3 ms·

A beta/early-access program?

onion2k 5y ago
Tracking people almost always a bad idea in my opinion. Even if they get something in return like early access to something. Even if they're happy to accept being tracked. There just isn't a good justification for it in most cases. For a start, most sites that track users don't even use the data they gather. They're just gathering it because they're think they're expected to. So many sites implement Google Analytics, Hotjar, etc and then use the data as nothing more than a web counter. That's beyond infuriating to anyone who thinks privacy is worth fighting for. If you're going to violate my privacy, at least do it for a good reason. In the case of the article there could be solid reasons for hoovering up lots of information about users. But really, unless you're in a massive company with significant resources, all of that perf data is just going to sit in a database and a senior might occasionally look at the dashboard overview and think "We should make our images smaller." or "Huh, users have a sucky time when they're on Android. Oh well.". Those are not good reasons to gather real-world user data instead of relying on Lighthouse scores. Lighthouse is "good enough" for most people. I imagine that a frustrating part of working on web perf is that small companies and startups don't have the resources to do it well, so they end up cargo-culting what Google does but without spending time or effort to make good on what they might learn. To be fair to the author, I'm much more at fault here than they are. I have no doubt that the article is aimed it at a much smaller audience (the web perf community), and now I'm here saying it's not applicable in a much broader context because it was posted to HN. I apologize to them for that. This is something I care about and it was an opportunity to rant. :)
- lelandfe 5y ago
  I’m not sure we are in agreement on what tracking means. This article advocates logging performance timings. You can’t track someone with that.
  - onion2k 5y ago
    This article advocates logging performance timings. You can’t track someone with that. Firstly, yes you can - https://www.researchgate.net/publication/2441386_Timing_Attacks_on_Web_Privacy https://www.researchgate.net/publication/2441386_Timing_Atta... - but that's not the point here. Secondly, web perf testing benefits from user tracking. It is very common for perf and tracking to be used together. In fact, I don't actually know of a time where I've seen perf metrics being used without tracking. I'd agree that it's possible to track perf metrics without tying them to a specific user, but even then you still need to be sending user data back to your server. I'm not in favour of that for something as trivial (in most case) as just making a website load slightly faster. Site owners should start with the assumption that they don't actually need data and then only track things that are critical to the functioning of their website. There will be very few cases where knowing how fast the page loaded actually meets that criteria.
    - lelandfe 5y ago
      > Firstly, yes you can 20 year old paper. "Domain tagging," Felten and Schneider's proposed countermeasure, was implemented as "cache partitioning" in Firefox, Safari, and Chrome. If you're aware of extant issues please let me know. > In fact, I don't actually know of a time where I've seen perf metrics being used without tracking Google's own library: https://github.com/GoogleChrome/web-vitals#overview https://github.com/GoogleChrome/web-vitals#overview, which is recommended in OP's article. > I'm not in favour of that for something as trivial (in most case) as just making a website load slightly faster No performance RUM means no knowledge of performance regressions. I have deployed changes that looked great on our CI and then gravely impacted performance for a segment of customers. Blinding a business to user experience because you've read papers on historic exploits seems like odd logic to me. You can't do anything malicious with a DB of LCP timings. HN's anti-telemetry mindset is baffling to me.

Tracking people almost always a bad idea in my opinion. Even if they get something in return like early access to something. Even if they're happy to accept being tracked. There just isn't a good justification for it in most cases. For a start, most sites that track users don't even use the data they gather. They're just gathering it because they're think they're expected to. So many sites implement Google Analytics, Hotjar, etc and then use the data as nothing more than a web counter. That's beyond infuriating to anyone who thinks privacy is worth fighting for. If you're going to violate my privacy, at least do it for a good reason. In the case of the article there could be solid reasons for hoovering up lots of information about users. But really, unless you're in a massive company with significant resources, all of that perf data is just going to sit in a database and a senior might occasionally look at the dashboard overview and think "We should make our images smaller." or "Huh, users have a sucky time when they're on Android. Oh well.". Those are not good reasons to gather real-world user data instead of relying on Lighthouse scores. Lighthouse is "good enough" for most people. I imagine that a frustrating part of working on web perf is that small companies and startups don't have the resources to do it well, so they end up cargo-culting what Google does but without spending time or effort to make good on what they might learn. To be fair to the author, I'm much more at fault here than they are. I have no doubt that the article is aimed it at a much smaller audience (the web perf community), and now I'm here saying it's not applicable in a much broader context because it was posted to HN. I apologize to them for that. This is something I care about and it was an opportunity to rant. :)

lelandfe 5y ago
I’m not sure we are in agreement on what tracking means. This article advocates logging performance timings. You can’t track someone with that.
- onion2k 5y ago
  This article advocates logging performance timings. You can’t track someone with that. Firstly, yes you can - https://www.researchgate.net/publication/2441386_Timing_Attacks_on_Web_Privacy https://www.researchgate.net/publication/2441386_Timing_Atta... - but that's not the point here. Secondly, web perf testing benefits from user tracking. It is very common for perf and tracking to be used together. In fact, I don't actually know of a time where I've seen perf metrics being used without tracking. I'd agree that it's possible to track perf metrics without tying them to a specific user, but even then you still need to be sending user data back to your server. I'm not in favour of that for something as trivial (in most case) as just making a website load slightly faster. Site owners should start with the assumption that they don't actually need data and then only track things that are critical to the functioning of their website. There will be very few cases where knowing how fast the page loaded actually meets that criteria.
  - lelandfe 5y ago
    > Firstly, yes you can 20 year old paper. "Domain tagging," Felten and Schneider's proposed countermeasure, was implemented as "cache partitioning" in Firefox, Safari, and Chrome. If you're aware of extant issues please let me know. > In fact, I don't actually know of a time where I've seen perf metrics being used without tracking Google's own library: https://github.com/GoogleChrome/web-vitals#overview https://github.com/GoogleChrome/web-vitals#overview, which is recommended in OP's article. > I'm not in favour of that for something as trivial (in most case) as just making a website load slightly faster No performance RUM means no knowledge of performance regressions. I have deployed changes that looked great on our CI and then gravely impacted performance for a segment of customers. Blinding a business to user experience because you've read papers on historic exploits seems like odd logic to me. You can't do anything malicious with a DB of LCP timings. HN's anti-telemetry mindset is baffling to me.