sites it links to. It's not spiteful to help Hacker News users avoid unwanted redirects.

I think your current site-wide Referrer-Policy of origin is fine. It's probably just bots and some addons overriding or ignoring it. People can still see where traffic is coming from via the bots and addons that ignore it and spoof referrer by adding one. There is no way to make everyone happy especially with something that varies so much by user-agent configured behavior.

Dang, whatever you do, someone will be unhappy.

You did the right thing by adding noreferrer to their links. Knowing where people got to your site from without them explicitly telling you is a privilege, and it's one that they chose to abuse.

There's a reason websites that host several communities ban such interactions upon the request of the recipient of the traffic; brigading is bannable on reddit.

Except HN keeps the comments on HN, so it's the opposite of brigading.

Have you considered that they may have done this in "self defense" to the abuse this aggregator was causing them?

Besides, by your argument, connecting to websites at all is privilege. HN wants the privilege of reading their content (otherwise why not just block their site) without taking any responsibility for it.

Agree, there's no mandatory standard that there must be valid referrer information on all hyperlinks. It's an optional extra from what I understand.

Similar to how freedom of religion also guarantees the right to not have any declared religion.

You guys could just add noreferrer to all links.

Marcan alleges that he sent you an E-Mail explaining the redirection with specific criticism about HN's moderation (https://social.treehouse.systems/@marcan/110503050993279759) and that your only response was adding the rel=noreferrer.

Is this true? Could you address his points of criticism?

I'll also throw a vote out that I do not see the value in having a public feud over whether one specific site is allowed to block HN traffic. I actually agree with stripping referrer headers from all posts (for user privacy reasons), but in addition I think it's clearly the right move to block links to asahilinux.org

It would:

A) not ban people from talking about Asahi Linux and would not prevent links about Asahi Linux from being shared.

B) be at least somewhat of a gesture of goodwill that the HN community is not trying to force itself into other communities (which we shouldn't be doing anyway).

C) not force HN to build a generic "anyone who wants to get blocked can get blocked" system.

HN moderation regularly takes context into account when making decisions (and in fact, the moderation would be much worse if it didn't). Yeah, of course the NYT should not be able to ask HN to stop linking to articles. But that's not the current situation. Regardless of whether or not HN is obligated to block links to asahilinux.org from being posted, it would be a low-impact move for the HN community that would go a long way towards both diffusing the controversy and would (from the sound of things) be a high-impact positive change for the Asahi Linux community.

And regardless of whether people think the Asahi Linux community is being reasonable or not, if there's an easy way to accommodate people who have a concern and it's not forcing us to do something drastic or high impact -- we should do it. If it becomes a problem in the future, if tons of sites start doing this and it impacts the community's ability to have conversations about current events, then change the policy. You're not locked into anything.

In the meantime, why not try to accommodate someone who feels harassed by certain HN users? It just seems like a very simple way to show some kindness towards another community.

---

To the point that users might misinterpret those blocks as hostile, I know that HN tries to make very minimal code changes, but no matter how hard I try I also do not understand why it wouldn't be possible with minimal code changes to show/redirect to an error that explained the situation.