[darrikmazey]

Ensure the "tweet this" or "like this" button does not generate a request to the 3rd party site simply by loading the Mozilla webpage the button is on (e.g. no requests to third party site without user's intent via clicking on the button).

Thank you for this.

[zobzu]

I'm not sure you can do this without voiding the agreement with twitter/facebook unfortunately.

I'd suggest the use of Ghostery (works on all major browsers) on the client side, and on the server site, well, you know, not use any like button :>

[skymt]

Heise Online worked out a solution[0]: a two-click Like button. The first click replaces a placeholder with the official Facebook Like button. Facebook objected at first, but only because Heise tried to make their placeholder look official. A quick design change allowed them to keep it.

[0]: http://news.ycombinator.com/item?id=2957119

[zobzu]

Yeah that's why I'm not sure. It could be attacked depending on the country I guess, and if you don't use a facebook-like icon, its hard to tell what you're going to like. Debatable I guess

[cowboyhero]

twitter allows custom links/ buttons. These don't require on-loading JavaScript or any calls to their services.

[justincormack]

Most GET requests to third part sites are fine, you need to be more precise.

[darrikmazey]

A GET request for an embedded resource exposes the user's cookies for that domain and associates a user of one site as a user of another. This is fine when it is at the user's explicitly intended request, but when paired with certain sites known not to delete all cookies on logout, this is nefarious and should not be done.