[ ijbswa-Actionsfile feedback-3421755 ] Google news click tracking

Actionsfile feedback item #3421755, was opened at 2011-10-11 04:54
Message generated for change (Comment added) made by dstahlke
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=460288&aid=3421755&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: filter: other problem
Group: current actionsfile
>Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: dan stahlke (dstahlke)
Assigned to: Fabian Keil (fabiankeil)
Summary: Google news click tracking

Initial Comment:
On news.google.com, when you hover over the links the legitimate address is displayed on the browser's status bar.  However, when you click the link it appears that google rewrites it to direct to their servers so they can tell which stories you are reading.  I found this out by using a network sniffer.  The rule below prevents this.  The first redirect cleans up the URL by removing tailing "&..." options which would otherwise be interpreted by the fast-redirects function.

{+redirect{s@(news.google.com/news/url.*&url=http[^&]*)&.*$@$1@}}
news.google.com/news/url.*&url=http.*&.*

{+fast-redirects{check-decoded-url}}
news.google.com/news/url


----------------------------------------------------------------------

>Comment By: dan stahlke (dstahlke)
Date: 2011-10-19 05:06

Message:
Here is the log.  The long URL (second to last) is the one relevant to this
bug report.  On my setup, I also block the "logXhrAction" URLs because they
sound like they may be trackers.  The very last URL is the real one for the
news story.  Notice that the redirect URL contains trailing ampersand
parameters that need to be truncated.

Oct 19 09:02:32.411 7f39ea3fd700 Request:
news.google.com/news/xhr/logXhrAction?
Oct 19 09:02:33.601 7f39ea3fd700 Request:
www.gstatic.com/news/img/favicon.ico
Oct 19 09:02:35.484 7f39ea3fd700 Request:
news.google.com/news/xhr/logXhrAction?&eit=s
Oct 19 09:02:35.498 7f39daffd700 Request:
news.google.com/news/xhr/eit?authuser=0
Oct 19 09:02:35.505 7f39e91f4700 Request:
news.google.com/news/xhr/logXhrAction?
Oct 19 09:02:35.508 7f39e99f5700 Request:
news.google.com/news/xhr/logXhrAction?&tgs=a
Oct 19 09:02:35.521 7f39e89f3700 Request:
news.google.com/news/url?ct2=us%2F0_0_s_1_1_a&sa=t&usg=AFQjCNHJWPc7ffoSXPSqBRz55jDA0KgxOQ&cid=8797762374160&url=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052970204485304576640791304008536.html&ei=YcqeTsymCIjxggf8uQE&rt=HOMEPAGE&vm=STANDARD&bvm=section&did=-6537064229385238098
Oct 19 09:02:35.659 7f39e89f3700 Request:
online.wsj.com/article/SB10001424052970204485304576640791304008536.html


----------------------------------------------------------------------

Comment By: Fabian Keil (fabiankeil)
Date: 2011-10-16 05:12

Message:
Thanks for the report.

I can't reproduce this with my browser configuration. Probably it requires
JavaScript, a Google account or something else.

Can you provide example URLs for both sections that we could use for
regression testing?

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=460288&aid=3421755&group_id=11118

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2d-oct