8 ms·

Ain't no party like a third party

97 points by pmlnr 5y ago

velcrovan 5y ago
I'm not sure whether it’s silly or genius for this post to lead with “don't load 3rd party scripts” and end with “by the way we all need to unionize for this to work kthxbye”.
- webmaven 5y ago
  Not sure I'd go so far as to call it "genius", but it is certainly clever (and possibly effective).
- DarylZero 5y ago
  Oh now I will read the article.
h2odragon 5y ago
People who have been saying things like this all along don't get to say "I told you so," tho, because we gave up on this issue years ago, and are currently involved in incessant bitching about the next society wide stupidity currently being perpetrated that will take decades to fix when the error id finally recognized.
- xwolfi 5y ago
  Oh crypto you mean ? I resist the call of the incessant exchanges and crypto startups stealing all my colleagues, I must resist even if they pay double arrrgl
deleted 5y ago
[deleted]
breckenedge 5y ago
> On today’s modern web it sounds like advice from a tinfoil-hat wearing conspiracy nut. Has this become common? I’ve been developing “modern web” SPAs for years now and still never load scripts from 3rd parties. Maybe I don’t understand the meaning of “modern web” in this context?
- AndyJames 5y ago
  If you want to sell your product/look for investors you need analytics. The easiest way is to just slap Google snippet in there. If you decide not to do it you're off to self hosted analytics solutions which are just not comparable to google. Building small sites, blogs, informational sites is pretty easy without 3rd party scripts but when you're going into mid size ecommerce (by mid size I mean company that have decent advertisement and sales research budget) it's getting way harder to stay away from 3rd party analytic and marketing tools.
  - dsign 5y ago
    Hmm, I checked some local e-commerces. They have more trackers than people actually fulfilling orders, that I don't understand.
    - AndyJames 5y ago
      That's actually skew in another direction. If marketing is not generating sales they're generating job for them self instead.
  - kevincox 5y ago
    > If you want to sell your product/look for investors you need analytics. Most meaningful analytics don't need these trackers. They can be done server-side with info you already have such as orders, logins, active users. If an investor bases their decision primarily based on how many users Google Analytics reports the probably aren't the most critical.
- michaelt 5y ago
  A few years ago, it was widespread advice that you shouldn't host a copy of jquery on your own server, and instead you should include it from cdnjs or jsdelivr in the hopes users would have it cached, having needed it on another website. This advice is now obsolete, because it was realised sharing caches between sites was a privacy problem. Evil.com can request example.com/logo.png and if it loads instantly, know that you've visited example.com before.
scrose 5y ago
> I know, I know. If you refuse to add that third-party script, your boss will probably say, “Fine, I’ll get someone else to do it. Also, you’re fired.” I’ve been on two ends of this during my brief time in media. I once worked on a team that had nothing to do with ads, but the manager who replaced my original one basically told me I’d be overlooked for any promotions because I would not pivot to work on adtech. I left pretty soon after. At a separate company, I made it clear from the start that I would not work on ads or tracking of any kind and I had some proposals to reduce invasive tracking that were actually heard and implemented. Unfortunately, in media, it’s a losing battle if you approach it from an engineer / IC level. Many partners expect you to have all types of scripts to measure engagement, bot detection/fraud, etc… and the voice that’s heard is the one giving the company the most money.
- Cthulhu_ 5y ago
  > I left pretty soon after. That's it, we work in a pretty privileged market where we can more easily vote with our feet, generally speaking. Of course, we also work in one where wages can end up being pretty exorbitant, and where there's plenty of people who are morally flexible depending on their own conscience, compensation, or whether the ad tech is wrapped in hype-driven development.
- stickfigure 5y ago
  > I left pretty soon after. This seems pretty win/win? I don't think you and I would be compatible either; you sound a bit too moralistic for my tastes. That's fine, you are entitled to your opinions and I'm entitled to mine.
fevangelou 5y ago
