4 ms·

I think if the next few years are going to be entertaining. At the moment a handful of shitty companies are abusing their ability to track users - but for me (a

I think if the next few years are going to be entertaining. At the moment a handful of shitty companies are abusing their ability to track users - but for me (and I think for many non profit-affected nerds) the outcome seems clear: ANY AND ALL third-party script have to go. Even when that means losing all the third-party goodness (CDNs, analytics, cloud providers...) that we've come to depend on. Yep, they save an uncountable amount of time and effort - but at the cost of tracking users' every step... We can't have one without the other!

tgsovlerkhgsel 7y ago
Third-party should not be the qualifier here. Cloudflare's CDNJS sets, by default, crossorigin=anonymous and subresource integrity. Add a "Referrer-Policy: no-referrer" header, and all the CDN sees is either a) nothing, because the client has the resource cached or b) a request for a certain version of jQuery without knowing where it came from. If you think this is a good idea because it enables technical enforcement, do you also want to ban static.example.com? Because if you don't, you'll soon have pointstothirdpartyadserver.example.com. If you do, you'll have https://example.com/proxytothirdpartyadserver/ https://example.com/proxytothirdpartyadserver/ instead... This is not a problem that can be completely solved on a technical level. Enforce the hell out of GDPR and see the problem shrink.
- jraph 7y ago
  It sounds like mitigating the CDN problem could be done like what the Decentraleyes browser addon does: replacing CDN hosted files by local versions. What are the difficulties for a browser to provide such a feature by default?
  - tgsovlerkhgsel 7y ago
    You need to decide which CDN files to ship locally, you need to store them, do the initial fetching, etc. There is already a system for all of that. It's called the browser cache.
tjoff 7y ago
There is nothing inherent in any of those that require tracking. Nor scripts that run in the browser.
JaggedNZ 7y ago
Honestly, if all third party scripts are blocked, the ad networks will just start making their participant sites serve the javascript direct and/or run local applications to proxy the data back to them. And unfortunately most management will force the changes through, because they want in on that ad revenue gravy train.
- hermanradtke 7y ago
  This is much harder to do, especially in larger enterprises where changes can take months. This includes updates and bug fixes. If this is where we push the industry, it will be a huge win for users.
  - Doxin 7y ago
    I'm willing to bet that IF this happens it'll amount to a lot of companies just including something like this on every page: <?PHP echo(file_get_contents("http://google.com/nefarious_crap.html")); ?>
- artificial 7y ago
  Correct, one method is via a subdomain to serve the 3rd party through. Bummer is when it’s mixed with data so blocking it isn’t as straight forward.

tgsovlerkhgsel 7y ago

Third-party should not be the qualifier here. Cloudflare's CDNJS sets, by default, crossorigin=anonymous and subresource integrity. Add a "Referrer-Policy: no-referrer" header, and all the CDN sees is either a) nothing, because the client has the resource cached or b) a request for a certain version of jQuery without knowing where it came from. If you think this is a good idea because it enables technical enforcement, do you also want to ban static.example.com? Because if you don't, you'll soon have pointstothirdpartyadserver.example.com. If you do, you'll have https://example.com/proxytothirdpartyadserver/ https://example.com/proxytothirdpartyadserver/ instead... This is not a problem that can be completely solved on a technical level. Enforce the hell out of GDPR and see the problem shrink.

jraph 7y ago
It sounds like mitigating the CDN problem could be done like what the Decentraleyes browser addon does: replacing CDN hosted files by local versions. What are the difficulties for a browser to provide such a feature by default?
- tgsovlerkhgsel 7y ago
  You need to decide which CDN files to ship locally, you need to store them, do the initial fetching, etc. There is already a system for all of that. It's called the browser cache.

tjoff 7y ago

There is nothing inherent in any of those that require tracking. Nor scripts that run in the browser.

JaggedNZ 7y ago

Honestly, if all third party scripts are blocked, the ad networks will just start making their participant sites serve the javascript direct and/or run local applications to proxy the data back to them. And unfortunately most management will force the changes through, because they want in on that ad revenue gravy train.

hermanradtke 7y ago
This is much harder to do, especially in larger enterprises where changes can take months. This includes updates and bug fixes. If this is where we push the industry, it will be a huge win for users.
- Doxin 7y ago
  I'm willing to bet that IF this happens it'll amount to a lot of companies just including something like this on every page: <?PHP echo(file_get_contents("http://google.com/nefarious_crap.html")); ?>
artificial 7y ago
Correct, one method is via a subdomain to serve the 3rd party through. Bummer is when it’s mixed with data so blocking it isn’t as straight forward.