6 ms·

I really hate the statement "built-in privacy: this site does not use any javascript", because privacy is not specifically violated by JS, and you can track (o

I really hate the statement "built-in privacy: this site does not use any javascript", because privacy is not specifically violated by JS, and you can track (or 3rd-party track) without JS just fine. Their site clearly does not need JS, but this misinforms their audience about privacy and safe browsing. Also, according to their Privacy Policy, they collect your IP (for Geolocation) and browser type... two pieces of data that are, in a great percentage of cases, enough to identify someone.

rpdillon 6y ago
Having used uMatrix over the past several years, I grow weary seeing almost every site bring in cascading JavaScript dependencies across 3-4 additional domains, sometimes as many as a dozen. I agree that technically, JS doesn't have to violate privacy, but in practice, the internet is packed to the brim with JS-powered 3rd party tracking.
- b4ke 6y ago
  Philosopher kings communicate in ways the average individual has issue grokking, doesn’t invalidate the potential for abuse to complain that it’s free of “tracking”
- mrspeaker 6y ago
  I agree - and I'm sick of it too. I don't think "no JS means no tracking", but it means "more likely less tracking" and "definitely a lot less bullshit 3rd party shenanigans". I absolutely love JavaScript, have been a fan of it since before it was cool, stayed a fan after it was not cool again, and am still a fan now! But now the benefits it brings me on the web is snowed under by the shit it delivers. It's not worth it. JavaScript is off by default everywhere for me now, and there has to be a really compelling reason to get me to whitelist a site. Most often (I'd say about 80-90% of unknown/non-regular links I click) I just close the tab and go somewhere else. Luckily there's a lot of sites out there, and there's starting to be more services like the OP's - which I will be able to visit!
b4ke 6y ago
How do you know that JavaScript doesn’t have an extra-dimensional component the human mind little understands?
vikramkr 6y ago
Who do you think that statement is targeting in their marketing? Clearly not full techies that would probably pick up that it's BS. Your everyday non-tech person wouldn't care about this service anyway since who cares what a javascript is, linkedin works fine. I guess there's a band of somewhat tech-aware folks who've heard a out wizards of privacy that go a step beyond adblockers to block javascript, and so think that no javascript==good?
- b4ke 6y ago
  Well the fact that you feel more aware of tech, but are talking about wizardry.... says a lot. Dimensionality is obviously complex, but critical consideration is just that.
  - vikramkr 6y ago
    You didn't read the comment correctly. Wizardry is from the perspective of the tech aware but not tech saavy users.
    - b4ke 6y ago
      so there is no potential for unknown dimensional qualities associated with language? i mean if that were the case, i doubt that sex would sell as well as it does....
superkuh 6y ago
I really hate the people talk about 'collecting' IP addresses or getting their "IP address exposed". There is no risk in anyone knowing this, not to privacy, not to security. This is how the internet is meant to work. A bunch of equal nodes. Just because mega-corps and wireless telcos have gimped the wildly popular mobile computers and taken away their ability to interact (no ipv4, no ports, not much beyond web) doesn't mean interacting directly is bad or unsafe or giving away some 'secret' information. No, we need more people directly interacting with other people via the internet protocol. We desparately need widespread ipv6 adoption so that everyone can have their own IPs and expose them all to each other in the emergent network we call the 'net. This 'IP as privacy risk' is scaremongering and very unhealthy.
- throwaway_pdp09 6y ago
  > and very unhealthy very unhealthy indeed if you're a reporter in some parts of the world not doing what's judged to be right.
- jefftk 6y ago
  If we went full IPv6 and everyone had their own unique IP, then tracking people across sites would not require JavaScript, requests to trackers, or even cookies. There are things that are nice about a world like that, but it's definitely a step back in privacy from today where tracking protection tools work pretty well. Willful IP blindness is one way to have communication over IP without allowing it to be used for tracking: https://github.com/bslassey/ip-blindness https://github.com/bslassey/ip-blindness
- CharlesW 6y ago
  > I really hate the people talk about 'collecting' IP addresses or getting their "IP address exposed". There is no risk in anyone knowing this, not to privacy, not to security. That's like saying there's no privacy or security risk to everyone knowing your home address or your phone number. I can understand if you're not concerned by it, but it's non-zero. Privacy-wise, knowing your router's IP address is enough to score/segment you and (over time) to build a profile on you. Security-wise, an IP address enables bad actors to scan and potentially attack your router and possibly your internal network. Real Security Experts™, am I wrong?
heavyset_go 6y ago
JavaScript tracking can provide much more personal and behavioral data than server logs can.
zie 6y ago
The browser hands that information over, even if you didn't want it to. a lot of info is just included with every HTTP request per the protocol. You can to some degree massage what your browser sends, to varying degrees of success, but there is not an easy 'send only non-unique things please' button. Obviously the IP has to be sent regardless, the only way to get around that is VPN and similar tech.
adsjhdashkj 6y ago
While i agree, i do think there is an aspect to it that's true. Eg, when you visit a site you, imo - agree to some degree of privacy violation with that site. Ie, it's reasonable to expect them to know your IP. It's reasonable to expect them to know your rough location. It's reasonable to expect them to know your username if you log in, and etc. What's unreasonable is the 50 sites that cascade off of an initial visit. I may have been fine giving my IP to bobsblog.com but not Google/etc. An interesting extension of this idea would be a hosting service or web framework that didn't just say something like "no javascript", but rather "no external connections with your information". All images, CSS, JS, etc would be loaded locally and nothing would make any remote connections from your IP. Come to think of it, this would be a neat "contract" that sites could agree to. Like No JS, such that browser clients could enforce it and get the expected UX on those sites. /shrug, just thinking out loud i suppose.

