Hey @Krinkle do you think we need to have the Security folks take a look at this change? As you note we went through a decent amount of work to make Diff and the Foundation WordPress installs more secure. If I'm understanding you there's little risk here, but I want to be cautious.

I'm writing an essay on the topic, but in a nut shell: The unintended use of no-referrer and other mechanisms like it has fueled industry dominance of Google and others, making the broader ecosystem of websites like ours incorrectly believe that they are dependent on Google for 90% of their traffic. What has happened is that tonnes and tonnes of websites have blindly followed security theatre around Referrer-Policy, without understanding what this does or what choices you have. The consequence is that all of these websites have erased their own footprints, thus making it seem that all traffic comes from Google. It is a true tragedy of the commons, because whenever one site does this, they still see others, but others no longer see them, and over time, nobody sees anybody, except we all still see the handful of sites in our analytics don't follow do this: big search engines and social media sites. There are other cases I'm researching where this is even worse.

For Referral-Policy it's a bit surprising to see that no-referrer took off because nobody actually recommended or argued for it. Not the free "security scanners", not MDN docs, not experts like Scott Helme. When you hire a consultant to secure your site, they are likely to start with the most paranoid settings possible. It's easier to turn things off than to have to take responsibility for leaving something on; even if turning it off kills the site in question, that's not the consultant's problem because they're primarily protecting themselves, not the site. The result is hundreds of thousands of websites who voluntarily blackholed their own traffic attribution without understanding what that means.

Unless someone understands the specific settings, the impact is not realized until a later time. That time is now. There is a cross-discipline gap between security, performance, and SEO. Sometimes these align, but often they don't. When they don't, it's important to understand how the overall thing works and make a decision that actually works.

In T422587#11802049, @CKoerner_WMF wrote:

Hey @Krinkle do you think we need to have the Security folks take a look at this change?

I think matching what our most sensitive sites use in production (en.wikipedia.org, uk.wikipedia.org, zh.wikipedia.org), what experts like Scott Helme recommend, and what privacy advocates like WebKit and Mozilla use as the strict default in their browser, should be good enough for our blogs.

In T422587#11803881, @Krinkle wrote:

I think matching what our most sensitive sites use in production (en.wikipedia.org, uk.wikipedia.org, zh.wikipedia.org), what experts like Scott Helme recommend, and what privacy advocates like WebKit and Mozilla use as the strict default in their browser, should be good enough for our blogs.

Ok, that makes sense. I'll work on getting the security plugin updated.

In T422587#11803881, @Krinkle wrote:

I'm writing an essay on the topic,

Maybe a blog post? On Diff? :)