3 ms·

I’m not sure we are in agreement on what tracking means. This article advocates logging performance timings. You can’t track someone with that.

onion2k 5y ago
This article advocates logging performance timings. You can’t track someone with that. Firstly, yes you can - https://www.researchgate.net/publication/2441386_Timing_Attacks_on_Web_Privacy https://www.researchgate.net/publication/2441386_Timing_Atta... - but that's not the point here. Secondly, web perf testing benefits from user tracking. It is very common for perf and tracking to be used together. In fact, I don't actually know of a time where I've seen perf metrics being used without tracking. I'd agree that it's possible to track perf metrics without tying them to a specific user, but even then you still need to be sending user data back to your server. I'm not in favour of that for something as trivial (in most case) as just making a website load slightly faster. Site owners should start with the assumption that they don't actually need data and then only track things that are critical to the functioning of their website. There will be very few cases where knowing how fast the page loaded actually meets that criteria.
- lelandfe 5y ago
  > Firstly, yes you can 20 year old paper. "Domain tagging," Felten and Schneider's proposed countermeasure, was implemented as "cache partitioning" in Firefox, Safari, and Chrome. If you're aware of extant issues please let me know. > In fact, I don't actually know of a time where I've seen perf metrics being used without tracking Google's own library: https://github.com/GoogleChrome/web-vitals#overview https://github.com/GoogleChrome/web-vitals#overview, which is recommended in OP's article. > I'm not in favour of that for something as trivial (in most case) as just making a website load slightly faster No performance RUM means no knowledge of performance regressions. I have deployed changes that looked great on our CI and then gravely impacted performance for a segment of customers. Blinding a business to user experience because you've read papers on historic exploits seems like odd logic to me. You can't do anything malicious with a DB of LCP timings. HN's anti-telemetry mindset is baffling to me.

onion2k 5y ago

This article advocates logging performance timings. You can’t track someone with that. Firstly, yes you can - https://www.researchgate.net/publication/2441386_Timing_Attacks_on_Web_Privacy https://www.researchgate.net/publication/2441386_Timing_Atta... - but that's not the point here. Secondly, web perf testing benefits from user tracking. It is very common for perf and tracking to be used together. In fact, I don't actually know of a time where I've seen perf metrics being used without tracking. I'd agree that it's possible to track perf metrics without tying them to a specific user, but even then you still need to be sending user data back to your server. I'm not in favour of that for something as trivial (in most case) as just making a website load slightly faster. Site owners should start with the assumption that they don't actually need data and then only track things that are critical to the functioning of their website. There will be very few cases where knowing how fast the page loaded actually meets that criteria.

lelandfe 5y ago
> Firstly, yes you can 20 year old paper. "Domain tagging," Felten and Schneider's proposed countermeasure, was implemented as "cache partitioning" in Firefox, Safari, and Chrome. If you're aware of extant issues please let me know. > In fact, I don't actually know of a time where I've seen perf metrics being used without tracking Google's own library: https://github.com/GoogleChrome/web-vitals#overview https://github.com/GoogleChrome/web-vitals#overview, which is recommended in OP's article. > I'm not in favour of that for something as trivial (in most case) as just making a website load slightly faster No performance RUM means no knowledge of performance regressions. I have deployed changes that looked great on our CI and then gravely impacted performance for a segment of customers. Blinding a business to user experience because you've read papers on historic exploits seems like odd logic to me. You can't do anything malicious with a DB of LCP timings. HN's anti-telemetry mindset is baffling to me.