5 ms·

I went a step further and designed my blog (https://sheep.horse/ https://sheep.horse/) not to use any third-party resources at all. This was easy for me because

I went a step further and designed my blog (https://sheep.horse/ https://sheep.horse/) not to use any third-party resources at all. This was easy for me because I am never going to make money from my ramblings about Rogue One or the last book I read. I am actually not against advertising in principle, or even tracking if that is what you want, but the current trend to pull in lots of resources (ads, tracking scripts, web fonts, CDN javascript libraries) from third parties scares me. When you serve a page to a user, you are responsible (morally and legally) for what happens on the user's computer. Ad network serves up malicious code? Your fault. Tracker places cookie on user's machine even if your privacy policy says you won't? Your fault. New version of that CDN'ed Javascript library does something you don't expect? Your fault. I wish more sites would arrange their own advertising like this guy, but I imagine it is a pain in the neck. [edit] I wrote a post expanding on this idea: https://sheep.horse/2016/6/a_website_manifesto_-_introducing_sheep.horse.html https://sheep.horse/2016/6/a_website_manifesto_-_introducing...

mi100hael 10y ago
> New version of that CDN'ed Javascript library does something you don't expect? Your fault. That's what the "integrity" field is for. If the CDN tries to change the file surreptitiously, it'll have a different checksum and the browser won't run it.
- AndrewStephens 10y ago
  True, that is a step in the right direction. Ideally that would work for any resource - fonts, images, etc.
andygates 10y ago
> When you serve a page to a user, you are responsible (morally and legally) for what happens on the user's computer. Ad network serves up malicious code? Your fault. Morally, absolutely, but has it been tested legally? I can see sites weaselling out by saying that they trusted their ad networks to do good, etc, etc, and nobody learning from it.
- AndrewStephens 10y ago
  As far as I know, it has not been tested legally but I would hate to be the defendant as the plaintive's lawyer displayed a screenshot of the page that damaged their client's computers with my URL displayed at the top.
jff 10y ago
I have the same philosophy. I have, over the last couple of years, stripped Javascript and other external assets from my site. First I removed Disqus from my blog, because Internet comments are a cesspit anyway. Then I removed Google Analytics because the tracking outweighs the benefits. Then I removed an externally-loaded font. I finally figured out the last thing, a little bit of JS that Cloudflare was injecting to obfuscate my email address. I contemplated just getting rid of Cloudflare because fucking with my webpage content is pretty bad, but instead opted to disable the functionality.
- AndrewStephens 10y ago
  I kind of miss analytics but I don't want to force my readers to run Javascript just to satisfy my curiosity. I can go through my logs if I want to see how many people read a page. My old wordpress blog got so few legitimate comments that I never bother to add a commenting system into my new software. Even when a post got hundreds of reads due to being linked on slashdot or whatever, very few people left comments directly. Perhaps I just have nothing interesting to say. If you add Disqus then you are just effectively letting other people make money off your content and if anyone makes money off my writing it should be me. I figure if anyone wants to tell me something about my posts they can contact me in many other ways. Plus, even if I loved Disqus (and it is pretty sweet if you want that functionality), who knows if they are going to be operating in 5 years time? They could go under or get bought out by someone who plasters ads everywhere. Then it is bye-bye to years worth of content in the comments. Much better, I think, to be responsible for hosting everything your users will see, even if it means forgoing some of the nice functionality third-parties can provide.The cost-benefit ratio just isn't favorable. I considered obfuscating my email address but I couldn't remember the last time spam actually hit my gmail inbox.
  - pmlnr 10y ago
    > I kind of miss analytics If you have access to your webserver's access log: http://www.awstats.org/ http://www.awstats.org/ http://www.webalizer.org/ http://www.webalizer.org/
  - dandelion_lover 10y ago
rsync 10y ago
"I went a step further and designed my blog (https://sheep.horse/ https://sheep.horse/) not to use any third-party resources at all. This was easy for me because I am never going to make money from my ramblings about Rogue One or the last book I read." We (Oh By)[1] did this as well - the difference being that there is probably a fair amount of money we will miss out on in the coming decade by making this decision. It's an attack vector, it's user hostile, it's slow, it's fragile and it supports an industry that has only degraded the promise of the Internet. It makes me happy to run a service that doesn't touch it at all. [1] https://0x.co https://0x.co

mi100hael 10y ago

> New version of that CDN'ed Javascript library does something you don't expect? Your fault. That's what the "integrity" field is for. If the CDN tries to change the file surreptitiously, it'll have a different checksum and the browser won't run it.

AndrewStephens 10y ago
True, that is a step in the right direction. Ideally that would work for any resource - fonts, images, etc.

andygates 10y ago

> When you serve a page to a user, you are responsible (morally and legally) for what happens on the user's computer. Ad network serves up malicious code? Your fault. Morally, absolutely, but has it been tested legally? I can see sites weaselling out by saying that they trusted their ad networks to do good, etc, etc, and nobody learning from it.

AndrewStephens 10y ago
As far as I know, it has not been tested legally but I would hate to be the defendant as the plaintive's lawyer displayed a screenshot of the page that damaged their client's computers with my URL displayed at the top.

jff 10y ago

I have the same philosophy. I have, over the last couple of years, stripped Javascript and other external assets from my site. First I removed Disqus from my blog, because Internet comments are a cesspit anyway. Then I removed Google Analytics because the tracking outweighs the benefits. Then I removed an externally-loaded font. I finally figured out the last thing, a little bit of JS that Cloudflare was injecting to obfuscate my email address. I contemplated just getting rid of Cloudflare because fucking with my webpage content is pretty bad, but instead opted to disable the functionality.

AndrewStephens 10y ago
I kind of miss analytics but I don't want to force my readers to run Javascript just to satisfy my curiosity. I can go through my logs if I want to see how many people read a page. My old wordpress blog got so few legitimate comments that I never bother to add a commenting system into my new software. Even when a post got hundreds of reads due to being linked on slashdot or whatever, very few people left comments directly. Perhaps I just have nothing interesting to say. If you add Disqus then you are just effectively letting other people make money off your content and if anyone makes money off my writing it should be me. I figure if anyone wants to tell me something about my posts they can contact me in many other ways. Plus, even if I loved Disqus (and it is pretty sweet if you want that functionality), who knows if they are going to be operating in 5 years time? They could go under or get bought out by someone who plasters ads everywhere. Then it is bye-bye to years worth of content in the comments. Much better, I think, to be responsible for hosting everything your users will see, even if it means forgoing some of the nice functionality third-parties can provide.The cost-benefit ratio just isn't favorable. I considered obfuscating my email address but I couldn't remember the last time spam actually hit my gmail inbox.
- pmlnr 10y ago
  > I kind of miss analytics If you have access to your webserver's access log: http://www.awstats.org/ http://www.awstats.org/ http://www.webalizer.org/ http://www.webalizer.org/
- dandelion_lover 10y ago

rsync 10y ago

"I went a step further and designed my blog (https://sheep.horse/ https://sheep.horse/) not to use any third-party resources at all. This was easy for me because I am never going to make money from my ramblings about Rogue One or the last book I read." We (Oh By)[1] did this as well - the difference being that there is probably a fair amount of money we will miss out on in the coming decade by making this decision. It's an attack vector, it's user hostile, it's slow, it's fragile and it supports an industry that has only degraded the promise of the Internet. It makes me happy to run a service that doesn't touch it at all. [1] https://0x.co https://0x.co