7 ms·

Two steps in the right direction, but this one page still sends requests to soundcloud.com, rawgit.com, cloudflare.com, googleapis.com, amazonaws.com, fontaweso

Two steps in the right direction, but this one page still sends requests to soundcloud.com, rawgit.com, cloudflare.com, googleapis.com, amazonaws.com, fontawesome.com, sndcdn.com, stackcommerce.com, stackassets.com, stacksocial.com, and gravatar.com. Their "self-hosted" Plausible content is pulled from tics.techdirect.com, which resolves to 46.101.161.209 and shares a reverse DNS with custom.plausible.io. Can't tell who runs the web server on the other end of this, so it may well be self-hosted. The site also dropped a first-party one-year cookie, and let a third party drop a week-long cookie. My browser is set to send Do Not Track requests, so my explicit wishes are still being flagrantly ignored. There is still a lot of third-party tracking going on here, as well as execution of remote code under the control of third parties. It's remains a privacy and security clusterfuck but it's better than it was.

shakna 5y ago
> ... rawgit.com ... Wait, they're still serving things via rawgit? They started shutting down in 2018! That service has been deprecated for three years. That sounds like an attack that is just waiting to happen. > GitHub repositories that served content through RawGit within the last month will continue to be served until at least October of 2019. URLs for other repositories are no longer being served. > If you're currently using RawGit, please stop using it as soon as you can.
- proactivesvcs 5y ago
  Fire and forget mentality. Wasn't long ago that some advert video hosting site's domain was taken into new ownership to host porn. It must take a lot of effort to integrate all this third-party garbage into a site. If only a site's security was given a similar effort.
- MattGaiser 5y ago
  I can easily see that after 2 years there is nobody left who remembers what APIs are in the code.
- quadrifoliate 5y ago
  I am not surprised at all. Technical debt, periodic refactors or security analyses are very low on the list of things that get rewarded, and shiny new projects are high. That's until a security incident takes place, then people are reprimanded and things will be okay for a month or two. Until that's fixed, things like this will keep being commonplace.
  - deleted 5y ago
    [deleted]
wizzwizz4 5y ago
> Can't tell who runs the web server on the other end of this, so it may well be self-hosted. That looks like it's Plausible's "they host it" system.
- google234123 5y ago
  Who is “they”?
  - martin_a 5y ago
    plausible.io
google234123 5y ago
Is that DNT deprecated?
- proactivesvcs 5y ago
  It's still an option in my modern Web browser. A site admin can choose not to track me if they wish - my software is making my wishes clear and in according to a standard.
  - Conlectus 5y ago
    Worth noting that the spec was abandoned in part because enabling it actually makes you more likely to be tracked. It's another datapoint that can be used to fingerprint your device.
    - jefftk 5y ago
      Another major reason that the spec was abandoned was that no one could agree on what "tracking" meant, and so what "respecting DNT" would even mean.
  - judge2020 5y ago
    If there were legal basis for that header saying "let me use your website without being tracked" and the website owner having to do so, then it would be worth it to enable it - but, in practice, having it enabled becomes a fingerprint datapoint, and since 99% of traffic doesn't have it enabled, it becomes a pretty reliable one.
    - proactivesvcs 5y ago
      I leave it enabled out of the principle, and as a data point. Every person who has such a feature enabled is sending a message: we do not want to be tracked. It's a blip in the dark, but you can't stop the signal.
    - account42 5y ago
      I'm much happier with the GDPR idea where tracking is not allowed by default and the website has to obtain informed consent first. Of course in practice the implementations still need to be improved - both through enforcement (many of the consent dialogs are not legal), through additional standards and legislation to require them (you should be able to set your browser to automatically deny all requests) and through continuing to shame companies and individuals for their excessive tracking (at least the consent dialogs tell you about the extend now).
firloop 5y ago
FTA > are now using both Plausible and Matomo (self-hosted), Is it possible they only meant self hosted Matomo, not Plausible?
jackson1442 5y ago
> My browser is set to send Do Not Track requests, so my explicit wishes are still being flagrantly ignored. I have a dollar that says most websites you visit do not respect this setting unless they don’t use trackers at all.
- netizen-936824 5y ago
  Only a dollar? I'd put my life savings on that bet
Griffinsauce 5y ago
> gravatar.com That's not tracking right?
- autoexec 5y ago
  According to their own privacy policy the information they collect and share (read sell) includes "online identifiers", internet and network activity, device activity including cookie information, "other device identifiers", IP addresses, and geolocation data
- Ndymium 5y ago
  I doubt Automattic runs Gravatar for free out of the goodness of their hearts. It can track in two easy ways: firstly the user that requests different avatars, as they move through the web and different sites, and secondly the users whose avatars are requested, as to what services they use. Their privacy policy allows for this at a quick glance. Personally I proxy Gravatar requests through my web service's backend to get rid of the first type of tracking.
- stjohnswarts 5y ago
  Neither firefox nor adblock origin are blocking it here.
8note 5y ago
I don't think it's reasonable to expect non-giants to self host a CDN
- autoexec 5y ago
  How much do non-giants really need one? Sure, they have their advantages, but are we really at the point where every website absolutely requires their use?
  - nickff 5y ago
    Depends on what you mean by 'absolutely requires'. With search engines now emphasizing mobile experience and load times, CDNs are more necessary than ever if a site wants to appear/rank in search results.
- MomoXenosaga 5y ago
  Isn't self hosting actually a huge legal cluster fuck liability? And as much as I hate Google I think they have better security practices than most websites out there.
  - dvdkon 5y ago
    A CDN? If you load JavaScript from it, then it has about the same "power" as a server hosting the HTML of a static site. So yes, there's some potential for misuse, but unless you're implying that hosting your own website is a bad idea from a liability perspective, I'd say it's safer to host your own JS instead of using multiple CDNs as many sites do.
Abishek_Muthian 5y ago
The fact that it took Techdirt, A site which supposedly is read by all leading Big Tech CEOs this long to do away with Google Ads shows how helpless nascent independent writers who have a fraction of audience of that of techdirt are when it comes to monetization without Ads. I'm myself in that category, I know that my blog has enough visitors to break even at least the running cost with Ads but I could not pull myself to do it when I personally hate Ads, Feel its disrespectful to attention and go all the way to ensure I don't see one(Pi-Hole, UBlock etc.). My content are distributed randomly across several interests and I don't have regular schedule due to health reasons so a patreon wouldn't work. Paypal donations are blocked for my country. So the best bet is 'Buy Me a Coffee' but then I have to pay both Stripe + BMaC commissions, I have to register a business to be able to get International payments on Stripe anyways. So a direct stripe payment or similar PG is the only option to monetize open content for this scenario and since tax id is involved due to Intl. payments it's not a donation.
- stjohnswarts 5y ago
  I've never minded reasonable ads, but I don't want tracker ads and cookies. I know people who produce good content deserve at least a chance at making a buck, I just don't want to sacrifice my privacy for it though. So serve up ads related to the article content or generic random ads I suppose.
  - Abishek_Muthian 5y ago
    I agree, But advertising agencies which offer advertisements without tracking are negligible because their competition produces more conversion so obviously advertisers flock to them. Services like ethical ads are available only to select large open-source projects as the advertisers target niche audience. Affiliate links when the content isn't exactly a review of the said product/book (to avoid conflict of interest) do work in this context to some extent. But the current referral system is a mess with each product/service tying up with different middlemen or having their own system, arbitrary approval, payment issues, publishers gaming the system etc. I have started to track the need-gap for 'Single referral system for all services' on my problem validation platform[1]. [1] https://needgap.com/problems/274-single-referral-system-for-all-services-marketing-monetization https://needgap.com/problems/274-single-referral-system-for-...
manigandham 5y ago
DNT does not mean no cookies.

