5 ms·

> Suggesting that Amazon aren't tracking requests to Cloudfront is ridiculous. Counting a solitary log that an IP loaded a resource is hardly the tracking that

> Suggesting that Amazon aren't tracking requests to Cloudfront is ridiculous. Counting a solitary log that an IP loaded a resource is hardly the tracking that is harmful. This is the absolutism that derails the discussion for me. In one step, you have forsworn any service which doesn't own it's entire stack from CDN to network switches to racks on the data center. How many websites do this? Worth noting that HN doesn't and is therefore allowing "third-parties" to "track" you. And yet you have no problem using HN.

avmich 7y ago
> This is the absolutism that derails the discussion for me. Sorry. Many of us have assumptions which are hard to change. > In one step, you have forsworn any service which doesn't own it's entire stack from CDN to network switches to racks on the data center. No quite so. There are modern tools which make owning the entire stack not absolutely necessary - end to end encryption and proxies, including Tor-like, come to mind. We're in the state of flux regarding privacy, both with losses and some gains, so it's not binary. If HN uses it, it's a reason to improve things - not to dismiss as unattainable the privacy feature which seems so essential for many purposes.
wpietri 7y ago
Do we know what tracking Amazon does and how harmful it is? I mean, I'm willing to believe that Amazon just doesn't care what I get up to. But as somebody who has watched the Amazon website be ever more about revenue maximization without regard to my interests, I can also believe that they will use any and all data if it gives them as much 0.1% bump in a key metric. I'll also note that a lot of what people shrug off as normal nowadays would have seemed wildly paranoid to most people 15 years ago. So I don't think our intuitions for "oh, they'd never do that" are particularly reliable.
coldtea 7y ago
>This is the absolutism that derails the discussion for me Because things are going very well on this privacy front, and it's the absolutism that should be curbed?
tlb 7y ago
I don't believe HN does! If so, we should change it. What third party tracking do you see?
- deleted 7y ago
  [deleted]
- nindalf 7y ago
  HN doesn’t own their entire stack. Since there is one or more third parties involved, those third parties are tracking you as you read this ... or so GP would have you believe.
jammygit 7y ago
Then again, Facebook uses your security QA pairs as personal info and adds it to your “what we know about you” profile. Even harmless security and logging features lately are being used for tracking beyond their original scope. It’s a bit of a difficult position to navigate
southerntofu 7y ago
> Counting a solitary log that an IP loaded a resource is hardly the tracking that is harmful. Well the thing is you don't know if it's a single log line. What if the 3rd party script you loaded has been modified by a malicious attacker as happened with the great firewall DDOS on Github last year? As server operators, we have a responsibility to preserve the privacy and security of our users. This includes the possibility to leverage 3rd party services when we need it, as long as we make it clear to the users. Having 3rd party requests taking place on the backend means you take the security/performance measures to ensure your website operates properly. Loading these 3rd party resources on the client side means those operational costs/risks lie on your users. You are literally opening backdoors to the browsers of all your users. Also worth noting, 3rd party resources & client side rendering (among other recent silicon valley fashions) play very poorly with higher-latency links. It's a truly degrading experience for your users.
m463 7y ago
CDNs like akamai make money from user tracking across sites.
hedora 7y ago
Are http referrers somehow disabled? All I got out of this article is that there is a wide divide between what the author and I consider to be tracking.

avmich 7y ago

> This is the absolutism that derails the discussion for me. Sorry. Many of us have assumptions which are hard to change. > In one step, you have forsworn any service which doesn't own it's entire stack from CDN to network switches to racks on the data center. No quite so. There are modern tools which make owning the entire stack not absolutely necessary - end to end encryption and proxies, including Tor-like, come to mind. We're in the state of flux regarding privacy, both with losses and some gains, so it's not binary. If HN uses it, it's a reason to improve things - not to dismiss as unattainable the privacy feature which seems so essential for many purposes.

wpietri 7y ago

Do we know what tracking Amazon does and how harmful it is? I mean, I'm willing to believe that Amazon just doesn't care what I get up to. But as somebody who has watched the Amazon website be ever more about revenue maximization without regard to my interests, I can also believe that they will use any and all data if it gives them as much 0.1% bump in a key metric. I'll also note that a lot of what people shrug off as normal nowadays would have seemed wildly paranoid to most people 15 years ago. So I don't think our intuitions for "oh, they'd never do that" are particularly reliable.

coldtea 7y ago

>This is the absolutism that derails the discussion for me Because things are going very well on this privacy front, and it's the absolutism that should be curbed?

tlb 7y ago

I don't believe HN does! If so, we should change it. What third party tracking do you see?

deleted 7y ago
[deleted]
nindalf 7y ago
HN doesn’t own their entire stack. Since there is one or more third parties involved, those third parties are tracking you as you read this ... or so GP would have you believe.

jammygit 7y ago

Then again, Facebook uses your security QA pairs as personal info and adds it to your “what we know about you” profile. Even harmless security and logging features lately are being used for tracking beyond their original scope. It’s a bit of a difficult position to navigate

southerntofu 7y ago

> Counting a solitary log that an IP loaded a resource is hardly the tracking that is harmful. Well the thing is you don't know if it's a single log line. What if the 3rd party script you loaded has been modified by a malicious attacker as happened with the great firewall DDOS on Github last year? As server operators, we have a responsibility to preserve the privacy and security of our users. This includes the possibility to leverage 3rd party services when we need it, as long as we make it clear to the users. Having 3rd party requests taking place on the backend means you take the security/performance measures to ensure your website operates properly. Loading these 3rd party resources on the client side means those operational costs/risks lie on your users. You are literally opening backdoors to the browsers of all your users. Also worth noting, 3rd party resources & client side rendering (among other recent silicon valley fashions) play very poorly with higher-latency links. It's a truly degrading experience for your users.

m463 7y ago

CDNs like akamai make money from user tracking across sites.

hedora 7y ago

Are http referrers somehow disabled? All I got out of this article is that there is a wide divide between what the author and I consider to be tracking.