8 ms·

It’s bad that Backblaze did not do their due diligence while integrating with Facebook pixel, but the bigger problem is the tendency of third party integrations

It’s bad that Backblaze did not do their due diligence while integrating with Facebook pixel, but the bigger problem is the tendency of third party integrations having default settings that are overly aggressive when it comes to access of user/site data. This should be a warning to every developer, when you integrate with any third party - don’t just copy the default snippet of code they recommend, read the docs thoroughly and then test/monitor what is being sent back to the third party. And if you are writing a third party widget, be considerate and make the defaults the least aggressive possible when it comes to accessing user/site/server data.

xorcist 6y ago
Due diligence when installing a tracking script? Is this not a third party script which runs in the page context?
qeternity 6y ago
> and then test/monitor what is being sent back to the third party. Trust, but verify. Especially FB. I see a lot of comments about a paid service using tracking pixels. I understand the backlash but this is also how companies that are taking your hard earned money improve and iterate on their products. I know people don’t like tracking but usage analytics are invaluable to improving the product. There’s only so much customer engagement you can do, and often that leaves really unexpected outcomes in the dark (if you asked most customers, they’d ask for a faster horse). The issue here is that Backblaze injected untrusted code into their core product which by its very nature is extremely sensitive. I’m not really sure what they were thinking. Rolling your own tracking is a pain, but some security contexts demand it.
- skinkestek 6y ago
  > Trust, but verify. Especially FB. In the particular case of Facebook many of us simplify to "don't trust if not absolutely necessary" ;-)
  - happymellon 6y ago
    I removed all Facebook many years ago. In the particular case of Facebook many of us simplify to "don't trust" There is no upside for Facebook to have anything about me.
    - qubex 6y ago
      Unfortunately Facebook has lots of information about you whether you have an account or not. You’re a big black hole with known characteristics inferred from those acquaintances of yours who interact with you in a manner Facebook can track. You might not have a name and an account, but there’s a big you-shaped golem in their data and there’s absolutely nothing you can do about it, unfortunately, and they’ll use it as they see fit with or without your consent.
      - happymellon 6y ago
        Completely agree. I block Facebook at the router but I can't stop other people giving away my PII. But I do make choices where I can.
      - ljm 6y ago
        Makes me think of that Junji Ito comic with the person-shaped holes in the rock after an earthquake. Only now, it's an allegory for social media giants and their corrupting influence on the people they lure into their system.
      - sofixa 6y ago
        You can I'd you live in a jurisdiction which gives you the right to demand for all information a company has on you, and the right to be forgotten ( GDPR in the EU, maybe California as well?)
  - bigiain 6y ago
    I totally trust Facebook. To fuck me over at every possible opportunity, even if they’ve pinky promised “we’d never do that!”. Because they have a track record of doing exactly that.
- happymellon 6y ago
  > I know people don’t like tracking but usage analytics are invaluable to improving the product. I wasn't aware that Facebook offered a Google Analytics style service, I was only aware of the Facebook Analytics for your Facebook page. Can you provide links to this service, as my Google-fu doesn't return anything.
  - wildy 6y ago
    Is it not this? https://www.facebook.com/business/learn/facebook-ads-pixel https://www.facebook.com/business/learn/facebook-ads-pixel
    - happymellon 6y ago
      Could be, I wouldn't touch a Facebook property to test it, but the description implies this is all advertising tracking rather than usage analytics.
- borispavlovic 6y ago
  Fine, then use Matomo (https://matomo.org/ https://matomo.org/) which even offers a free tier.
- tiborsaas 6y ago
  > I’m not really sure what they were thinking. My guess would be that developers installed a single Google Tag Manager script and left the tracking to the marketing/analytics team. From that point they manage what third party scripts are added to the site, not engineers. This situation cases a tunnel vision which can unfortunately lead to situations like this.
- goatinaboat 6y ago
  this is also how companies that are taking your hard earned money improve and iterate on their products. What analytics do you think they can do using Facebook that they cannot do from their own httpd access logs, a technology that's 30 years old at this point?
  - dnzm 6y ago
    Or, if that is not sufficient, one of the increasing number of ethical and/or self-hosted services, like Plausible? There is no need whatsoever to ship this kind of data to an outside party.
- stefan_ 6y ago
