5 ms·

Looks a bit like adware IMO. The library appears to be drenched in analytics. Dependencies include: https://www.npmjs.com/package/web-vitals/v/0.1.0 https://ww

by af3d 5y ago

Looks a bit like adware IMO. The library appears to be drenched in analytics. Dependencies include: https://www.npmjs.com/package/web-vitals/v/0.1.0 https://www.npmjs.com/package/web-vitals/v/0.1.0 https://www.npmjs.com/package/@fingerprintjs/fingerprintjs https://www.npmjs.com/package/@fingerprintjs/fingerprintjs Harvesting user's data, most likely...

MonaroVXR 5y ago
How did you figure this out?
- lcabral 5y ago
  The page has a link at the bottom to the GitHub project where you check the dependencies...
  - true_religion 5y ago
    Yes but it’s not a library. It’s an entire website. It even uses Firebase.
ianschmitz 5y ago
There's nothing wrong with web-vitals...
- hughcrt 5y ago
  There's nothing wrong with web-vitals, and it's included in create-react-app, which the author used.
  - true_religion 5y ago
    I agree, though for the sake of argument Facebooks tolerance for tracking and fingerprinting far exceeds anyone else’s on the internet so their stamp of approval for web vitals is meaningless.
- croes 5y ago
  But there is much wrong with finger printing.
Karliss 5y ago
It looks like there is some confusion of what it is. The content you see in linked page is the the software not a demonstration of how the library output looks. If it was a library taking in bytes and outputting bytes I would agree that it shouldn't depend on any analytics, but if it's a website that's more of authors choice.
okumurahata 5y ago
Author here; some clarification. I use fingerprint to get the number of visits (instead of using something invasive like Google Analytics): https://github.com/erikmartinjordan/jsonmatic/blob/master/src/Analytics.js https://github.com/erikmartinjordan/jsonmatic/blob/master/sr... I get the fingerprint as a UID (which is like a random number for me). I don't harvest any user's data. Code is open-source, you can verify what I'm saying if you wish.
- koolba 5y ago
  Collecting usage statistics is harvesting data. This is a classic example of why you should never run random NPM modules. Or even install them as all of this is possible in a post install script too. Putting analytics in a deployed app is your prerogative. Putting it in what touts itself as a reusable component is at best frowned upon.
  - okumurahata 5y ago
    Ok, I see your point. I update the website. This commit deletes any kind of data harvesting (removes fingerprint and visit counting): https://github.com/erikmartinjordan/jsonmatic/commit/7f3fa892fa5527ec4ef9bc772c96dba365678b04 https://github.com/erikmartinjordan/jsonmatic/commit/7f3fa89...
    - johndough 5y ago
      web-vitals is still there. What is it used for? https://github.com/erikmartinjordan/jsonmatic/blob/f926f197bd166ae81a19f740831808819c809fa9/package.json#L20 https://github.com/erikmartinjordan/jsonmatic/blob/f926f197b...
      - okumurahata 5y ago
        It comes by default on React apps, it’s not used for anything.

by af3d 5y ago

MonaroVXR 5y ago

How did you figure this out?

lcabral 5y ago
The page has a link at the bottom to the GitHub project where you check the dependencies...
- true_religion 5y ago
  Yes but it’s not a library. It’s an entire website. It even uses Firebase.

ianschmitz 5y ago

There's nothing wrong with web-vitals...

hughcrt 5y ago
There's nothing wrong with web-vitals, and it's included in create-react-app, which the author used.
- true_religion 5y ago
  I agree, though for the sake of argument Facebooks tolerance for tracking and fingerprinting far exceeds anyone else’s on the internet so their stamp of approval for web vitals is meaningless.
croes 5y ago
But there is much wrong with finger printing.

Karliss 5y ago

It looks like there is some confusion of what it is. The content you see in linked page is the the software not a demonstration of how the library output looks. If it was a library taking in bytes and outputting bytes I would agree that it shouldn't depend on any analytics, but if it's a website that's more of authors choice.

okumurahata 5y ago

Author here; some clarification. I use fingerprint to get the number of visits (instead of using something invasive like Google Analytics): https://github.com/erikmartinjordan/jsonmatic/blob/master/src/Analytics.js https://github.com/erikmartinjordan/jsonmatic/blob/master/sr... I get the fingerprint as a UID (which is like a random number for me). I don't harvest any user's data. Code is open-source, you can verify what I'm saying if you wish.

koolba 5y ago
Collecting usage statistics is harvesting data. This is a classic example of why you should never run random NPM modules. Or even install them as all of this is possible in a post install script too. Putting analytics in a deployed app is your prerogative. Putting it in what touts itself as a reusable component is at best frowned upon.
- okumurahata 5y ago
  Ok, I see your point. I update the website. This commit deletes any kind of data harvesting (removes fingerprint and visit counting): https://github.com/erikmartinjordan/jsonmatic/commit/7f3fa892fa5527ec4ef9bc772c96dba365678b04 https://github.com/erikmartinjordan/jsonmatic/commit/7f3fa89...
  - johndough 5y ago
    web-vitals is still there. What is it used for? https://github.com/erikmartinjordan/jsonmatic/blob/f926f197bd166ae81a19f740831808819c809fa9/package.json#L20 https://github.com/erikmartinjordan/jsonmatic/blob/f926f197b...
    - okumurahata 5y ago
      It comes by default on React apps, it’s not used for anything.