5 ms·

Maybe if everyone wasn't leaking my entire lifes history to 58 different adtech shitcompanies the EU wouldn't have needed to step in. Now people say "oh but if

Maybe if everyone wasn't leaking my entire lifes history to 58 different adtech shitcompanies the EU wouldn't have needed to step in. Now people say "oh but if every website hosts their own fonts the browser can't cache them" while sending me 35 megs of shitty tracking Javascript code. There is a very clear aggressor here and it's not the EU or the regulators.

Talinx 5y ago
What about a HTML tag that includes a hash sum? Only request the resource if not already present. That could enable cross-website resource caching without leaking information. (IF the resource the site sends if necessary matches the resource of the tag, otherwise the hash sum would tell the server whether the user visited some other site.) Hashing content makes more sense than relying on the URL staying the same IMHO.
- kevin_thibedeau 5y ago
  The Decentraleyes extension does this.
  - contravariant 5y ago
    Unless the situation has changed the LocalCDN extension is a bit more active and contains more (recent) resources.
- MarkSweep 5y ago
  I think the reason this is not done is it would leak to the website if the user had previously downloaded the same file from a different website.
  - vanviegen 5y ago
    Sure. And you can do the same thing with a CDN file by timing how long it takes to load. Sub millisecond means cache.
    - notriddle 5y ago
      It's why newer versions of Firefox and Safari use segmented caches. Which, of course, means that loading fonts from a CDN no longer buys you anything at all.
      - imajoredinecon 5y ago
        Chrome as well. (The zdnet article above is about Chrome, which shipped this last year.)
- mananaysiempre 5y ago
  Including the hash is exactly what subresource integrity[1] does (it was even designed for a CDN context originally), but so far people haven’t figured out a sufficiently non-leaky design to use it for caching[2,3]. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... [2] https://github.com/w3c/webappsec-subresource-integrity/issues/22 https://github.com/w3c/webappsec-subresource-integrity/issue... [3] https://hillbrad.github.io/sri-addressable-caching/sri-addressable-caching.html https://hillbrad.github.io/sri-addressable-caching/sri-addre...
Aerroon 5y ago
>Maybe if everyone wasn't leaking my entire lifes history to 58 different adtech shitcompanies the EU wouldn't have needed to step in. But it's not "everyone" - it's you. Your computer sends out all the information that is requested from it. That's how the internet is built. Even when a website tries to use an external font it is still your browser that asks the font host for the font.
- twojacobtwo 5y ago
  A little too much blaming the victim vibe from this. "It's not the rapists who let you get raped! You let yourself get raped! Why didn't you have more personal security?" It seems you either missed the point of what the post was getting at, or you are being purposefully obtuse about it.
  - Aerroon 5y ago
    Victim blaming? What's the point of your system being open and you are in control if you don't use that control to stop voluntarily sending data to websites you don't want. I agree that it would be nicer if websites slurped up less data. But to portray a lot of this stuff as the user being the victim is ridiculous. The users are the ones that voluntarily started using browsers made by an adtech companies. There are alternatives but they don't use them! And yet they complain that their data then ends up with the adtech company because their browser, that is under their control, sends it to the company.
    - hackerfromthefu 5y ago
      In case you didn't realise it's Google who controls the browser not the user.
- ocdtrekkie 5y ago
  This design is largely perpetrated by the adtech companies in question. Your reference to an external font is, of course, largely referring to Google Fonts. Nobody embedded externally-hosted fonts until adtech companies started pushing you to just add their convenient code that grabs the fonts from their servers direct, but it's insane we allow this. Of course, the web browser should do something about it... but the adtech company built that too. "That's how the internet is built" is an aggressively dismissive attitude, because there are specific companies building the Internet. Note that every new trash web standard is written by... oh, yeah, Google too. Sidebar: I block Google Fonts. You should too.
TurningCanadian 5y ago
Each origin has its own cache, so it doesn't matter if you load your fonts from the same place as some other site -- they won't be shared. https://andydavies.me/blog/2018/09/06/safari-caching-and-3rd-party-resources/ https://andydavies.me/blog/2018/09/06/safari-caching-and-3rd... https://www.zdnet.com/article/chromes-new-cache-partitioning-system-impacts-google-fonts-performance/ https://www.zdnet.com/article/chromes-new-cache-partitioning... https://arstechnica.com/gadgets/2020/12/firefox-v85-will-improve-its-cache-partitioning-for-stronger-privacy/ https://arstechnica.com/gadgets/2020/12/firefox-v85-will-imp...
- chmod775 5y ago
  Additionally - when everything is served from the same server - existing connections can be re-used, resulting in a latency advantage.
- GekkePrutser 5y ago
  Yes but that added inefficiency is also a result of adtech abusing the font cache for tracking. Which led to the need to isolate sites.