  Facebook doesn't make an usage analytics service. And I really, really doubt 99.9% of the people using these abundance of tracking services ever discover any worthwhile corner cases you extol their virtues for. "Analytics" is just the 2000 word for "Reporting" - clueless middlemanagers demand shiny graphics.
- deadbytes 6y ago
  Tracking is not ethical. Corporations only get away with it because most users don't realise it's even happening. If you went into a retail store and an employee followed you around the whole time with a notebook and stopwatch writing down everywhere you walked and every product you looked at, you would rightly be creeped the fuck out and tell him to stop. This is exactly what online tracking is, but done virtually.
  - sbarre 6y ago
    > If you went into a retail store and an employee followed you around the whole time with a notebook and stopwatch writing down everywhere you walked and every product you looked at I hate to break it to you, but retail companies are doing this today using security camera footage, to figure out what parts of the store customers start at, or spend the most time in..
    - prirun 6y ago
      They're also doing it with Bluetooth beacons / pings, explaining why every store has an app they want you to install: https://www.nytimes.com/interactive/2019/06/14/opinion/bluetooth-wireless-tracking-privacy.html https://www.nytimes.com/interactive/2019/06/14/opinion/bluet...
    - PeterisP 6y ago
      This is one of key applications of GDPR in Europe - the fact that you can collect data for one purpose (e.g. security cameras) does not necessarily imply that you're permitted to use the same data for any other purpose (e.g. marketing analysis of customer movements). For the former purpose, it would generally be sufficient to inform visitors with a sign on the entrance with legitimate interest clause; for the latter example IMHO the only practical compliant solution would require anonymization of the data, so you could make and store density data iff you don't have any way to tie them back to customer identities including the purchases they made, which is a key difference from the facebook example, which (as far as I understand) uses unique IDs to link the conversions to specific FB accounts.
  - charcircuit 6y ago
- fabbari 6y ago
  Pet peeve of mine: "Trust but verify" is an oxymoron. If you "trust" someone/something you don't need to verify. I understand the sentiment, but it's based on a faulty assumption that trust is a binary state. It's most exemplary case is the use done by the security teams in most IT shops: "Yes, we did put endpoint protection on your laptop, it's not that we don't trust you -- but you know what they say...". I wish they would simply say:"Of course we don't trust you, not on this. You are going to click on that shady link or download and run random executables from the interwebs. But we do trust you're good at your job".
  - PeterisP 6y ago
    The historical usage of the saying "trust but verify" is that the verification happens after they had the chance to do the thing (possibly badly), as opposed to mistrust where you'd verify everything that they'd do before allowing the thing to be done. It's essentially "audits instead of pre-approval".
beshrkayali 6y ago
At this point, every developer should (and needs) to be aware of how invasive any tracking code they blindly copy/paste into a website. I think it's required from people who operate normal websites, blogs, etc... but missing it is somewhat forgivable, especially from people just starting. But the level of irresponsibility with customers' most private data from a company who's MAIN JOB is to protect it is absolutely shocking. Yes, it's the freaking pixel that does the tracking, BUT IT'S THEIR RESPONSIBILITY TO KNOW WHAT THE HECK IS HAPPENING ON THEIR WEBSITE. Don't they have any sort of vulnerability assessment or security code review? Their reply tweet is almost as infuriating as how something like that could even happen to begin with. Like yeah, sorry, ain't our fault! It's astounding. I considered using backblaze a couple of times and now I'm very happy that I eventually didn't.
- vesinisa 6y ago
  > Don't they have any sort of vulnerability assessment or security code review? I bet people just don't realize that the frontend code could end up being a source of major data confidentiality vulnerability. The threat modeling, auditing etc. usually just concentrates on attack scenarios involving the backend to save money and keep frontend development a bit lighter on the security review process side. Does not make it excusable of course, just means their threat modeling was inadequate. But probably explains how this was able to sip into production.
  - Aeolun 6y ago
    I dunno, you don’t need to be particularly concerned with security to understand that you do not need a facebook tracking pixel on your ‘paying customer’ UI.
    - jeffasinger 6y ago
      Facebook will be pitching to your Marketing folks that's exactly where you need it. Facebook want data on what actions users took before signing up, which users actually signed up and started paying, and how that relates to revenue. This UI is exactly where they can determine these types of actions. Whether this actually makes Facebook better at marketing or not is a good question.
agilob 6y ago
