6 ms·

My blog (ahelwer.ca) uses Hugo hosted on gitlab pages; I notice that privacy badger flags two trackers on it, cloudflare CDN and google fonts. I'm assuming gfon

My blog (ahelwer.ca) uses Hugo hosted on gitlab pages; I notice that privacy badger flags two trackers on it, cloudflare CDN and google fonts. I'm assuming gfonts is because the Hugo theme I'm using uses a google-provided font and cloudflare CDN is there because it's automatically added by gitlab or something; anyone know how you can create a completely tracker-free experience? Do you basically have to stand up your own webserver on a cloud provider (or at home)? I guess without cloudflare or some other CDN you'd also have to hope your server can handle serving all the traffic directly. Or would a different static site generator like pelican help?

detritus 6y ago
Your posts seems to highlight why I'm wary about these extractable site generator things - it appears that people much smarter than I use them out of the box but don't really peer into that box, so end up with queries like yours. Whereas dumb people like me hand code a site and keep small chunks of code or 'boot strap' type folders where we can re-use old assets quickly and with the knowledge of exactly what's in them. I don't use Hugo, etc, but it seems odd to me that it's not abundantly clear how to nix CDN and Google asset references from the site generation code.
- ahelwer 6y ago
  No disrespect intended, I've just never enjoyed all the tinkering that comes with managing this stuff myself. I just want to write & publish my posts somehow; used to use medium but then they added all these popups and annoying things, so I switched to Hugo. Now, it might be a good stepping stone to eventually just setting this all up myself, since I've been frustrated with the limitations of markdown & hugo shortcodes and occasionally just want to write things in HTML (yes I know you can write HTML in hugo markdown pages). But I never would get to that stage straight from hosted blogs like medium, so it is good that static site generators exist I think.
  - detritus 6y ago
    No disrespect assumed! :) tbh, when I see people using things like Hugo, i tend to assume they're on a part of the web dev spectrum that is equal-to or further-along than mine. This my failing. I made assumptions about your situation. I just tend to assume that people default to things like Wordpress when they need to exist in that hinterland between publication and bother. Perhaps I need to look into these things a bit more!
- zerkten 6y ago
  > I don't use Hugo, etc, but it seems odd to me that it's not abundantly clear how to nix CDN and Google asset references from the site generation code. All static site generators do is take a bunch of inputs (markdown files, templates, config, images, etc.) and process them to output a directory of HTML and assets. It's usually trivial to do a search on the input side and identify the source of the problem code. Commenting it out and reprocessing results in it being removed. You only run into complications when there is some odd dependency between the static site generator and the inputs. Generally, it'll delegate everything to the templates it uses (good separation of concerns), but sometimes there is a weird config option, or convention you are supposed to use.
- paultopia 6y ago
  Static site generators are really useful for ongoing projects with new pages being added all the time. I hand-roll my discrete "here's a page for a thing" sites, and use SSGs for things like blogs, classes, etc., stuff where I might just decide to add a page when I'm sitting on a train, and would like to just be able to type it out in markdown on my phone, push a commit, and have it appear.
TacoSteemers 6y ago
You could get your own hosting, and not use Cloudflare. You could then host the font on your own site. My site doesn't load any files from a different domain since I removed the Twitter share button javascript[0], except for one page. I moved the mailchimp signup to a separate page to isolate their JS code to just that page. [0] https://tacosteemers.com/articles/2020-08-30-twitter-share-button-does-not-need-javascript.html https://tacosteemers.com/articles/2020-08-30-twitter-share-b...
- TacoSteemers 6y ago
  To add to my answer: If we depend on other people's hosting and themes then we just kind of have to accept what they offer. But getting our own hosting doesn't have to be difficult. There are many cheap providers that give sftp access, for example. Pelican comes with a script for uploading to sftp.
- oneeyedpigeon 6y ago
  > You could then host the font on your own site. Only if you have a licence for it — font licences are typically prohibitively expensive for individuals' use.
  - detaro 6y ago
    All Google Fonts are open-source.
    - oneeyedpigeon 6y ago