Talinx 5y ago

What about a HTML tag that includes a hash sum? Only request the resource if not already present. That could enable cross-website resource caching without leaking information. (IF the resource the site sends if necessary matches the resource of the tag, otherwise the hash sum would tell the server whether the user visited some other site.) Hashing content makes more sense than relying on the URL staying the same IMHO.

kevin_thibedeau 5y ago
The Decentraleyes extension does this.
- contravariant 5y ago
  Unless the situation has changed the LocalCDN extension is a bit more active and contains more (recent) resources.
MarkSweep 5y ago
I think the reason this is not done is it would leak to the website if the user had previously downloaded the same file from a different website.
- vanviegen 5y ago
  Sure. And you can do the same thing with a CDN file by timing how long it takes to load. Sub millisecond means cache.
  - notriddle 5y ago
    It's why newer versions of Firefox and Safari use segmented caches. Which, of course, means that loading fonts from a CDN no longer buys you anything at all.
    - imajoredinecon 5y ago
      Chrome as well. (The zdnet article above is about Chrome, which shipped this last year.)
mananaysiempre 5y ago
Including the hash is exactly what subresource integrity[1] does (it was even designed for a CDN context originally), but so far people haven’t figured out a sufficiently non-leaky design to use it for caching[2,3]. [1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... [2] https://github.com/w3c/webappsec-subresource-integrity/issues/22 https://github.com/w3c/webappsec-subresource-integrity/issue... [3] https://hillbrad.github.io/sri-addressable-caching/sri-addressable-caching.html https://hillbrad.github.io/sri-addressable-caching/sri-addre...

Aerroon 5y ago

>Maybe if everyone wasn't leaking my entire lifes history to 58 different adtech shitcompanies the EU wouldn't have needed to step in. But it's not "everyone" - it's you. Your computer sends out all the information that is requested from it. That's how the internet is built. Even when a website tries to use an external font it is still your browser that asks the font host for the font.

twojacobtwo 5y ago
A little too much blaming the victim vibe from this. "It's not the rapists who let you get raped! You let yourself get raped! Why didn't you have more personal security?" It seems you either missed the point of what the post was getting at, or you are being purposefully obtuse about it.
- Aerroon 5y ago
  Victim blaming? What's the point of your system being open and you are in control if you don't use that control to stop voluntarily sending data to websites you don't want. I agree that it would be nicer if websites slurped up less data. But to portray a lot of this stuff as the user being the victim is ridiculous. The users are the ones that voluntarily started using browsers made by an adtech companies. There are alternatives but they don't use them! And yet they complain that their data then ends up with the adtech company because their browser, that is under their control, sends it to the company.
  - hackerfromthefu 5y ago
    In case you didn't realise it's Google who controls the browser not the user.
ocdtrekkie 5y ago
This design is largely perpetrated by the adtech companies in question. Your reference to an external font is, of course, largely referring to Google Fonts. Nobody embedded externally-hosted fonts until adtech companies started pushing you to just add their convenient code that grabs the fonts from their servers direct, but it's insane we allow this. Of course, the web browser should do something about it... but the adtech company built that too. "That's how the internet is built" is an aggressively dismissive attitude, because there are specific companies building the Internet. Note that every new trash web standard is written by... oh, yeah, Google too. Sidebar: I block Google Fonts. You should too.

TurningCanadian 5y ago

Each origin has its own cache, so it doesn't matter if you load your fonts from the same place as some other site -- they won't be shared. https://andydavies.me/blog/2018/09/06/safari-caching-and-3rd-party-resources/ https://andydavies.me/blog/2018/09/06/safari-caching-and-3rd... https://www.zdnet.com/article/chromes-new-cache-partitioning-system-impacts-google-fonts-performance/ https://www.zdnet.com/article/chromes-new-cache-partitioning... https://arstechnica.com/gadgets/2020/12/firefox-v85-will-improve-its-cache-partitioning-for-stronger-privacy/ https://arstechnica.com/gadgets/2020/12/firefox-v85-will-imp...

chmod775 5y ago
Additionally - when everything is served from the same server - existing connections can be re-used, resulting in a latency advantage.
GekkePrutser 5y ago
Yes but that added inefficiency is also a result of adtech abusing the font cache for tracking. Which led to the need to isolate sites.