>And if you are writing a third party widget, be considerate and make the defaults the least aggressive possible when it comes to accessing user/site/server data. Unless your business model is literally collecting all personal and private information, then don't do it.
magicalhippo 6y ago
> It’s bad that Backblaze did not do their due diligence while integrating with Facebook pixel Here's the thing though, being a third party, due diligence means you constantly have to check what they're doing. Because otherwise how do you know when they suddenly change their script to do something entirely different? This is why having any 3rd party scripts on a dashboard service like this is in my view entirely inexcusable. When I go to visit my cloud-based dashboard for Acronis' backup service[1] there's one single domain involved, and that's how it should be. [1]: https://www.acronis.com/en-us/products/true-image/ https://www.acronis.com/en-us/products/true-image/
- the8472 6y ago
  > Because otherwise how do you know when they suddenly change their script to do something entirely different? https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
  - magicalhippo 6y ago
    Not bad, but as far as I can see it requires you are _really_ sure no further scripts are dynamically loaded. Or is there a way for the server to specify all resources must have SRI?
    - thecopy 6y ago
      Yes, by using CSP
      - magicalhippo 6y ago
        Nice, at least it's possible.
    - the8472 6y ago
      https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... You can combine CSP it with SRI hashes and also report violations to the backend.
gruturo 6y ago
As much as I loathe and despise Facebook, this one is on Backblaze: they integrated with a well-known evil (seriously this surprises absolutely nobody) and should have been more careful with their settings. Or, you know, not have done it at all.
- tornato7 6y ago
  Why does Backblaze even need Facebook integration anyway? That seems absurd to me.
syshum 6y ago
>>It’s bad that Backblaze did not do their due diligence while integrating with Facebook pixel How much "due diligence" should be required to know that adding anything from facebook INSIDE your backup / file storage product is a bad idea... hell adding anything from facebook at any product should be considered a bad idea...
bambax 6y ago
> but the bigger problem is the tendency of third party integrations having default settings It's certainly a problem, but the biggest problem is simply that Backblaze doesn't need to integrate Facebook pixel to their web interface, especially when users are logged in. There is absolutely zero benefit to this for their users, but I also fail to see what it could bring to them as a company?? They have now created a major PR problem for themselves, and what did they get in exchange? (Ok, as the saying goes, there's no such thing as bad publicity. But still.)
- rciorba 6y ago
  The FB pixel is how FB gets to know about conversions. If your company runs FB adds, FB encourages you to let them know about which users converted to paying customers so it can improve the targeting of your ad campaign. And if you offer a free trial and the upgrade to paying customer happens inside the user dashboard, presto-bingo Marketing now needs you to install the FB pixel there. It's disappointing that this is what the internet has become, and I'm happy to see issues like this brought forward. I can see value in feeding back conversion events to an ad network, but the "just let us run code on your page" style of integration needs to stop. Give developers some API to explicitly send such an event, if they really need to.
  - jeffasinger 6y ago
    Almost every ad network does give you some type of API like what you're talking about, but unfortunately they usually actively discourage use of it.
    - jaywalk 6y ago
      Well yeah, the API isn't going to let them keep tracking your users.
tomaskafka 6y ago
The real warning is this one: Disable any third party tracking scripts on all user account pages. Assume they are hostile party's attack vector. If you want to retarget me on FB, fine, do it on a marketing pages of a website, but don't let the trackers anywhere close to my private data.
spaetzleesser 6y ago
"but the bigger problem is the tendency of third party integrations having default settings that are overly aggressive when it comes to access of user/site data. " Our permission schemes are way too broad in general. I have done some tests with Zapier and IFTTT. For every integration you consent with them seeing ALL your data, being able to modify and so on. You also don't get a log how often the permission was used.
Sephr 6y ago
We're looking to invert this equation at Transcend. All client side network emissions can be regulated in accordance with tracking consent following a block/quarantine-by-default model. This means that any network emissions you add to your site would have to be categorized by URL or domain instead of relying on shaky special-cased integrations that can fail as soon as an API changes.
atYevP 6y ago
Yev from Backblaze here -> I chimed in below but wanted to let you know hat we've finished our root cause analysis and have updated our blog post with some additional information: https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr....

