5 ms·

> suggesting that Stratechery includes trackers from Amazon because I rely on AWS is ridiculous. On the contrary. Suggesting that Amazon aren't tracking reques

> suggesting that Stratechery includes trackers from Amazon because I rely on AWS is ridiculous. On the contrary. Suggesting that Amazon aren't tracking requests to Cloudfront is ridiculous. You don't need to have malicious intent in order to accidentally send your user's data to third-party companies. Every single time you load any resource from anywhere, you create at minimum a line in their log file that contains your user's IP address, their User-Agent string, the content their browser requested, and the time they requested it. EDIT: Personally, I no longer load any resources from third-party domains in new code I write. Bootstrap, jquery, etc. get served from the same domain as the rest of the website. Google Analytics is an absolute non-starter. And if you're concerned about wasting loading time or bandwidth on popular assets, you can use the "integrity" attribute to let the browser reuse a cached file from a different domain.

pfortuny 7y ago
Honest question: I have personal page on S3 which I deliver using CloudFront. Should I think that this is an unwanted behaviour for my (certainly few) visitors? I am asking in full honestly, not trying to create an argument here.
- jstanley 7y ago
  It's less than optimal from a privacy perspective, and it's worth being cognizant of that, but it wouldn't be enough to stop me from looking at the website. Just don't serve stuff out of CloudFront and then cry foul when people point out that you're helping Amazon track your users around the Internet. :)
  - pfortuny 7y ago
    Aha, understood. Thanks for the explanation.
- cameronbrown 7y ago
  There's virtually (heh) no way to host a web page that doesn't involve another company's infrastructure (AWS, your ISP, etc), even any number of nodes logging that some packets were forwarded from A to C. If it's important to you then the best that can be done is find a company you can trust doesn't have profit motive to use this data and use always use HTTPS. AWS is big enough that there's probably very little profit in analysing CloudFront logs but then again I don't know that.
  - pfortuny 7y ago
    No, no: it was just a "technical" security question, not personally important at all. Thanks for the reply.
  - RandomBacon 7y ago
    If a website was on TOR, it would be virtually untrackable by those other companies, right? Technically the website is still using the infrastructure, but they wouldn't have details about the end user. Can we get more "normal" websites on TOR please?
    - cameronbrown 7y ago
      That's true, but we're not living in a world where everyone uses Tor. I think it'd be pretty cool to see though.
      - n3k5 7y ago
        Yeah, pretty cool, if you're into cypherpunky solutions to an extent where you don't mind the accompanying dystopia. I get why some users need Tor, many of them for agreeable reasons, and that they would benefit from more people using Tor (and having more nodes available). But I think making it the default way of using the internet for everyone would be stupid. If the average connection goes through n hops, the entire infrastructure would have to be multiplied by that factor. Just the environmental impact (in terms of increased energy consumption and hardware production) would be significant. And when Tor is the only effective option you have for escaping unwanted tracking, you're disadvantaged as soon as you want to use a service that doesn't work well with he increased latency. There has to be a better way. Not that I could say what exactly that would be, but what would be really cool to see is a world in which everyone has worry-free internet access. Multiplying the cost doesn't seem like the best approach.
    - southerntofu 7y ago
      I think you're mixing two different aspects of the Tor project. On the server side, onion services (running a tor daemon that reverse-proxies request to your HTTP/mail server) provide end-to-end encryption and secure name resolution (transport security). On the client side, the Tor Browser is a custom Firefox edition that aims to make user fingerprinting impossible among Tor Browser users. From a server's perspective, they are all the same; they also come from the same IP address (the Tor exit nodes) when the service is not an onion. Enabling an onion service does not prevent 3rd party tracking although it raises the bar. Third-party scripts/cookies can still do plenty of tracking. That's why those (as well as web fonts and SVG) are disabled in Tor Browser's Safer security settings, and javascript is completely disabled in the Safest mode. So fingerprinting protection really is taken care of on the client side. Neither onion routing nor onion services will help you evade tracking if you use a classic browser.
- hedora 7y ago
  CloudFront effectively blocks Tor: https://www.theregister.co.uk/2016/10/05/cloudflare_tor/ https://www.theregister.co.uk/2016/10/05/cloudflare_tor/ They are trying to fix it (or were in 2016, at least), but it is the biggest practical barrier to using Tor (bigger than performance).
nindalf 7y ago
> Suggesting that Amazon aren't tracking requests to Cloudfront is ridiculous. Counting a solitary log that an IP loaded a resource is hardly the tracking that is harmful. This is the absolutism that derails the discussion for me. In one step, you have forsworn any service which doesn't own it's entire stack from CDN to network switches to racks on the data center. How many websites do this? Worth noting that HN doesn't and is therefore allowing "third-parties" to "track" you. And yet you have no problem using HN.
- avmich 7y ago
  > This is the absolutism that derails the discussion for me. Sorry. Many of us have assumptions which are hard to change. > In one step, you have forsworn any service which doesn't own it's entire stack from CDN to network switches to racks on the data center. No quite so. There are modern tools which make owning the entire stack not absolutely necessary - end to end encryption and proxies, including Tor-like, come to mind. We're in the state of flux regarding privacy, both with losses and some gains, so it's not binary. If HN uses it, it's a reason to improve things - not to dismiss as unattainable the privacy feature which seems so essential for many purposes.
- wpietri 7y ago
  Do we know what tracking Amazon does and how harmful it is? I mean, I'm willing to believe that Amazon just doesn't care what I get up to. But as somebody who has watched the Amazon website be ever more about revenue maximization without regard to my interests, I can also believe that they will use any and all data if it gives them as much 0.1% bump in a key metric. I'll also note that a lot of what people shrug off as normal nowadays would have seemed wildly paranoid to most people 15 years ago. So I don't think our intuitions for "oh, they'd never do that" are particularly reliable.
- coldtea 7y ago
  >This is the absolutism that derails the discussion for me Because things are going very well on this privacy front, and it's the absolutism that should be curbed?
- tlb 7y ago

pfortuny 7y ago

Honest question: I have personal page on S3 which I deliver using CloudFront. Should I think that this is an unwanted behaviour for my (certainly few) visitors? I am asking in full honestly, not trying to create an argument here.