For personal sites? Sure, why not. For anything commercial though, especially in media publishing, this is just insane. I'm beginning to think the old generation of "celebrity" web devs (the ones that became famous in the 2000s - now around in their 50s) has really lost touch with the modern web for some time now. And this comes from someone who's actually bought all of Jeremy's books. The fact that Google is switching away from third party cookies is surely not a matter of "resisting the tide" as Jeremy writes. It's actually about more control. Whoever controls the web platform (=the browser) can now control the ad landscape [1]. See how Google used AMP to promote a supposedly "faster" web (and it's now being sued for for preferencial ad placement) [2]. [1] https://www.reuters.com/technology/googles-browser-cookies-plan-anti-competitive-advertisers-tell-eu-2021-09-28/ https://www.reuters.com/technology/googles-browser-cookies-p... [2] https://www.theregister.com/2021/10/26/google_deliberately_throttled_ad_load/ https://www.theregister.com/2021/10/26/google_deliberately_t...
- the__alchemist 5y ago
  Your reaction is in line with this speculation about reactions from the article: "On today’s modern web it sounds like advice from a tinfoil-hat wearing conspiracy nut." Your post doesn't address any details from the article; it reads like a gut reaction.
- horsawlarway 5y ago
  I spent a good chunk of my career working in software security. I'm fairly damn well convinced at this point that a WHOLE LOT of modern security practices are actually technical run-arounds on missing legislation. Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course. We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!) It turns out small sites can make a pretty compelling web experience when they can coordinate and work together (links to each other, shared preferences, decentralized identity) and it's absolutely NOT a mistake that many large orgs are now using every technical lever than can to prevent that sort of organization. I see "Security" as filling the same space as union busting right now - make it impossible for those smaller than you to become threatening by banding together. When you keep them divided you can eat them at your leisure.
david_draco 5y ago
To get this through what you have to do is a) create a Chrome clone that rejects third-party scripts and has other security enhancements by default (do browsers really still need http support?). Then, you can say "Your site doesn't work with SuperChrome!" and shame until they fix it, to reach also the SuperChrome users (hopefully growing in number). SuperChrome cannot be a loose set of extensions, it has to be a well-defined thing. b) have other services treat sites preferentially: higher throughput, better caching, higher ranking in search results, better user retention. I think this can easily be achieved, because the load-time will be shorter on such sites, therefore users will stay longer, and faster sites are already preferred by Google. This is the "AMP route" btw.
- jtbayly 5y ago
  Yes. Browsers really should maintain HTTP support. There’s no reason to require every static site in the world to be encrypted in transit. And in particular, there’s no reason to block off all the actual good websites that are old static sites still serving their purpose.
  - wayoutthere 5y ago
    Stick an SSL proxy in front of them and be done with it. This was a solved problem 15 years ago.
  - sneak 5y ago
    > There’s no reason to require every static site in the world to be encrypted in transit. Yes, there is. Encryption doesn't just provide privacy, it also provides authentication. Being able to tamper with downloadable code (i.e. javascript) in transit is a nonstarter. Everything needs to be authenticated, and the way we authenticate data from a webserver in 2021 is by using TLS. Ban port 80.
    - phil294 5y ago
      Here [1] is an interesting article that advocates for not blindly enforcing SSL everywhere as it makes deliberate mitm caching impossible. Also discussed in 2018 [2] [1] https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites-made-them-less-accessible/ https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites... [2] https://news.ycombinator.com/item?id=17707187 https://news.ycombinator.com/item?id=17707187
narag 5y ago
Browsers are now beginning to block third-party cookies. I assume that means by default? I remember having that option like twenty years ago or something like that. Edit: Navigator had the option to block 3rd party images. Blocking 3rd party cookies might be more recent, but not "now beginning" by any means.
- mikestew 5y ago