xorcist 6y ago

Due diligence when installing a tracking script? Is this not a third party script which runs in the page context?

qeternity 6y ago

> and then test/monitor what is being sent back to the third party. Trust, but verify. Especially FB. I see a lot of comments about a paid service using tracking pixels. I understand the backlash but this is also how companies that are taking your hard earned money improve and iterate on their products. I know people don’t like tracking but usage analytics are invaluable to improving the product. There’s only so much customer engagement you can do, and often that leaves really unexpected outcomes in the dark (if you asked most customers, they’d ask for a faster horse). The issue here is that Backblaze injected untrusted code into their core product which by its very nature is extremely sensitive. I’m not really sure what they were thinking. Rolling your own tracking is a pain, but some security contexts demand it.

skinkestek 6y ago
> Trust, but verify. Especially FB. In the particular case of Facebook many of us simplify to "don't trust if not absolutely necessary" ;-)
- happymellon 6y ago
  I removed all Facebook many years ago. In the particular case of Facebook many of us simplify to "don't trust" There is no upside for Facebook to have anything about me.
  - qubex 6y ago
    Unfortunately Facebook has lots of information about you whether you have an account or not. You’re a big black hole with known characteristics inferred from those acquaintances of yours who interact with you in a manner Facebook can track. You might not have a name and an account, but there’s a big you-shaped golem in their data and there’s absolutely nothing you can do about it, unfortunately, and they’ll use it as they see fit with or without your consent.
    - happymellon 6y ago
      Completely agree. I block Facebook at the router but I can't stop other people giving away my PII. But I do make choices where I can.
    - ljm 6y ago
      Makes me think of that Junji Ito comic with the person-shaped holes in the rock after an earthquake. Only now, it's an allegory for social media giants and their corrupting influence on the people they lure into their system.
    - sofixa 6y ago
      You can I'd you live in a jurisdiction which gives you the right to demand for all information a company has on you, and the right to be forgotten ( GDPR in the EU, maybe California as well?)
- bigiain 6y ago
  I totally trust Facebook. To fuck me over at every possible opportunity, even if they’ve pinky promised “we’d never do that!”. Because they have a track record of doing exactly that.
happymellon 6y ago
> I know people don’t like tracking but usage analytics are invaluable to improving the product. I wasn't aware that Facebook offered a Google Analytics style service, I was only aware of the Facebook Analytics for your Facebook page. Can you provide links to this service, as my Google-fu doesn't return anything.
- wildy 6y ago
  Is it not this? https://www.facebook.com/business/learn/facebook-ads-pixel https://www.facebook.com/business/learn/facebook-ads-pixel
  - happymellon 6y ago
    Could be, I wouldn't touch a Facebook property to test it, but the description implies this is all advertising tracking rather than usage analytics.
borispavlovic 6y ago
Fine, then use Matomo (https://matomo.org/ https://matomo.org/) which even offers a free tier.
tiborsaas 6y ago
> I’m not really sure what they were thinking. My guess would be that developers installed a single Google Tag Manager script and left the tracking to the marketing/analytics team. From that point they manage what third party scripts are added to the site, not engineers. This situation cases a tunnel vision which can unfortunately lead to situations like this.
goatinaboat 6y ago
this is also how companies that are taking your hard earned money improve and iterate on their products. What analytics do you think they can do using Facebook that they cannot do from their own httpd access logs, a technology that's 30 years old at this point?
- dnzm 6y ago
  Or, if that is not sufficient, one of the increasing number of ethical and/or self-hosted services, like Plausible? There is no need whatsoever to ship this kind of data to an outside party.
stefan_ 6y ago
Facebook doesn't make an usage analytics service. And I really, really doubt 99.9% of the people using these abundance of tracking services ever discover any worthwhile corner cases you extol their virtues for. "Analytics" is just the 2000 word for "Reporting" - clueless middlemanagers demand shiny graphics.
deadbytes 6y ago
Tracking is not ethical. Corporations only get away with it because most users don't realise it's even happening. If you went into a retail store and an employee followed you around the whole time with a notebook and stopwatch writing down everywhere you walked and every product you looked at, you would rightly be creeped the fuck out and tell him to stop. This is exactly what online tracking is, but done virtually.
- sbarre 6y ago
  > If you went into a retail store and an employee followed you around the whole time with a notebook and stopwatch writing down everywhere you walked and every product you looked at I hate to break it to you, but retail companies are doing this today using security camera footage, to figure out what parts of the store customers start at, or spend the most time in..
  - prirun 6y ago
    They're also doing it with Bluetooth beacons / pings, explaining why every store has an app they want you to install: https://www.nytimes.com/interactive/2019/06/14/opinion/bluetooth-wireless-tracking-privacy.html https://www.nytimes.com/interactive/2019/06/14/opinion/bluet...
  - PeterisP 6y ago
    This is one of key applications of GDPR in Europe - the fact that you can collect data for one purpose (e.g. security cameras) does not necessarily imply that you're permitted to use the same data for any other purpose (e.g. marketing analysis of customer movements). For the former purpose, it would generally be sufficient to inform visitors with a sign on the entrance with legitimate interest clause; for the latter example IMHO the only practical compliant solution would require anonymization of the data, so you could make and store density data iff you don't have any way to tie them back to customer identities including the purchases they made, which is a key difference from the facebook example, which (as far as I understand) uses unique IDs to link the conversions to specific FB accounts.
- charcircuit 6y ago
fabbari 6y ago
Pet peeve of mine: "Trust but verify" is an oxymoron. If you "trust" someone/something you don't need to verify. I understand the sentiment, but it's based on a faulty assumption that trust is a binary state. It's most exemplary case is the use done by the security teams in most IT shops: "Yes, we did put endpoint protection on your laptop, it's not that we don't trust you -- but you know what they say...". I wish they would simply say:"Of course we don't trust you, not on this. You are going to click on that shady link or download and run random executables from the interwebs. But we do trust you're good at your job".
- PeterisP 6y ago
  The historical usage of the saying "trust but verify" is that the verification happens after they had the chance to do the thing (possibly badly), as opposed to mistrust where you'd verify everything that they'd do before allowing the thing to be done. It's essentially "audits instead of pre-approval".

