4 ms·

We're dropping all third party domains at Userify [1] (plug: SSH key management software for EC2), but for reasons of both security and privacy. What would hap

by _hyn3 11y ago

We're dropping all third party domains at Userify [1] (plug: SSH key management software for EC2), but for reasons of both security and privacy. What would happen to your website (or millions of websites) if one of the CDN's that you rely on started quietly issuing evil code to a few, targeted users? Would you notice? Would your users? I don't think that it'd be too hard for us to add a simple API call that pokes data about screen resolution, browser agent string, language, etc upon load or login, and it'll be far more efficient and private than us sending random data off to GA or similar where they frequently don't even provide us IP addresses of our own site visitors so that we can correlate the data against our own logs. The data that GA gathers is highly valuable... to Google. They only provide you visibility of the tippy tip of the iceberg.. but ultimately it's your customers' and your data, not theirs. Don't compromise your users with third-party includes, even Google Fonts (which is still our last holdout on the website.. hm, someone should make a simple web app that gathers names and styles of fonts and provides a zip w/ pre-generated CSS.) CDN's sound great but they're a huge privacy hole. Ask yourself; what's the profit model? Are they really just an opportunity to gather valuable data on other people's websites and browsing habits? (yes). Please don't leak your customers' data. 1. https://Userify.com https://Userify.com

lifeisstillgood 11y ago
All third party domains - wonderful :-). Please tell us more - would like to follow suit (am revamping my site. Where I have a different privacy protection strategy - no-one ever visits so no privacy loss)
- roel_v 11y ago
  What are you asking? How to host your own css/jquery etc? (sorry if I'm an annoying old fart in the rest of this remark but I went back to desktop software 15 years ago (yes that sounds weird) and the last 2-4 years I have more and more troubles understanding discussions on modern web development as everything that was once considered Very Bad is now not only encouraged, but taken as the natural state of affairs - e.g. javascript for core functionality, the 'css is bad, do it in javascript' movement, 'semantic markup should not even be attempted', 'frontend frameworks', ...) So yeah my question is not sarcastic, I'm just asking for some context.
  - lifeisstillgood 11y ago
    Well partly I'm asking the same question - what am I missing? CSS and other CDN based stuff I get, but hosting my own analytics? Where does one start - what can be measured, what is worth measuring? What else is done on these 10MB JS downloads we all get these days? I suppose there is a job of work to be done downloading the top 1Million web sites and seeing what crap comes through the door - but would be nice to know what the OP is replacing and with what so I know what is derigeur these days
    - roel_v 11y ago
      Oh OK then we're on the same page and I don't have much advise. Maybe just that you can look at Piwik analytics - open source and you can host it yourself. Html/dynamic pages, images, CSS, js, fonts, analytics all from the same server (or at least same domain), and as much squashed together to avoid requests, that was the 'best practice' when I was still 'current'. I don't really understand either what else there would be.
WA 11y ago
Same here. I never really used third party domain software. I used Google Fonts for a while, but I find it pathetic to have some font files and some CSS loaded from a different server than mine. Google Fonts (and every CDN) can be a lot slower than my own server. Sometimes, the site hangs while "waiting for google.com". Silly. Also, Google Fonts might be Google Analytics in disguise. Who knows. I use Piwik for tracking, but the self-hosted version. I don't even use newsletter services. I bought a cheap newsletter plugin for Wordpress which I use as an autoresponder email course. But delivery is all that matters they say. And yet, all Mailchimp and Aweber and whatnot goes 100% to my spam folder automatically. I believe the delivery argument is a myth. The best part: Decision making is much easier. "So, your product can't be installed on my own server? Bad luck, I won't become your customer."
- nacs 11y ago
  > I used Google Fonts for a while, but I find it pathetic to have some font files and some CSS loaded from a different server than mine You can have the fonts and not have any requests leave your site by using something like this[1]. It downloads the Google font data so you can serve the font files and CSS from your own site. https://github.com/majodev/google-webfonts-helper https://github.com/majodev/google-webfonts-helper
  - Wilya 11y ago
    In theory, the point of Google Fonts is that it does user-agent sniffing to adapt the font and css to the user's browser, to get the best rendering. You would lose that advantage by hosting the fonts yourself.
    - WA 11y ago
      In practice, I'd set up the CSS such that modern browsers render it beautifully and give a crap about older browsers. Or make a CSS for older browsers without that font.
  - WA 11y ago
    That's great, thank you :)
snowwrestler 11y ago
> What would happen to your website (or millions of websites) if one of the CDN's that you rely on started quietly issuing evil code to a few, targeted users? What would happen if EC2 started quietly issuing evil code to a few, targeted users? Would you notice? Would your users? What would happen if Digital Ocean started quietly issuing evil code to a few, targeted users? Would you notice? Would your users?
- lcswi 11y ago
  Great questions. People should host themselves.
  - neilellis 11y ago
    In their own garage too!
hrbrtglm 11y ago
> hm, someone should make a simple web app that gathers names and styles of fonts and provides a zip w/ pre-generated CSS I used http://www.localfont.com http://www.localfont.com to retrieve the Open Sans font I was previously using from google font. Maybe that's the kind of webapp you are looking for.
thedufer 11y ago
> What would happen to your website (or millions of websites) if one of the CDN's that you rely on started quietly issuing evil code to a few, targeted users? Would you notice? Would your users? Most of ours would. Subresource Integrity means that all of our Firefox and Chrome users would get mostly blank pages if our CDN tried to pull anything. It's really hard to justify dropping our CDN when they do so much for our load times for people outside of the US (where our servers are located). > Ask yourself; what's the profit model? Well, we pay them, so I kinda thought it was obvious. I suppose they could be selling data as well, but it doesn't seem like a great strategy to endanger so much of their userbase when there's already a clear and profitable monetization model.
frik 11y ago
What about application performance monitoring? Usual SaaS solutions use tracking solutions similar to Google Analytics (and are blocked by ad blockers).

