4 ms·

> On today’s modern web it sounds like advice from a tinfoil-hat wearing conspiracy nut. Has this become common? I’ve been developing “modern web” SPAs for yea

> On today’s modern web it sounds like advice from a tinfoil-hat wearing conspiracy nut. Has this become common? I’ve been developing “modern web” SPAs for years now and still never load scripts from 3rd parties. Maybe I don’t understand the meaning of “modern web” in this context?

AndyJames 5y ago
If you want to sell your product/look for investors you need analytics. The easiest way is to just slap Google snippet in there. If you decide not to do it you're off to self hosted analytics solutions which are just not comparable to google. Building small sites, blogs, informational sites is pretty easy without 3rd party scripts but when you're going into mid size ecommerce (by mid size I mean company that have decent advertisement and sales research budget) it's getting way harder to stay away from 3rd party analytic and marketing tools.
- dsign 5y ago
  Hmm, I checked some local e-commerces. They have more trackers than people actually fulfilling orders, that I don't understand.
  - AndyJames 5y ago
    That's actually skew in another direction. If marketing is not generating sales they're generating job for them self instead.
- kevincox 5y ago
  > If you want to sell your product/look for investors you need analytics. Most meaningful analytics don't need these trackers. They can be done server-side with info you already have such as orders, logins, active users. If an investor bases their decision primarily based on how many users Google Analytics reports the probably aren't the most critical.
michaelt 5y ago
A few years ago, it was widespread advice that you shouldn't host a copy of jquery on your own server, and instead you should include it from cdnjs or jsdelivr in the hopes users would have it cached, having needed it on another website. This advice is now obsolete, because it was realised sharing caches between sites was a privacy problem. Evil.com can request example.com/logo.png and if it loads instantly, know that you've visited example.com before.
- moffkalast 5y ago
  Yeah at best that'll break your site when the library has the next update, changing random things that nobody asks for. And you'll get a swapped malicious file at worst.
  - michaelt 5y ago
    Well, back when that was common you'd import a numbered version, like "https://cdn.example.com/js/library-v1.2.3.js https://cdn.example.com/js/library-v1.2.3.js" which, unless the CDN was evil, would be immutable. Someone even came up with a standard for "subresource integrity" [1] where you could specify a checksum of the thing you were importing from a CDN, so it couldn't be replaced by an evil CDN. I don't believe it ever achieved widespread use. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
    - dexterdog 5y ago
      It doesn't need widespread use since you get the benefit of using by just using it on your own site.
hannob 5y ago
3rd party JS is pretty much unavoidable if your main source of income is ads. It's particularly true for almost all media pages. That's of course not the whole web, but it's a huge chunk. If you do anything that does not require ad funding, you have a much easier time to do without 3rd party JS.
- Supermancho 5y ago
  If a site is small enough, it's going to use 3rd party sources for convenience. If a site is large enough to have it's own cdn, etc it's going to have 3rd party sources for ads. https://almanac.httparchive.org/en/2019/third-parties https://almanac.httparchive.org/en/2019/third-parties It's over 90%
commandlinefan 5y ago
> still never load scripts from 3rd parties Hm, maybe you and I are reading this differently, but I read it as not using React or Angular or Ember or Vue or jQuery or whatever is fashionable until next Tuesday. You don't eschew all of those as well do you?

AndyJames 5y ago

If you want to sell your product/look for investors you need analytics. The easiest way is to just slap Google snippet in there. If you decide not to do it you're off to self hosted analytics solutions which are just not comparable to google. Building small sites, blogs, informational sites is pretty easy without 3rd party scripts but when you're going into mid size ecommerce (by mid size I mean company that have decent advertisement and sales research budget) it's getting way harder to stay away from 3rd party analytic and marketing tools.

dsign 5y ago
Hmm, I checked some local e-commerces. They have more trackers than people actually fulfilling orders, that I don't understand.
- AndyJames 5y ago
  That's actually skew in another direction. If marketing is not generating sales they're generating job for them self instead.
kevincox 5y ago
> If you want to sell your product/look for investors you need analytics. Most meaningful analytics don't need these trackers. They can be done server-side with info you already have such as orders, logins, active users. If an investor bases their decision primarily based on how many users Google Analytics reports the probably aren't the most critical.

michaelt 5y ago

A few years ago, it was widespread advice that you shouldn't host a copy of jquery on your own server, and instead you should include it from cdnjs or jsdelivr in the hopes users would have it cached, having needed it on another website. This advice is now obsolete, because it was realised sharing caches between sites was a privacy problem. Evil.com can request example.com/logo.png and if it loads instantly, know that you've visited example.com before.

moffkalast 5y ago
Yeah at best that'll break your site when the library has the next update, changing random things that nobody asks for. And you'll get a swapped malicious file at worst.
- michaelt 5y ago
  Well, back when that was common you'd import a numbered version, like "https://cdn.example.com/js/library-v1.2.3.js https://cdn.example.com/js/library-v1.2.3.js" which, unless the CDN was evil, would be immutable. Someone even came up with a standard for "subresource integrity" [1] where you could specify a checksum of the thing you were importing from a CDN, so it couldn't be replaced by an evil CDN. I don't believe it ever achieved widespread use. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
  - dexterdog 5y ago
    It doesn't need widespread use since you get the benefit of using by just using it on your own site.

hannob 5y ago

3rd party JS is pretty much unavoidable if your main source of income is ads. It's particularly true for almost all media pages. That's of course not the whole web, but it's a huge chunk. If you do anything that does not require ad funding, you have a much easier time to do without 3rd party JS.

Supermancho 5y ago
If a site is small enough, it's going to use 3rd party sources for convenience. If a site is large enough to have it's own cdn, etc it's going to have 3rd party sources for ads. https://almanac.httparchive.org/en/2019/third-parties https://almanac.httparchive.org/en/2019/third-parties It's over 90%

commandlinefan 5y ago

> still never load scripts from 3rd parties Hm, maybe you and I are reading this differently, but I read it as not using React or Angular or Ember or Vue or jQuery or whatever is fashionable until next Tuesday. You don't eschew all of those as well do you?