beshrkayali 6y ago

At this point, every developer should (and needs) to be aware of how invasive any tracking code they blindly copy/paste into a website. I think it's required from people who operate normal websites, blogs, etc... but missing it is somewhat forgivable, especially from people just starting. But the level of irresponsibility with customers' most private data from a company who's MAIN JOB is to protect it is absolutely shocking. Yes, it's the freaking pixel that does the tracking, BUT IT'S THEIR RESPONSIBILITY TO KNOW WHAT THE HECK IS HAPPENING ON THEIR WEBSITE. Don't they have any sort of vulnerability assessment or security code review? Their reply tweet is almost as infuriating as how something like that could even happen to begin with. Like yeah, sorry, ain't our fault! It's astounding. I considered using backblaze a couple of times and now I'm very happy that I eventually didn't.

vesinisa 6y ago
> Don't they have any sort of vulnerability assessment or security code review? I bet people just don't realize that the frontend code could end up being a source of major data confidentiality vulnerability. The threat modeling, auditing etc. usually just concentrates on attack scenarios involving the backend to save money and keep frontend development a bit lighter on the security review process side. Does not make it excusable of course, just means their threat modeling was inadequate. But probably explains how this was able to sip into production.
- Aeolun 6y ago
  I dunno, you don’t need to be particularly concerned with security to understand that you do not need a facebook tracking pixel on your ‘paying customer’ UI.
  - jeffasinger 6y ago
    Facebook will be pitching to your Marketing folks that's exactly where you need it. Facebook want data on what actions users took before signing up, which users actually signed up and started paying, and how that relates to revenue. This UI is exactly where they can determine these types of actions. Whether this actually makes Facebook better at marketing or not is a good question.