      That's ... interesting. I must admit, I think somewhere in the back of my mind I knew that, but I'm so used to font services requiring to be used remotely, I hadn't even really considered that. So there's absolutely no breach of any kind of law or terms if you host them locally? That could be a game-changer, thanks!
      - onion2k 6y ago
        So there's absolutely no breach of any kind of law or terms if you host them locally? Open source doesn't necessarily mean free to use for whatever you want. Which licence a font on Google Fonts uses varies - common ones are Apache and Open Font Licence, but you should check the licence file in any font pack you download.
vladvasiliu 6y ago
I quick look on what happens, it would seem cloudflare is used to load katex.js You may be able to disable this in the theme config if you don't use it.
- ahelwer 6y ago
  Ahhh thank you, looks like that's used to render MathML, which I do use. Perhaps I can add katex.js to the git repo and serve it from wherever it is gitlab hosts their websites.
  - vladvasiliu 6y ago
    I'm no hugo expert, but that's likely possible. After all, the JS files are static content. You can probably modify the theme's template to load the js from the origin. I guess the whole point of using cloudflare as the cdn is so that people can reuse this from cache.
    - ahelwer 6y ago
      That's an interesting trade-off. I guess static sites are small enough that downloading an extra script wouldn't be terrible, by modern heavyweight website standards. Still, maybe I should look into what cloudflare CDN actually does with its data.
  - abdullahkhalids 6y ago
    I use pelican-katex plugin to render math once during website generation, and then not have to load the katex.js file at all. Only a katex.css file and fonts loaded from my own server. https://github.com/cqql/pelican-katex https://github.com/cqql/pelican-katex
merlinscholz 6y ago
I host my blog on netlify.com, works great and automatically builds on git push. Instead of cloudflare CDN they use their own CDN network.
- onion2k 6y ago
  I also use Netlify. On the free tier of Netlify a site is deployed to 6 points on the Netlify Edge CDN (Frankfurt, Singapore, San Francisco, New York, Sao Paolo, Sydney, Moscow as of August this year, but it might have changed). On the free tier of Cloudflare a site is deployed to 194 locations. That can knock a couple of hundred ms off of a page load time. It might be worthwhile if you need something to be especially fast. That said, Cloudflare is much more of a hassle to set up. Netlify is ludicrously easy. That's one of the many things I like about it.
  - StavrosK 6y ago
    Why is Cloudflare more of a hassle? Point your nameservers to them, done. I use Cloudflare in front of Netlify.
  - Kye 6y ago
    Step 1: set up on Netlify Step 2: add the domain on Cloudflare and let it grab the DNS entries Netlify made
oneeyedpigeon 6y ago
The google font issue is obviously down to you, but GitHub pages doesn't add anything that gets flagged by Privacy Badger.
otekeng 6y ago
Gitlab pages doesn't inherently use trackers - See link below showing Privacy Badger for my page that's also built with Hugo. Your trackers probably come from your Hugo template, I had to edit the template to remove them. https://otekeng.gitlab.io/privacy_badger.PNG https://otekeng.gitlab.io/privacy_badger.PNG
ficklepickle 6y ago
You should add a CNAME record for the www subdomain. As it stands now, appending "www." results in a server not found. Browsers append that automatically sometimes. The cloudflare CDN is there because your theme includes "auto-render.min.js" and "katex.min.js" from cdnjs.cloudflare.com. They are in script tags in your homepage HTML. You can verify this with: > curl -L ahelwer.ca | grep 'auto-render.min.js' You can check my domain if you want an example of a CNAME record: > dig CNAME www.jeremypoole.ca I am also using Hugo, I modified a theme called "coder". As far as avoiding trackers, it would depend on what you mean by tracker. In your case, the external requests are for fonts and a couple of JavaScript dependencies. You could easily host those yourself instead of using the CDN, and then there would be no third-party HTTP requests. As a fellow .ca HNer, I would gladly help you out. Feel free to hit me up.
- saagarjha 6y ago
  GitLab Pages also apparently needs a TXT verification record for the subdomain as well, otherwise it'll serve a 401. (GitHub Pages does not seem to require this.)
xconverge 6y ago
Thanks for this question, it allowed me to tune some of the cloudflare optimizations I didn't need (Rocket Loader) and remove the dependency for the script pull and thus the tracking flag with privacy badger! I hadn't even thought to check if my own site met my own personal bar/criteria for trackers and ads!

