When the A/B test tells you that you should

but you shouldn't

This is what hacking is all about!

"Css-only-chat"

CSS is always CSS. It's CSS on the repo too, but got edited back to "Css" here on the HN title for some reason.

It does; it triggers an event just like clicking (or in the case of CSS, a state change).

haha

Yes, and the twitter link above suggests that this is already used for tracking in the wild.

That being said, if one is THAT worried about tracking then one should not be on the modern web, and should probably stick to using Lynx over TOR.

I love hacky things like this one.

Yes, it would.

Gopher had the right idea. Menus only. What executable code?

You can front load it with an <img> tag and various other ways. Look at how arbitrary asset loaders work for browser games.

You don't need letter buttons. You can have a regular text box in an iframe and submit the form with the text.

I actually remember websites doing exactly that years ago.

Some would display the chat like here, by never closing the connection, as described in the repo. And another trick was to just send a refresh header (or use a meta tag) to automatically reload the iframe displaying the chat every $x seconds. The latter one was iirc more prominent because you could do it on any web host with PHP and MySQL as it doesn't require any long living processes.

Ah, indeed, I tend to confuse it for Brainfuck which at least can do something of use.

"Sorry boss, please fire me and ask one of the 200 other employees here to use that system with built-in tracking to make a newsletter for this clothing brand."

You're profiling the what now?

And break navigation on half of the nav bars on the web?

> the idea that one can look at a modern browser, which are some of the most complex software packages being developed, and think "clearly these people don't know how to add an 'origin' column to a SQLite database", well, it boggles the mind

It boggles my mind too. Imagine, what would have happened, if those small Javascript snippets, used mainly to add cute visual effects to pages, could check if some image from different site is already in browser cache by performing cross-site HTTP requests... That would allow completely new dimension of spying on web users!

Fortunately, browser developers are some of the most competent people in the word. They would never give web pages too much power by letting them start CPU threads, use OpenGL, allocate arbitrary amount of memory or read your battery level to set exorbitant taxi tariffs for people in a pinch. Browsers are well-designed and highly secure, because they are being updated with security fixes every day, sometimes even multiple times a day.

> But that hash is a regular, fast hash that takes like 1µs to compute right?

They use SHA512 which is fast, but noticeable for large enough files.

> Or is this meant to spite the 0.01% of visitors that really try not to be tracked and have turned off javascript?

Yes, the point is that it works with blockers.

I always read FAQ as "eff-aye-que." Relatedly, I recently saw an HN comment with the line "an .edu," referring to the TLD, and at first took it as a grammatical error since I pronounced the "." as "dot" in my head rather than dropping it as the author intended. Then I realised I was pronouncing the whole thing as "an dot ee-dee-you," whereas I would naturally think of ".com" as "dot com." I'm not sure why, but I think one possibility is that the recent proliferation of .io domains has made me think of other less common TLDs as the sum of their constituent letters rather than as fragments of words. Another possibility is that less common TLDs need to be spelled out for people in normal parlance more frequently. Yet, I'm pretty sure I've been thinking of the recently added ".dev" TLDs as "dot dev," not "dot dee-ee-vee," perhaps specifically because I've never had to spell it out for somebody in speech? Or maybe because we use "dev" as a standalone word already, as in "dev house?" I dunno. It would be interesting to see a survey of how different people naturally pronounce acronyms and word-fragment-TLDs like this.

That was not intended. If I could edit my original comment I'd say it was a great hack and the humor in the FAQ is appreciated.

> Do you think that companies who send newsletter do it without any traces of analytics?

I don't doubt it.

> Everyone does it, that's the current state of the industry.

That's not an excuse

> To refuse work from anyone who does analytics would mean to leave the web industry.

Analytics as a whole is not the issue. Doing shit like abusing CSS in order to track when someone opens an email and what they do in that email is evil. That violates the user's trust and expectations. I don't doubt that any time I spend on somebodies website will be tracked and analyzed by them. But they have no right to track and analyze me on my own properties, like while reading my own email.

"Everybody is doing it" is not an excuse for evil behaviour. Be better than others, don't contribute to this race to the bottom.

59k a year is a very healthy salary. I know real Engineers doing things like verifying building and bridges who make less than that. Honestly to think that $59k a year in Canada is too little money to afford a moral compass shows how much of a bubble you are already in.

It does solve the problem because Google download the image no mater what so you can't know if someone opened the image or not.

And they do that exactly. The fix is to disable images by default but every user has to manually do this.

Couldn't google just hit the URL randomly themselves to throw off tracking, even if the email was never opened?

and then send many emails? is that an availability attack?

... and then do what?

Agreed, it's a terrible idea. I've been subscribed to the NY Times' "morning briefing" email for a long time. I'm using an IMAP client, and I never bother to load the images for this, because all I want is a text summary of the day's news.

They recently sent me an email saying something like "we noticed that you're not reading our email, so we're unsubscribing you." Apparently I hadn't been loading their tracking pixel/script/CSS, so they thought I wasn't "engaging" enough. This was despite the fact that I clicked on links to full articles, which had all sorts of tracking info embedded in a redirect.

A responsible email publisher offers a clearly-visible "unsubscribe" link at the bottom of the email, which will unsubscribe you with a single click. No nags, no checklists of email categories, maybe an "are you sure?" page at most, with equal-sized "yes" and "no" buttons. One or two clicks, and I don't hear from you again.

A dodgy email provider is more likely to "use lack of opens to reduce volume." If I don't trust some company to actually unsubscribe me when I ask, I'll just filter their domain directly to the trash. Clicking on spammers' "unsubscribe" links is usually a bad idea.

> I've never once been automatically unsubscribed from anything.

To be fair, this is the kind of thing where, if it had happened, it’s possible you wouldn’t have ever noticed.

Hi, pleased to meet you. Even though everyone on our newsletter list specifically signed up to get newsletters, we’ll still warn you and then unsubscribe you if you do not engage for a long time.

Google, in particular, will send all a sender’s mail to everyone’s spam folder if it sees low engagement across all gmail users... so it is in publisher’s own self interest to remove disengaged users.

I believe mailchimp has something that automatically unsubscribes users if they haven't opened your emails for x time, but the amount of publishers that use this is probably pretty low.

Mailchimp analytics would outright not work if it was the latter, so it's probably the former.