agilob 6y ago

>And if you are writing a third party widget, be considerate and make the defaults the least aggressive possible when it comes to accessing user/site/server data. Unless your business model is literally collecting all personal and private information, then don't do it.

magicalhippo 6y ago

> It’s bad that Backblaze did not do their due diligence while integrating with Facebook pixel Here's the thing though, being a third party, due diligence means you constantly have to check what they're doing. Because otherwise how do you know when they suddenly change their script to do something entirely different? This is why having any 3rd party scripts on a dashboard service like this is in my view entirely inexcusable. When I go to visit my cloud-based dashboard for Acronis' backup service[1] there's one single domain involved, and that's how it should be. [1]: https://www.acronis.com/en-us/products/true-image/ https://www.acronis.com/en-us/products/true-image/

the8472 6y ago
> Because otherwise how do you know when they suddenly change their script to do something entirely different? https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- magicalhippo 6y ago
  Not bad, but as far as I can see it requires you are _really_ sure no further scripts are dynamically loaded. Or is there a way for the server to specify all resources must have SRI?
  - thecopy 6y ago
    Yes, by using CSP
    - magicalhippo 6y ago
      Nice, at least it's possible.
  - the8472 6y ago
    https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... You can combine CSP it with SRI hashes and also report violations to the backend.

gruturo 6y ago

As much as I loathe and despise Facebook, this one is on Backblaze: they integrated with a well-known evil (seriously this surprises absolutely nobody) and should have been more careful with their settings. Or, you know, not have done it at all.

tornato7 6y ago
Why does Backblaze even need Facebook integration anyway? That seems absurd to me.

syshum 6y ago

>>It’s bad that Backblaze did not do their due diligence while integrating with Facebook pixel How much "due diligence" should be required to know that adding anything from facebook INSIDE your backup / file storage product is a bad idea... hell adding anything from facebook at any product should be considered a bad idea...

bambax 6y ago

> but the bigger problem is the tendency of third party integrations having default settings It's certainly a problem, but the biggest problem is simply that Backblaze doesn't need to integrate Facebook pixel to their web interface, especially when users are logged in. There is absolutely zero benefit to this for their users, but I also fail to see what it could bring to them as a company?? They have now created a major PR problem for themselves, and what did they get in exchange? (Ok, as the saying goes, there's no such thing as bad publicity. But still.)

rciorba 6y ago
The FB pixel is how FB gets to know about conversions. If your company runs FB adds, FB encourages you to let them know about which users converted to paying customers so it can improve the targeting of your ad campaign. And if you offer a free trial and the upgrade to paying customer happens inside the user dashboard, presto-bingo Marketing now needs you to install the FB pixel there. It's disappointing that this is what the internet has become, and I'm happy to see issues like this brought forward. I can see value in feeding back conversion events to an ad network, but the "just let us run code on your page" style of integration needs to stop. Give developers some API to explicitly send such an event, if they really need to.
- jeffasinger 6y ago
  Almost every ad network does give you some type of API like what you're talking about, but unfortunately they usually actively discourage use of it.
  - jaywalk 6y ago
    Well yeah, the API isn't going to let them keep tracking your users.

tomaskafka 6y ago

The real warning is this one: Disable any third party tracking scripts on all user account pages. Assume they are hostile party's attack vector. If you want to retarget me on FB, fine, do it on a marketing pages of a website, but don't let the trackers anywhere close to my private data.

spaetzleesser 6y ago

"but the bigger problem is the tendency of third party integrations having default settings that are overly aggressive when it comes to access of user/site data. " Our permission schemes are way too broad in general. I have done some tests with Zapier and IFTTT. For every integration you consent with them seeing ALL your data, being able to modify and so on. You also don't get a log how often the permission was used.

Sephr 6y ago

We're looking to invert this equation at Transcend. All client side network emissions can be regulated in accordance with tracking consent following a block/quarantine-by-default model. This means that any network emissions you add to your site would have to be categorized by URL or domain instead of relying on shaky special-cased integrations that can fail as soon as an API changes.

atYevP 6y ago

Yev from Backblaze here -> I chimed in below but wanted to let you know hat we've finished our root cause analysis and have updated our blog post with some additional information: https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr....