Is it OK to let the publishers know the SXG distributor's URL?
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 125
- PR merge metrics
- No merged PRs in 30d
Description
I have stopped working on Signed Exchange Reporting for publishers. https://github.com/w3c/network-error-logging/issues/99#issuecomment-490739647
This is mainly because it is not clear whether is it OK to let the publisher know the distributor's URL.
If my understanding is correct, we can't know redirecting URLs.
The publisher can only know "aggregator.example/feed" using referrer in this case:
- aggregator.example/feed -> redirect.example/publisher.example/article (returns 301 redirect) -> publisher.example/article
So I think it sounds reasonable not to let the publisher know the SXG distributor's URL.
And also if the publishers can know the distributor's URL, this can be used for user tracking.
Example:
https://TRACKING_ID.distributor.example/publisher.example/article.html.sxg
https://distributor.example/TRACKING_ID/publisher.example/article.html.sxg
I think we should avoid adding new features which can be used for user tracking.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Network Error Logging discussion (issue #99 and its referenced comment) and review the redirect and distributor-URL examples in this issue. Determine whether publisher disclosure is permitted and whether the tracking scenarios require a specification change; done means recording a resolved decision about Signed Exchange Reporting.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100