shakna 5y ago

> ... rawgit.com ... Wait, they're still serving things via rawgit? They started shutting down in 2018! That service has been deprecated for three years. That sounds like an attack that is just waiting to happen. > GitHub repositories that served content through RawGit within the last month will continue to be served until at least October of 2019. URLs for other repositories are no longer being served. > If you're currently using RawGit, please stop using it as soon as you can.

proactivesvcs 5y ago
Fire and forget mentality. Wasn't long ago that some advert video hosting site's domain was taken into new ownership to host porn. It must take a lot of effort to integrate all this third-party garbage into a site. If only a site's security was given a similar effort.
MattGaiser 5y ago
I can easily see that after 2 years there is nobody left who remembers what APIs are in the code.
quadrifoliate 5y ago
I am not surprised at all. Technical debt, periodic refactors or security analyses are very low on the list of things that get rewarded, and shiny new projects are high. That's until a security incident takes place, then people are reprimanded and things will be okay for a month or two. Until that's fixed, things like this will keep being commonplace.
- deleted 5y ago
  [deleted]

wizzwizz4 5y ago

> Can't tell who runs the web server on the other end of this, so it may well be self-hosted. That looks like it's Plausible's "they host it" system.

google234123 5y ago
Who is “they”?
- martin_a 5y ago
  plausible.io

google234123 5y ago

Is that DNT deprecated?