  Without searching for a timeline of Safari development, I recall that Safari has had the option to block 3rd-party cookies for a number of years. Last year Safari started blocking those cookies by default: https://www.pcmag.com/news/safari-now-blocks-all-third-party-cookies https://www.pcmag.com/news/safari-now-blocks-all-third-party... And now that I look, there is no longer an option in Safari Preferences that mentions anything about 3rd-party cookies. It's either "all cookies", or "no cookies".
blackbear_ 5y ago
Wouldn't this make ad blocking much harder for end users?
jakub_g 5y ago
The reason people add third-parties is the same why big companies outsource cleaning to a cleaning company: pay someone else to own a subproblem of yours. Even the analogy is similar: evil cleaner can steal secret documents and wreak havoc in your office. In media, there are a handful of third-parties that you de facto must load, because this is the only way to compare various metrics between different websites (number of views etc.); you can't rely on companies to self-report the numbers; even if they acted in good faith, the small details of how they collect the data would lead to discrepancies. I hate third-parties like everyone else (and especially since I used to be a perf engineer and had my hands tied with bloated unremovable 3p libs), but they're just not going away.
- Puts 5y ago
  Well if you are a somewhat serious company you probably have a clean-desk policy, workstations that lock themselves after a couple of minutes inactivity and encrypted hard-drives. Also there are probably areas where you don't let the cleaner go, like that closet with all the switches. And the cleaner has in some form been vetted. You see that person a couple of days every week and start building a relationship. You can see if he/she suddenly shows up drunk every day. With security and risk it works like this. You can accept some risk if you at the same time find solutions to mitigate any dire consequences. With third-party javascripts you are giving away all control. Now if you are in an nonsensitive business maybe it's okay to use some third-party javascripts here and there, but is it reasonable to have those on an e-commerce checkout for example? Also Subresource Integrity has been mentioned a couple of times already here to mitigate the risks of third-party javascripts.
  - bsder 5y ago
    > And the cleaner has in some form been vetted. Oh, you sweet summer child, I admire your optimistic view of life. Please never lose it. I have this facepalm discussion with people who want to "upgrade" our security by moving something into the office. "So, you want to trust our cleaning staff who regularly fail to lock our front door more than having it in a locked colocation cage with monitoring?" Even if the cleaning staff were "vetted" (which they are not), humans gonna human.
JasonFruit 5y ago
> This tactic will only work if everyone agrees to do what’s right. I do not know who said it first, but: "If your solution to some problem relies on “If everyone would just…” then you do not have a solution. Everyone is not going to just. At no time in the history of the universe has everyone just, and they’re not going to start now."
- gjm11 5y ago
  Earliest instance I can find (where it is presented as if original): https://squareallworthy.tumblr.com/post/163790039847/everyone-will-not-just https://squareallworthy.tumblr.com/post/163790039847/everyon...
- ColinHayhurst 5y ago
  More companies need to take a stand and not use any third-party scripts or third-party cookies. We do that with our search engine and it works without Javascript.
- danw1979 5y ago
  There are plenty of historical examples of "everyone" in a union "just" going on strike to get a problem fixed.
celestialcheese 5y ago
Google isn't dragging their feet and pushing the timeline for their "Privacy Sandbox" update because their ad business will be hurt - likely these changes will help them. It's because EU/UK regulators are blocking this move as anti-competitive, and the FLoC/FLEDGE/Whatever cohort targeting gives Google essentially a monopoly on targeted ads since they have the best look with 1st party data of almost any company (except maybe FB). My prediction - it'll get pushed back another 2 years to 2025 since the industry can't figure out what to do. There's hundreds of billions at stake and Google wins no matter what.
MarkusWandel 5y ago
I tried the request mapper link, with two URLs. http://news.ycombinator.com http://news.ycombinator.com http://cnn.com http://cnn.com Warning, the second one takes a while. I remember hand-coding HTML and "bloat" was a page that took annoyingly long to load on dialup. Has it really been worth it? Coincidentally, last time I used dialup, Hacker News worked just fine.