detritus 6y ago

Your posts seems to highlight why I'm wary about these extractable site generator things - it appears that people much smarter than I use them out of the box but don't really peer into that box, so end up with queries like yours. Whereas dumb people like me hand code a site and keep small chunks of code or 'boot strap' type folders where we can re-use old assets quickly and with the knowledge of exactly what's in them. I don't use Hugo, etc, but it seems odd to me that it's not abundantly clear how to nix CDN and Google asset references from the site generation code.

ahelwer 6y ago
No disrespect intended, I've just never enjoyed all the tinkering that comes with managing this stuff myself. I just want to write & publish my posts somehow; used to use medium but then they added all these popups and annoying things, so I switched to Hugo. Now, it might be a good stepping stone to eventually just setting this all up myself, since I've been frustrated with the limitations of markdown & hugo shortcodes and occasionally just want to write things in HTML (yes I know you can write HTML in hugo markdown pages). But I never would get to that stage straight from hosted blogs like medium, so it is good that static site generators exist I think.
- detritus 6y ago
  No disrespect assumed! :) tbh, when I see people using things like Hugo, i tend to assume they're on a part of the web dev spectrum that is equal-to or further-along than mine. This my failing. I made assumptions about your situation. I just tend to assume that people default to things like Wordpress when they need to exist in that hinterland between publication and bother. Perhaps I need to look into these things a bit more!
zerkten 6y ago
> I don't use Hugo, etc, but it seems odd to me that it's not abundantly clear how to nix CDN and Google asset references from the site generation code. All static site generators do is take a bunch of inputs (markdown files, templates, config, images, etc.) and process them to output a directory of HTML and assets. It's usually trivial to do a search on the input side and identify the source of the problem code. Commenting it out and reprocessing results in it being removed. You only run into complications when there is some odd dependency between the static site generator and the inputs. Generally, it'll delegate everything to the templates it uses (good separation of concerns), but sometimes there is a weird config option, or convention you are supposed to use.
paultopia 6y ago
Static site generators are really useful for ongoing projects with new pages being added all the time. I hand-roll my discrete "here's a page for a thing" sites, and use SSGs for things like blogs, classes, etc., stuff where I might just decide to add a page when I'm sitting on a train, and would like to just be able to type it out in markdown on my phone, push a commit, and have it appear.

TacoSteemers 6y ago

You could get your own hosting, and not use Cloudflare. You could then host the font on your own site. My site doesn't load any files from a different domain since I removed the Twitter share button javascript[0], except for one page. I moved the mailchimp signup to a separate page to isolate their JS code to just that page. [0] https://tacosteemers.com/articles/2020-08-30-twitter-share-button-does-not-need-javascript.html https://tacosteemers.com/articles/2020-08-30-twitter-share-b...

TacoSteemers 6y ago
To add to my answer: If we depend on other people's hosting and themes then we just kind of have to accept what they offer. But getting our own hosting doesn't have to be difficult. There are many cheap providers that give sftp access, for example. Pelican comes with a script for uploading to sftp.
oneeyedpigeon 6y ago
> You could then host the font on your own site. Only if you have a licence for it — font licences are typically prohibitively expensive for individuals' use.
- detaro 6y ago
  All Google Fonts are open-source.
  - oneeyedpigeon 6y ago
    That's ... interesting. I must admit, I think somewhere in the back of my mind I knew that, but I'm so used to font services requiring to be used remotely, I hadn't even really considered that. So there's absolutely no breach of any kind of law or terms if you host them locally? That could be a game-changer, thanks!
    - onion2k 6y ago
      So there's absolutely no breach of any kind of law or terms if you host them locally? Open source doesn't necessarily mean free to use for whatever you want. Which licence a font on Google Fonts uses varies - common ones are Apache and Open Font Licence, but you should check the licence file in any font pack you download.