jstanley 7y ago
It's less than optimal from a privacy perspective, and it's worth being cognizant of that, but it wouldn't be enough to stop me from looking at the website. Just don't serve stuff out of CloudFront and then cry foul when people point out that you're helping Amazon track your users around the Internet. :)
- pfortuny 7y ago
  Aha, understood. Thanks for the explanation.
cameronbrown 7y ago
There's virtually (heh) no way to host a web page that doesn't involve another company's infrastructure (AWS, your ISP, etc), even any number of nodes logging that some packets were forwarded from A to C. If it's important to you then the best that can be done is find a company you can trust doesn't have profit motive to use this data and use always use HTTPS. AWS is big enough that there's probably very little profit in analysing CloudFront logs but then again I don't know that.
- pfortuny 7y ago
  No, no: it was just a "technical" security question, not personally important at all. Thanks for the reply.
- RandomBacon 7y ago
  If a website was on TOR, it would be virtually untrackable by those other companies, right? Technically the website is still using the infrastructure, but they wouldn't have details about the end user. Can we get more "normal" websites on TOR please?
  - cameronbrown 7y ago
    That's true, but we're not living in a world where everyone uses Tor. I think it'd be pretty cool to see though.
    - n3k5 7y ago
      Yeah, pretty cool, if you're into cypherpunky solutions to an extent where you don't mind the accompanying dystopia. I get why some users need Tor, many of them for agreeable reasons, and that they would benefit from more people using Tor (and having more nodes available). But I think making it the default way of using the internet for everyone would be stupid. If the average connection goes through n hops, the entire infrastructure would have to be multiplied by that factor. Just the environmental impact (in terms of increased energy consumption and hardware production) would be significant. And when Tor is the only effective option you have for escaping unwanted tracking, you're disadvantaged as soon as you want to use a service that doesn't work well with he increased latency. There has to be a better way. Not that I could say what exactly that would be, but what would be really cool to see is a world in which everyone has worry-free internet access. Multiplying the cost doesn't seem like the best approach.
  - southerntofu 7y ago
    I think you're mixing two different aspects of the Tor project. On the server side, onion services (running a tor daemon that reverse-proxies request to your HTTP/mail server) provide end-to-end encryption and secure name resolution (transport security). On the client side, the Tor Browser is a custom Firefox edition that aims to make user fingerprinting impossible among Tor Browser users. From a server's perspective, they are all the same; they also come from the same IP address (the Tor exit nodes) when the service is not an onion. Enabling an onion service does not prevent 3rd party tracking although it raises the bar. Third-party scripts/cookies can still do plenty of tracking. That's why those (as well as web fonts and SVG) are disabled in Tor Browser's Safer security settings, and javascript is completely disabled in the Safest mode. So fingerprinting protection really is taken care of on the client side. Neither onion routing nor onion services will help you evade tracking if you use a classic browser.
hedora 7y ago
CloudFront effectively blocks Tor: https://www.theregister.co.uk/2016/10/05/cloudflare_tor/ https://www.theregister.co.uk/2016/10/05/cloudflare_tor/ They are trying to fix it (or were in 2016, at least), but it is the biggest practical barrier to using Tor (bigger than performance).

nindalf 7y ago

> Suggesting that Amazon aren't tracking requests to Cloudfront is ridiculous. Counting a solitary log that an IP loaded a resource is hardly the tracking that is harmful. This is the absolutism that derails the discussion for me. In one step, you have forsworn any service which doesn't own it's entire stack from CDN to network switches to racks on the data center. How many websites do this? Worth noting that HN doesn't and is therefore allowing "third-parties" to "track" you. And yet you have no problem using HN.

avmich 7y ago
> This is the absolutism that derails the discussion for me. Sorry. Many of us have assumptions which are hard to change. > In one step, you have forsworn any service which doesn't own it's entire stack from CDN to network switches to racks on the data center. No quite so. There are modern tools which make owning the entire stack not absolutely necessary - end to end encryption and proxies, including Tor-like, come to mind. We're in the state of flux regarding privacy, both with losses and some gains, so it's not binary. If HN uses it, it's a reason to improve things - not to dismiss as unattainable the privacy feature which seems so essential for many purposes.
wpietri 7y ago
Do we know what tracking Amazon does and how harmful it is? I mean, I'm willing to believe that Amazon just doesn't care what I get up to. But as somebody who has watched the Amazon website be ever more about revenue maximization without regard to my interests, I can also believe that they will use any and all data if it gives them as much 0.1% bump in a key metric. I'll also note that a lot of what people shrug off as normal nowadays would have seemed wildly paranoid to most people 15 years ago. So I don't think our intuitions for "oh, they'd never do that" are particularly reliable.
coldtea 7y ago
>This is the absolutism that derails the discussion for me Because things are going very well on this privacy front, and it's the absolutism that should be curbed?
tlb 7y ago