rpdillon 6y ago

Having used uMatrix over the past several years, I grow weary seeing almost every site bring in cascading JavaScript dependencies across 3-4 additional domains, sometimes as many as a dozen. I agree that technically, JS doesn't have to violate privacy, but in practice, the internet is packed to the brim with JS-powered 3rd party tracking.

b4ke 6y ago
Philosopher kings communicate in ways the average individual has issue grokking, doesn’t invalidate the potential for abuse to complain that it’s free of “tracking”
mrspeaker 6y ago
I agree - and I'm sick of it too. I don't think "no JS means no tracking", but it means "more likely less tracking" and "definitely a lot less bullshit 3rd party shenanigans". I absolutely love JavaScript, have been a fan of it since before it was cool, stayed a fan after it was not cool again, and am still a fan now! But now the benefits it brings me on the web is snowed under by the shit it delivers. It's not worth it. JavaScript is off by default everywhere for me now, and there has to be a really compelling reason to get me to whitelist a site. Most often (I'd say about 80-90% of unknown/non-regular links I click) I just close the tab and go somewhere else. Luckily there's a lot of sites out there, and there's starting to be more services like the OP's - which I will be able to visit!

b4ke 6y ago

How do you know that JavaScript doesn’t have an extra-dimensional component the human mind little understands?

vikramkr 6y ago

Who do you think that statement is targeting in their marketing? Clearly not full techies that would probably pick up that it's BS. Your everyday non-tech person wouldn't care about this service anyway since who cares what a javascript is, linkedin works fine. I guess there's a band of somewhat tech-aware folks who've heard a out wizards of privacy that go a step beyond adblockers to block javascript, and so think that no javascript==good?

b4ke 6y ago
Well the fact that you feel more aware of tech, but are talking about wizardry.... says a lot. Dimensionality is obviously complex, but critical consideration is just that.
- vikramkr 6y ago
  You didn't read the comment correctly. Wizardry is from the perspective of the tech aware but not tech saavy users.
  - b4ke 6y ago
    so there is no potential for unknown dimensional qualities associated with language? i mean if that were the case, i doubt that sex would sell as well as it does....

superkuh 6y ago

I really hate the people talk about 'collecting' IP addresses or getting their "IP address exposed". There is no risk in anyone knowing this, not to privacy, not to security. This is how the internet is meant to work. A bunch of equal nodes. Just because mega-corps and wireless telcos have gimped the wildly popular mobile computers and taken away their ability to interact (no ipv4, no ports, not much beyond web) doesn't mean interacting directly is bad or unsafe or giving away some 'secret' information. No, we need more people directly interacting with other people via the internet protocol. We desparately need widespread ipv6 adoption so that everyone can have their own IPs and expose them all to each other in the emergent network we call the 'net. This 'IP as privacy risk' is scaremongering and very unhealthy.

throwaway_pdp09 6y ago
> and very unhealthy very unhealthy indeed if you're a reporter in some parts of the world not doing what's judged to be right.
jefftk 6y ago
If we went full IPv6 and everyone had their own unique IP, then tracking people across sites would not require JavaScript, requests to trackers, or even cookies. There are things that are nice about a world like that, but it's definitely a step back in privacy from today where tracking protection tools work pretty well. Willful IP blindness is one way to have communication over IP without allowing it to be used for tracking: https://github.com/bslassey/ip-blindness https://github.com/bslassey/ip-blindness
CharlesW 6y ago
> I really hate the people talk about 'collecting' IP addresses or getting their "IP address exposed". There is no risk in anyone knowing this, not to privacy, not to security. That's like saying there's no privacy or security risk to everyone knowing your home address or your phone number. I can understand if you're not concerned by it, but it's non-zero. Privacy-wise, knowing your router's IP address is enough to score/segment you and (over time) to build a profile on you. Security-wise, an IP address enables bad actors to scan and potentially attack your router and possibly your internal network. Real Security Experts™, am I wrong?

heavyset_go 6y ago

JavaScript tracking can provide much more personal and behavioral data than server logs can.

zie 6y ago

The browser hands that information over, even if you didn't want it to. a lot of info is just included with every HTTP request per the protocol. You can to some degree massage what your browser sends, to varying degrees of success, but there is not an easy 'send only non-unique things please' button. Obviously the IP has to be sent regardless, the only way to get around that is VPN and similar tech.

adsjhdashkj 6y ago

While i agree, i do think there is an aspect to it that's true. Eg, when you visit a site you, imo - agree to some degree of privacy violation with that site. Ie, it's reasonable to expect them to know your IP. It's reasonable to expect them to know your rough location. It's reasonable to expect them to know your username if you log in, and etc. What's unreasonable is the 50 sites that cascade off of an initial visit. I may have been fine giving my IP to bobsblog.com but not Google/etc. An interesting extension of this idea would be a hosting service or web framework that didn't just say something like "no javascript", but rather "no external connections with your information". All images, CSS, JS, etc would be loaded locally and nothing would make any remote connections from your IP. Come to think of it, this would be a neat "contract" that sites could agree to. Like No JS, such that browser clients could enforce it and get the expected UX on those sites. /shrug, just thinking out loud i suppose.