5 ms·

So it’s finally come down to “turn off JavaScript, or be infinitely tracked”?

ehnto 5y ago
And all cookies, else pixel trackers and serverside analytics can still identify your device. Don't need JS to set a cookie.
- encryptluks2 5y ago
  They can identify a device. Without JavaScript, you don't have nasty client-side hints telling sites exactly what OS, CPUs, Graphics Cards, etc. With a VPN and changing your UA, no JavaScript does a pretty good job at preventing sites from tracking you.
  - steve_taylor 5y ago
    User agent strings tend to reveal the operating system and CPU architecture.
    - encryptluks2 5y ago
      That is why I mentioned changing your UA. Unfortunately, with JS that is not enough due to client-side hints and other information leaked.
88913527 5y ago
I'd characterize more as "Turn off JavaScript, and lose access to any site fronted by Cloudflare."
- ehnto 5y ago
  Which is a staggering portion of the popular web.
  - rhizome 5y ago
- akkartik 5y ago
  I've been running NoScript for the past year. It's pretty nice once you get to a stable set of policies. I load mainstream media sites in incognito tabs with JavaScript enabled for the tab.
  - jtbayly 5y ago
    So in other words you allow some of the largest, worst sites to track you. ;)
    - akkartik 5y ago
      Elaborate? I have dnt turned on and am using incognito tabs? Still not good enough?
      - Nursie 5y ago
        “DNT” is a bad joke, always was, just so you know. It just adds a header to your requests asking nicely not to be tracked. If anything it probably acts as a datapoint on fingerprinting and actually helps to track you.
        akkartik 5y ago
        It provides a modicum of social and legal enforcement. A website with any sort of brand risks legal and PR costs if they violate DNT. I'm happy for them to take that risk. Though I see now that the whole thing has fallen through since around 2019: https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track. Oh well. Going back to my original comment, if there's a better way to read say the NYTimes without being tracked by the NYTimes, I'd like to hear it.
        Nursie 5y ago
        Legal risks? I'm unaware that it's ever been enforceable anywhere, and I don't think there's ever been enough awareness of its existence to cause reputational damage. Personally I think the whole thing fell through the moment it was conceived in 2009. We're going to ask nicely that people who are tracking us, who know that we don't want to be tracked anyway, kindly refrain? The whole idea was laughable. Its advocates got annoyed when Microsoft enabled it by default on a version of IE several years ago, as then it wouldn't be perceived as a reliable indicator of intent. This really just exposed the problem with the whole thing, that it was going to be hidden away in settings where few people would go, and rely on the good will of effectively known-bad actors to respect it, and just maybe they would respect it if we keep it more-or-less a secret that only techy people bother with. (Sorry, this rant is not aimed at you, it's just a bit of a pet hate)

And all cookies, else pixel trackers and serverside analytics can still identify your device. Don't need JS to set a cookie.

encryptluks2 5y ago
They can identify a device. Without JavaScript, you don't have nasty client-side hints telling sites exactly what OS, CPUs, Graphics Cards, etc. With a VPN and changing your UA, no JavaScript does a pretty good job at preventing sites from tracking you.
- steve_taylor 5y ago
  User agent strings tend to reveal the operating system and CPU architecture.
  - encryptluks2 5y ago
    That is why I mentioned changing your UA. Unfortunately, with JS that is not enough due to client-side hints and other information leaked.

88913527 5y ago

I'd characterize more as "Turn off JavaScript, and lose access to any site fronted by Cloudflare."

ehnto 5y ago
Which is a staggering portion of the popular web.
- rhizome 5y ago
akkartik 5y ago
I've been running NoScript for the past year. It's pretty nice once you get to a stable set of policies. I load mainstream media sites in incognito tabs with JavaScript enabled for the tab.
- jtbayly 5y ago
  So in other words you allow some of the largest, worst sites to track you. ;)
  - akkartik 5y ago
    Elaborate? I have dnt turned on and am using incognito tabs? Still not good enough?
    - Nursie 5y ago
      “DNT” is a bad joke, always was, just so you know. It just adds a header to your requests asking nicely not to be tracked. If anything it probably acts as a datapoint on fingerprinting and actually helps to track you.
      - akkartik 5y ago
        It provides a modicum of social and legal enforcement. A website with any sort of brand risks legal and PR costs if they violate DNT. I'm happy for them to take that risk. Though I see now that the whole thing has fallen through since around 2019: https://en.wikipedia.org/wiki/Do_Not_Track https://en.wikipedia.org/wiki/Do_Not_Track. Oh well. Going back to my original comment, if there's a better way to read say the NYTimes without being tracked by the NYTimes, I'd like to hear it.
        Nursie 5y ago
        Legal risks? I'm unaware that it's ever been enforceable anywhere, and I don't think there's ever been enough awareness of its existence to cause reputational damage. Personally I think the whole thing fell through the moment it was conceived in 2009. We're going to ask nicely that people who are tracking us, who know that we don't want to be tracked anyway, kindly refrain? The whole idea was laughable. Its advocates got annoyed when Microsoft enabled it by default on a version of IE several years ago, as then it wouldn't be perceived as a reliable indicator of intent. This really just exposed the problem with the whole thing, that it was going to be hidden away in settings where few people would go, and rely on the good will of effectively known-bad actors to respect it, and just maybe they would respect it if we keep it more-or-less a secret that only techy people bother with. (Sorry, this rant is not aimed at you, it's just a bit of a pet hate)