97 points by pmlnr 5y ago

I'm not sure whether it’s silly or genius for this post to lead with “don't load 3rd party scripts” and end with “by the way we all need to unionize for this to work kthxbye”.

webmaven 5y ago
Not sure I'd go so far as to call it "genius", but it is certainly clever (and possibly effective).
DarylZero 5y ago
Oh now I will read the article.

h2odragon 5y ago

People who have been saying things like this all along don't get to say "I told you so," tho, because we gave up on this issue years ago, and are currently involved in incessant bitching about the next society wide stupidity currently being perpetrated that will take decades to fix when the error id finally recognized.

xwolfi 5y ago
Oh crypto you mean ? I resist the call of the incessant exchanges and crypto startups stealing all my colleagues, I must resist even if they pay double arrrgl

deleted 5y ago

[deleted]

breckenedge 5y ago

> On today’s modern web it sounds like advice from a tinfoil-hat wearing conspiracy nut. Has this become common? I’ve been developing “modern web” SPAs for years now and still never load scripts from 3rd parties. Maybe I don’t understand the meaning of “modern web” in this context?

AndyJames 5y ago
If you want to sell your product/look for investors you need analytics. The easiest way is to just slap Google snippet in there. If you decide not to do it you're off to self hosted analytics solutions which are just not comparable to google. Building small sites, blogs, informational sites is pretty easy without 3rd party scripts but when you're going into mid size ecommerce (by mid size I mean company that have decent advertisement and sales research budget) it's getting way harder to stay away from 3rd party analytic and marketing tools.
- dsign 5y ago
  Hmm, I checked some local e-commerces. They have more trackers than people actually fulfilling orders, that I don't understand.
  - AndyJames 5y ago
    That's actually skew in another direction. If marketing is not generating sales they're generating job for them self instead.
- kevincox 5y ago
  > If you want to sell your product/look for investors you need analytics. Most meaningful analytics don't need these trackers. They can be done server-side with info you already have such as orders, logins, active users. If an investor bases their decision primarily based on how many users Google Analytics reports the probably aren't the most critical.
michaelt 5y ago
A few years ago, it was widespread advice that you shouldn't host a copy of jquery on your own server, and instead you should include it from cdnjs or jsdelivr in the hopes users would have it cached, having needed it on another website. This advice is now obsolete, because it was realised sharing caches between sites was a privacy problem. Evil.com can request example.com/logo.png and if it loads instantly, know that you've visited example.com before.

scrose 5y ago

> I know, I know. If you refuse to add that third-party script, your boss will probably say, “Fine, I’ll get someone else to do it. Also, you’re fired.” I’ve been on two ends of this during my brief time in media. I once worked on a team that had nothing to do with ads, but the manager who replaced my original one basically told me I’d be overlooked for any promotions because I would not pivot to work on adtech. I left pretty soon after. At a separate company, I made it clear from the start that I would not work on ads or tracking of any kind and I had some proposals to reduce invasive tracking that were actually heard and implemented. Unfortunately, in media, it’s a losing battle if you approach it from an engineer / IC level. Many partners expect you to have all types of scripts to measure engagement, bot detection/fraud, etc… and the voice that’s heard is the one giving the company the most money.

Cthulhu_ 5y ago
> I left pretty soon after. That's it, we work in a pretty privileged market where we can more easily vote with our feet, generally speaking. Of course, we also work in one where wages can end up being pretty exorbitant, and where there's plenty of people who are morally flexible depending on their own conscience, compensation, or whether the ad tech is wrapped in hype-driven development.
stickfigure 5y ago
> I left pretty soon after. This seems pretty win/win? I don't think you and I would be compatible either; you sound a bit too moralistic for my tastes. That's fine, you are entitled to your opinions and I'm entitled to mine.