vladvasiliu 6y ago

I quick look on what happens, it would seem cloudflare is used to load katex.js You may be able to disable this in the theme config if you don't use it.

ahelwer 6y ago
Ahhh thank you, looks like that's used to render MathML, which I do use. Perhaps I can add katex.js to the git repo and serve it from wherever it is gitlab hosts their websites.
- vladvasiliu 6y ago
  I'm no hugo expert, but that's likely possible. After all, the JS files are static content. You can probably modify the theme's template to load the js from the origin. I guess the whole point of using cloudflare as the cdn is so that people can reuse this from cache.
  - ahelwer 6y ago
    That's an interesting trade-off. I guess static sites are small enough that downloading an extra script wouldn't be terrible, by modern heavyweight website standards. Still, maybe I should look into what cloudflare CDN actually does with its data.
- abdullahkhalids 6y ago
  I use pelican-katex plugin to render math once during website generation, and then not have to load the katex.js file at all. Only a katex.css file and fonts loaded from my own server. https://github.com/cqql/pelican-katex https://github.com/cqql/pelican-katex

merlinscholz 6y ago

I host my blog on netlify.com, works great and automatically builds on git push. Instead of cloudflare CDN they use their own CDN network.

onion2k 6y ago
I also use Netlify. On the free tier of Netlify a site is deployed to 6 points on the Netlify Edge CDN (Frankfurt, Singapore, San Francisco, New York, Sao Paolo, Sydney, Moscow as of August this year, but it might have changed). On the free tier of Cloudflare a site is deployed to 194 locations. That can knock a couple of hundred ms off of a page load time. It might be worthwhile if you need something to be especially fast. That said, Cloudflare is much more of a hassle to set up. Netlify is ludicrously easy. That's one of the many things I like about it.
- StavrosK 6y ago
  Why is Cloudflare more of a hassle? Point your nameservers to them, done. I use Cloudflare in front of Netlify.
- Kye 6y ago
  Step 1: set up on Netlify Step 2: add the domain on Cloudflare and let it grab the DNS entries Netlify made

oneeyedpigeon 6y ago

The google font issue is obviously down to you, but GitHub pages doesn't add anything that gets flagged by Privacy Badger.

otekeng 6y ago

Gitlab pages doesn't inherently use trackers - See link below showing Privacy Badger for my page that's also built with Hugo. Your trackers probably come from your Hugo template, I had to edit the template to remove them. https://otekeng.gitlab.io/privacy_badger.PNG https://otekeng.gitlab.io/privacy_badger.PNG

ficklepickle 6y ago

You should add a CNAME record for the www subdomain. As it stands now, appending "www." results in a server not found. Browsers append that automatically sometimes. The cloudflare CDN is there because your theme includes "auto-render.min.js" and "katex.min.js" from cdnjs.cloudflare.com. They are in script tags in your homepage HTML. You can verify this with: > curl -L ahelwer.ca | grep 'auto-render.min.js' You can check my domain if you want an example of a CNAME record: > dig CNAME www.jeremypoole.ca I am also using Hugo, I modified a theme called "coder". As far as avoiding trackers, it would depend on what you mean by tracker. In your case, the external requests are for fonts and a couple of JavaScript dependencies. You could easily host those yourself instead of using the CDN, and then there would be no third-party HTTP requests. As a fellow .ca HNer, I would gladly help you out. Feel free to hit me up.

saagarjha 6y ago
GitLab Pages also apparently needs a TXT verification record for the subdomain as well, otherwise it'll serve a 401. (GitHub Pages does not seem to require this.)

xconverge 6y ago

Thanks for this question, it allowed me to tune some of the cloudflare optimizations I didn't need (Rocket Loader) and remove the dependency for the script pull and thus the tracking flag with privacy badger! I hadn't even thought to check if my own site met my own personal bar/criteria for trackers and ads!