by _hyn3 11y ago

lifeisstillgood 11y ago

All third party domains - wonderful :-). Please tell us more - would like to follow suit (am revamping my site. Where I have a different privacy protection strategy - no-one ever visits so no privacy loss)

roel_v 11y ago
What are you asking? How to host your own css/jquery etc? (sorry if I'm an annoying old fart in the rest of this remark but I went back to desktop software 15 years ago (yes that sounds weird) and the last 2-4 years I have more and more troubles understanding discussions on modern web development as everything that was once considered Very Bad is now not only encouraged, but taken as the natural state of affairs - e.g. javascript for core functionality, the 'css is bad, do it in javascript' movement, 'semantic markup should not even be attempted', 'frontend frameworks', ...) So yeah my question is not sarcastic, I'm just asking for some context.
- lifeisstillgood 11y ago
  Well partly I'm asking the same question - what am I missing? CSS and other CDN based stuff I get, but hosting my own analytics? Where does one start - what can be measured, what is worth measuring? What else is done on these 10MB JS downloads we all get these days? I suppose there is a job of work to be done downloading the top 1Million web sites and seeing what crap comes through the door - but would be nice to know what the OP is replacing and with what so I know what is derigeur these days
  - roel_v 11y ago
    Oh OK then we're on the same page and I don't have much advise. Maybe just that you can look at Piwik analytics - open source and you can host it yourself. Html/dynamic pages, images, CSS, js, fonts, analytics all from the same server (or at least same domain), and as much squashed together to avoid requests, that was the 'best practice' when I was still 'current'. I don't really understand either what else there would be.

WA 11y ago

Same here. I never really used third party domain software. I used Google Fonts for a while, but I find it pathetic to have some font files and some CSS loaded from a different server than mine. Google Fonts (and every CDN) can be a lot slower than my own server. Sometimes, the site hangs while "waiting for google.com". Silly. Also, Google Fonts might be Google Analytics in disguise. Who knows. I use Piwik for tracking, but the self-hosted version. I don't even use newsletter services. I bought a cheap newsletter plugin for Wordpress which I use as an autoresponder email course. But delivery is all that matters they say. And yet, all Mailchimp and Aweber and whatnot goes 100% to my spam folder automatically. I believe the delivery argument is a myth. The best part: Decision making is much easier. "So, your product can't be installed on my own server? Bad luck, I won't become your customer."

nacs 11y ago
> I used Google Fonts for a while, but I find it pathetic to have some font files and some CSS loaded from a different server than mine You can have the fonts and not have any requests leave your site by using something like this[1]. It downloads the Google font data so you can serve the font files and CSS from your own site. https://github.com/majodev/google-webfonts-helper https://github.com/majodev/google-webfonts-helper
- Wilya 11y ago
  In theory, the point of Google Fonts is that it does user-agent sniffing to adapt the font and css to the user's browser, to get the best rendering. You would lose that advantage by hosting the fonts yourself.
  - WA 11y ago
    In practice, I'd set up the CSS such that modern browsers render it beautifully and give a crap about older browsers. Or make a CSS for older browsers without that font.
- WA 11y ago
  That's great, thank you :)

snowwrestler 11y ago

> What would happen to your website (or millions of websites) if one of the CDN's that you rely on started quietly issuing evil code to a few, targeted users? What would happen if EC2 started quietly issuing evil code to a few, targeted users? Would you notice? Would your users? What would happen if Digital Ocean started quietly issuing evil code to a few, targeted users? Would you notice? Would your users?

lcswi 11y ago
Great questions. People should host themselves.
- neilellis 11y ago
  In their own garage too!

hrbrtglm 11y ago

> hm, someone should make a simple web app that gathers names and styles of fonts and provides a zip w/ pre-generated CSS I used http://www.localfont.com http://www.localfont.com to retrieve the Open Sans font I was previously using from google font. Maybe that's the kind of webapp you are looking for.

thedufer 11y ago

> What would happen to your website (or millions of websites) if one of the CDN's that you rely on started quietly issuing evil code to a few, targeted users? Would you notice? Would your users? Most of ours would. Subresource Integrity means that all of our Firefox and Chrome users would get mostly blank pages if our CDN tried to pull anything. It's really hard to justify dropping our CDN when they do so much for our load times for people outside of the US (where our servers are located). > Ask yourself; what's the profit model? Well, we pay them, so I kinda thought it was obvious. I suppose they could be selling data as well, but it doesn't seem like a great strategy to endanger so much of their userbase when there's already a clear and profitable monetization model.

frik 11y ago

What about application performance monitoring? Usual SaaS solutions use tracking solutions similar to Google Analytics (and are blocked by ad blockers).