fevangelou 5y ago

For personal sites? Sure, why not. For anything commercial though, especially in media publishing, this is just insane. I'm beginning to think the old generation of "celebrity" web devs (the ones that became famous in the 2000s - now around in their 50s) has really lost touch with the modern web for some time now. And this comes from someone who's actually bought all of Jeremy's books. The fact that Google is switching away from third party cookies is surely not a matter of "resisting the tide" as Jeremy writes. It's actually about more control. Whoever controls the web platform (=the browser) can now control the ad landscape [1]. See how Google used AMP to promote a supposedly "faster" web (and it's now being sued for for preferencial ad placement) [2]. [1] https://www.reuters.com/technology/googles-browser-cookies-plan-anti-competitive-advertisers-tell-eu-2021-09-28/ https://www.reuters.com/technology/googles-browser-cookies-p... [2] https://www.theregister.com/2021/10/26/google_deliberately_throttled_ad_load/ https://www.theregister.com/2021/10/26/google_deliberately_t...

the__alchemist 5y ago
Your reaction is in line with this speculation about reactions from the article: "On today’s modern web it sounds like advice from a tinfoil-hat wearing conspiracy nut." Your post doesn't address any details from the article; it reads like a gut reaction.
horsawlarway 5y ago
I spent a good chunk of my career working in software security. I'm fairly damn well convinced at this point that a WHOLE LOT of modern security practices are actually technical run-arounds on missing legislation. Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course. We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!) It turns out small sites can make a pretty compelling web experience when they can coordinate and work together (links to each other, shared preferences, decentralized identity) and it's absolutely NOT a mistake that many large orgs are now using every technical lever than can to prevent that sort of organization. I see "Security" as filling the same space as union busting right now - make it impossible for those smaller than you to become threatening by banding together. When you keep them divided you can eat them at your leisure.

david_draco 5y ago

To get this through what you have to do is a) create a Chrome clone that rejects third-party scripts and has other security enhancements by default (do browsers really still need http support?). Then, you can say "Your site doesn't work with SuperChrome!" and shame until they fix it, to reach also the SuperChrome users (hopefully growing in number). SuperChrome cannot be a loose set of extensions, it has to be a well-defined thing. b) have other services treat sites preferentially: higher throughput, better caching, higher ranking in search results, better user retention. I think this can easily be achieved, because the load-time will be shorter on such sites, therefore users will stay longer, and faster sites are already preferred by Google. This is the "AMP route" btw.

jtbayly 5y ago
Yes. Browsers really should maintain HTTP support. There’s no reason to require every static site in the world to be encrypted in transit. And in particular, there’s no reason to block off all the actual good websites that are old static sites still serving their purpose.
- wayoutthere 5y ago
  Stick an SSL proxy in front of them and be done with it. This was a solved problem 15 years ago.
- sneak 5y ago
  > There’s no reason to require every static site in the world to be encrypted in transit. Yes, there is. Encryption doesn't just provide privacy, it also provides authentication. Being able to tamper with downloadable code (i.e. javascript) in transit is a nonstarter. Everything needs to be authenticated, and the way we authenticate data from a webserver in 2021 is by using TLS. Ban port 80.
  - phil294 5y ago
    Here [1] is an interesting article that advocates for not blindly enforcing SSL everywhere as it makes deliberate mitm caching impossible. Also discussed in 2018 [2] [1] https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites-made-them-less-accessible/ https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites... [2] https://news.ycombinator.com/item?id=17707187 https://news.ycombinator.com/item?id=17707187

narag 5y ago

Browsers are now beginning to block third-party cookies. I assume that means by default? I remember having that option like twenty years ago or something like that. Edit: Navigator had the option to block 3rd party images. Blocking 3rd party cookies might be more recent, but not "now beginning" by any means.