proactivesvcs 5y ago
It's still an option in my modern Web browser. A site admin can choose not to track me if they wish - my software is making my wishes clear and in according to a standard.
- Conlectus 5y ago
  Worth noting that the spec was abandoned in part because enabling it actually makes you more likely to be tracked. It's another datapoint that can be used to fingerprint your device.
  - jefftk 5y ago
    Another major reason that the spec was abandoned was that no one could agree on what "tracking" meant, and so what "respecting DNT" would even mean.
- judge2020 5y ago
  If there were legal basis for that header saying "let me use your website without being tracked" and the website owner having to do so, then it would be worth it to enable it - but, in practice, having it enabled becomes a fingerprint datapoint, and since 99% of traffic doesn't have it enabled, it becomes a pretty reliable one.
  - proactivesvcs 5y ago
    I leave it enabled out of the principle, and as a data point. Every person who has such a feature enabled is sending a message: we do not want to be tracked. It's a blip in the dark, but you can't stop the signal.
  - account42 5y ago
    I'm much happier with the GDPR idea where tracking is not allowed by default and the website has to obtain informed consent first. Of course in practice the implementations still need to be improved - both through enforcement (many of the consent dialogs are not legal), through additional standards and legislation to require them (you should be able to set your browser to automatically deny all requests) and through continuing to shame companies and individuals for their excessive tracking (at least the consent dialogs tell you about the extend now).

firloop 5y ago

FTA > are now using both Plausible and Matomo (self-hosted), Is it possible they only meant self hosted Matomo, not Plausible?

jackson1442 5y ago

> My browser is set to send Do Not Track requests, so my explicit wishes are still being flagrantly ignored. I have a dollar that says most websites you visit do not respect this setting unless they don’t use trackers at all.

netizen-936824 5y ago
Only a dollar? I'd put my life savings on that bet

Griffinsauce 5y ago

> gravatar.com That's not tracking right?

autoexec 5y ago
According to their own privacy policy the information they collect and share (read sell) includes "online identifiers", internet and network activity, device activity including cookie information, "other device identifiers", IP addresses, and geolocation data
Ndymium 5y ago
I doubt Automattic runs Gravatar for free out of the goodness of their hearts. It can track in two easy ways: firstly the user that requests different avatars, as they move through the web and different sites, and secondly the users whose avatars are requested, as to what services they use. Their privacy policy allows for this at a quick glance. Personally I proxy Gravatar requests through my web service's backend to get rid of the first type of tracking.
stjohnswarts 5y ago
Neither firefox nor adblock origin are blocking it here.

8note 5y ago

I don't think it's reasonable to expect non-giants to self host a CDN

autoexec 5y ago
How much do non-giants really need one? Sure, they have their advantages, but are we really at the point where every website absolutely requires their use?
- nickff 5y ago
  Depends on what you mean by 'absolutely requires'. With search engines now emphasizing mobile experience and load times, CDNs are more necessary than ever if a site wants to appear/rank in search results.
MomoXenosaga 5y ago
Isn't self hosting actually a huge legal cluster fuck liability? And as much as I hate Google I think they have better security practices than most websites out there.
- dvdkon 5y ago
  A CDN? If you load JavaScript from it, then it has about the same "power" as a server hosting the HTML of a static site. So yes, there's some potential for misuse, but unless you're implying that hosting your own website is a bad idea from a liability perspective, I'd say it's safer to host your own JS instead of using multiple CDNs as many sites do.

Abishek_Muthian 5y ago

The fact that it took Techdirt, A site which supposedly is read by all leading Big Tech CEOs this long to do away with Google Ads shows how helpless nascent independent writers who have a fraction of audience of that of techdirt are when it comes to monetization without Ads. I'm myself in that category, I know that my blog has enough visitors to break even at least the running cost with Ads but I could not pull myself to do it when I personally hate Ads, Feel its disrespectful to attention and go all the way to ensure I don't see one(Pi-Hole, UBlock etc.). My content are distributed randomly across several interests and I don't have regular schedule due to health reasons so a patreon wouldn't work. Paypal donations are blocked for my country. So the best bet is 'Buy Me a Coffee' but then I have to pay both Stripe + BMaC commissions, I have to register a business to be able to get International payments on Stripe anyways. So a direct stripe payment or similar PG is the only option to monetize open content for this scenario and since tax id is involved due to Intl. payments it's not a donation.

stjohnswarts 5y ago
I've never minded reasonable ads, but I don't want tracker ads and cookies. I know people who produce good content deserve at least a chance at making a buck, I just don't want to sacrifice my privacy for it though. So serve up ads related to the article content or generic random ads I suppose.
- Abishek_Muthian 5y ago
  I agree, But advertising agencies which offer advertisements without tracking are negligible because their competition produces more conversion so obviously advertisers flock to them. Services like ethical ads are available only to select large open-source projects as the advertisers target niche audience. Affiliate links when the content isn't exactly a review of the said product/book (to avoid conflict of interest) do work in this context to some extent. But the current referral system is a mess with each product/service tying up with different middlemen or having their own system, arbitrary approval, payment issues, publishers gaming the system etc. I have started to track the need-gap for 'Single referral system for all services' on my problem validation platform[1]. [1] https://needgap.com/problems/274-single-referral-system-for-all-services-marketing-monetization https://needgap.com/problems/274-single-referral-system-for-...

manigandham 5y ago

DNT does not mean no cookies.