5 ms·

I just want to point out that I was unable to fill out my 2021 marketplace application on healthcare.gov until I stopped blocking optimizely.com in Little Snitc

by _qulr 6y ago

I just want to point out that I was unable to fill out my 2021 marketplace application on healthcare.gov until I stopped blocking optimizely.com in Little Snitch.

sneak 6y ago
That’s terrible. Nobody should be compelled to provide their private health information to a single, unelected private company to obtain government benefits or comply with the law.
- jcims 6y ago
  It's been like that since the initial release unfortunately. Realistically private companies support all sorts of government operations and have access to all sorts of extremely sensitive information. There's just something extra creepy about seeing it happen in your browser. (It's not immediately obvious what can be gleaned but most likely more than what you would gather from a cursory glance.) Here's a few of the domains from just the front page: adsrvr.org advertising.com chartbeat.com chartbeat.net digitalgov.gov doubleclick.net google-analytics.com google.com googleapis.com googletagmanager.com govdelivery.com gstatic.com healthcare.gov newrelic.com nr-data.net optimizely.com qualtrics.com quantummetric.com tealiumiq.com tiqcdn.com Edit: After a bit more looking I really think they need a bug bounty or something. This site has been dinged numerous times for infosec practices and it doesn't seem like the message is getting through.
  - _qulr 6y ago
    I have quite a few of those domains blocked, but other than optimizely, blocking seems to have no effect on functionality.
  - jcims 6y ago
    This is what you want to see in your Optimizely code from Healthcare.gov:  <script> !function(f,b,e,v,n,t,s) {if(f.fbq)return;n=f.fbq=function(){n.callMethod? n.callMethod.apply(n,arguments):n.queue.push(arguments)}; if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0'; n.queue=[];t=b.createElement(e);t.async=!0; t.src=v;s=b.getElementsByTagName(e)[0]; s.parentNode.insertBefore(t,s)}(window, document,'script', 'https://connect.facebook.net/en_US/fbevents.js'); fbq('init', '1706186366368131'); fbq('track', 'PageView'); fbq('track', 'Lead'); </script> lol
  - clairity 6y ago
    it's infuriating that google is so embedded in government. i'm routinely thwarted from using government websites, especially in CA, because i block google (especially captcha). if you're in gov (or not), please advocate for using/building open-source, privacy-conscious analytics tools rather than giving all of our sensitive information to uncaring corporations like google. the right to privacy extends to our personal data and google shouldn't be a information tollbooth between us and government services.
- ineedasername 6y ago
  At a glance, it looks like optimizely does A/B testing. Couldn't they do that without receiving personal data?
nobleach 6y ago
Because optimizely is a marketing department's wet dream for invalidating a dev department. "See, we can add content by ourselves! we don't need any highly paid developers!". Meanwhile, it jacks in jQuery to add DOM nodes on a page that might not appreciate that method of content injection.

by _qulr 6y ago

I just want to point out that I was unable to fill out my 2021 marketplace application on healthcare.gov until I stopped blocking optimizely.com in Little Snitch.

sneak 6y ago

That’s terrible. Nobody should be compelled to provide their private health information to a single, unelected private company to obtain government benefits or comply with the law.

jcims 6y ago
It's been like that since the initial release unfortunately. Realistically private companies support all sorts of government operations and have access to all sorts of extremely sensitive information. There's just something extra creepy about seeing it happen in your browser. (It's not immediately obvious what can be gleaned but most likely more than what you would gather from a cursory glance.) Here's a few of the domains from just the front page: adsrvr.org advertising.com chartbeat.com chartbeat.net digitalgov.gov doubleclick.net google-analytics.com google.com googleapis.com googletagmanager.com govdelivery.com gstatic.com healthcare.gov newrelic.com nr-data.net optimizely.com qualtrics.com quantummetric.com tealiumiq.com tiqcdn.com Edit: After a bit more looking I really think they need a bug bounty or something. This site has been dinged numerous times for infosec practices and it doesn't seem like the message is getting through.
- _qulr 6y ago
  I have quite a few of those domains blocked, but other than optimizely, blocking seems to have no effect on functionality.
- jcims 6y ago
  This is what you want to see in your Optimizely code from Healthcare.gov:  <script> !function(f,b,e,v,n,t,s) {if(f.fbq)return;n=f.fbq=function(){n.callMethod? n.callMethod.apply(n,arguments):n.queue.push(arguments)}; if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0'; n.queue=[];t=b.createElement(e);t.async=!0; t.src=v;s=b.getElementsByTagName(e)[0]; s.parentNode.insertBefore(t,s)}(window, document,'script', 'https://connect.facebook.net/en_US/fbevents.js'); fbq('init', '1706186366368131'); fbq('track', 'PageView'); fbq('track', 'Lead'); </script> lol
- clairity 6y ago
  it's infuriating that google is so embedded in government. i'm routinely thwarted from using government websites, especially in CA, because i block google (especially captcha). if you're in gov (or not), please advocate for using/building open-source, privacy-conscious analytics tools rather than giving all of our sensitive information to uncaring corporations like google. the right to privacy extends to our personal data and google shouldn't be a information tollbooth between us and government services.
ineedasername 6y ago
At a glance, it looks like optimizely does A/B testing. Couldn't they do that without receiving personal data?

nobleach 6y ago

Because optimizely is a marketing department's wet dream for invalidating a dev department. "See, we can add content by ourselves! we don't need any highly paid developers!". Meanwhile, it jacks in jQuery to add DOM nodes on a page that might not appreciate that method of content injection.