mikestew 5y ago
Without searching for a timeline of Safari development, I recall that Safari has had the option to block 3rd-party cookies for a number of years. Last year Safari started blocking those cookies by default: https://www.pcmag.com/news/safari-now-blocks-all-third-party-cookies https://www.pcmag.com/news/safari-now-blocks-all-third-party... And now that I look, there is no longer an option in Safari Preferences that mentions anything about 3rd-party cookies. It's either "all cookies", or "no cookies".

blackbear_ 5y ago

Wouldn't this make ad blocking much harder for end users?

jakub_g 5y ago

The reason people add third-parties is the same why big companies outsource cleaning to a cleaning company: pay someone else to own a subproblem of yours. Even the analogy is similar: evil cleaner can steal secret documents and wreak havoc in your office. In media, there are a handful of third-parties that you de facto must load, because this is the only way to compare various metrics between different websites (number of views etc.); you can't rely on companies to self-report the numbers; even if they acted in good faith, the small details of how they collect the data would lead to discrepancies. I hate third-parties like everyone else (and especially since I used to be a perf engineer and had my hands tied with bloated unremovable 3p libs), but they're just not going away.

Puts 5y ago
Well if you are a somewhat serious company you probably have a clean-desk policy, workstations that lock themselves after a couple of minutes inactivity and encrypted hard-drives. Also there are probably areas where you don't let the cleaner go, like that closet with all the switches. And the cleaner has in some form been vetted. You see that person a couple of days every week and start building a relationship. You can see if he/she suddenly shows up drunk every day. With security and risk it works like this. You can accept some risk if you at the same time find solutions to mitigate any dire consequences. With third-party javascripts you are giving away all control. Now if you are in an nonsensitive business maybe it's okay to use some third-party javascripts here and there, but is it reasonable to have those on an e-commerce checkout for example? Also Subresource Integrity has been mentioned a couple of times already here to mitigate the risks of third-party javascripts.
- bsder 5y ago
  > And the cleaner has in some form been vetted. Oh, you sweet summer child, I admire your optimistic view of life. Please never lose it. I have this facepalm discussion with people who want to "upgrade" our security by moving something into the office. "So, you want to trust our cleaning staff who regularly fail to lock our front door more than having it in a locked colocation cage with monitoring?" Even if the cleaning staff were "vetted" (which they are not), humans gonna human.

JasonFruit 5y ago

> This tactic will only work if everyone agrees to do what’s right. I do not know who said it first, but: "If your solution to some problem relies on “If everyone would just…” then you do not have a solution. Everyone is not going to just. At no time in the history of the universe has everyone just, and they’re not going to start now."

gjm11 5y ago
Earliest instance I can find (where it is presented as if original): https://squareallworthy.tumblr.com/post/163790039847/everyone-will-not-just https://squareallworthy.tumblr.com/post/163790039847/everyon...
ColinHayhurst 5y ago
More companies need to take a stand and not use any third-party scripts or third-party cookies. We do that with our search engine and it works without Javascript.
danw1979 5y ago
There are plenty of historical examples of "everyone" in a union "just" going on strike to get a problem fixed.

celestialcheese 5y ago

Google isn't dragging their feet and pushing the timeline for their "Privacy Sandbox" update because their ad business will be hurt - likely these changes will help them. It's because EU/UK regulators are blocking this move as anti-competitive, and the FLoC/FLEDGE/Whatever cohort targeting gives Google essentially a monopoly on targeted ads since they have the best look with 1st party data of almost any company (except maybe FB). My prediction - it'll get pushed back another 2 years to 2025 since the industry can't figure out what to do. There's hundreds of billions at stake and Google wins no matter what.

MarkusWandel 5y ago

I tried the request mapper link, with two URLs. http://news.ycombinator.com http://news.ycombinator.com http://cnn.com http://cnn.com Warning, the second one takes a while. I remember hand-coding HTML and "bloat" was a page that took annoyingly long to load on dialup. Has it really been worth it? Coincidentally, last time I used dialup, Hacker News worked just fine.