4 ms·

This is super widespread, even in the UK. This is the patient portal for one of the two largest medical records systems in the UK: https://account.patientaccess

This is super widespread, even in the UK. This is the patient portal for one of the two largest medical records systems in the UK: https://account.patientaccess.com/Account/Login https://account.patientaccess.com/Account/Login Open the network tab and there's a lot of gstatic network connections.

Nextgrid 4y ago
Last time I looked I found https://patally.co.uk https://patally.co.uk which does the same thing and doesn't have as much nastiness (it only has Google Fonts).
maccard 4y ago
To be fair, the majority of those gstatic connections are for things like fonts. When you are actually logged in there,s only one (for a font), and that is cached by the browser (because you've received it already). Worryingly, I saw requests (that ublock stopped) to https://exponea.com/ https://exponea.com/, dc.services.visualstudio.com/v2/track, and googletagmanager, _and_ if I book an appointment it sends the details of the booking to the analytics service... that's pretty horiffic.
- tgv 4y ago
  Serving fonts from google is forbidden now in the EU.
  - maccard 4y ago
    That's a bit of a stretch of an interpretation - you can serve fonts via Google as long as you obtain permission, and it being illegal doesn't mean you're going to get put in jail. The case this came from finedthe company €100.
    - tgv 4y ago
      It's more serious than that. From The Register: > The ruling directs the website to stop providing IP addresses to Google and threatens the site operator with a fine of €250,000 for each violation, or up to six months in prison, for continued improper use of Google Fonts.
  - dylan604 4y ago
    Hopefully, it's not actually written as dumb as it sounds: Okay, so we don't serve fonts from google-ish domains. We know server from freefontswithtracking.com a wholly owned subsidiary of Alphabet! See, no longer serving fonts from Googs. /s
    - tgv 4y ago
      It isn't dumb, unless you consider the GDPR dumb. The court says it's easy enough to serve fonts yourself.
      - Silhouette 4y ago
        The trouble with this argument - and I write this as someone who is generally a strong proponent of privacy safeguards - is that the logical conclusion is the end of the WWW as we know it. Balkanisation has been a concern for some time mostly because of government regulations in different jurisdictions that conflict. However if a site can't import any externally hosted resources without getting explicit consent first then that breaks CDNs, payment services that require you to use their versions of scripts for security and/or regulatory reasons, services that host content where providing locally hosted alternatives might not be practical such as video or audio files or mapping data, and the list goes on. Some reasonable middle ground is clearly needed here. Perhaps there could be some reasonable standard for privacy that those external services can meaningfully promise to maintain and then some sort of safe harbour provision where importing resources from privacy-respecting sources is acceptable. Of course that only works if services that promise to respect privacy and then don't will be hit with meaningful sanctions but the same is true of any obligations under GDPR and other privacy laws today.
        maccard 4y ago
        > that breaks CDN CDNs are already broken unfortunately. Both Firefox and Chrome use per-site caches [0]. > payment services that require you to use their versions of scripts for security, services that host content where providing locally hosted alternatives might not be practical such as video or audio files or mapping data, and the list goes on. That's reasonable, and the GDPR doens't stop you from doing that, but it does mean that you must tell the user that you're loading it from a third party, ask permission to do so, and list the data that you're sharing with that party in exchange for them providing those resources. [0] https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/
  - aix1 4y ago
    Care to provide more details on what you mean by this?
- maxehmookau 4y ago
  I think the principal is that any page with my medical details on it should not load 3rd party JS from external sources. Regardless of its reported function, it's just not ok.

Nextgrid 4y ago

Last time I looked I found https://patally.co.uk https://patally.co.uk which does the same thing and doesn't have as much nastiness (it only has Google Fonts).

maccard 4y ago

To be fair, the majority of those gstatic connections are for things like fonts. When you are actually logged in there,s only one (for a font), and that is cached by the browser (because you've received it already). Worryingly, I saw requests (that ublock stopped) to https://exponea.com/ https://exponea.com/, dc.services.visualstudio.com/v2/track, and googletagmanager, _and_ if I book an appointment it sends the details of the booking to the analytics service... that's pretty horiffic.

tgv 4y ago
Serving fonts from google is forbidden now in the EU.
- maccard 4y ago
  That's a bit of a stretch of an interpretation - you can serve fonts via Google as long as you obtain permission, and it being illegal doesn't mean you're going to get put in jail. The case this came from finedthe company €100.
  - tgv 4y ago
    It's more serious than that. From The Register: > The ruling directs the website to stop providing IP addresses to Google and threatens the site operator with a fine of €250,000 for each violation, or up to six months in prison, for continued improper use of Google Fonts.
- dylan604 4y ago
  Hopefully, it's not actually written as dumb as it sounds: Okay, so we don't serve fonts from google-ish domains. We know server from freefontswithtracking.com a wholly owned subsidiary of Alphabet! See, no longer serving fonts from Googs. /s
  - tgv 4y ago
    It isn't dumb, unless you consider the GDPR dumb. The court says it's easy enough to serve fonts yourself.
    - Silhouette 4y ago
      The trouble with this argument - and I write this as someone who is generally a strong proponent of privacy safeguards - is that the logical conclusion is the end of the WWW as we know it. Balkanisation has been a concern for some time mostly because of government regulations in different jurisdictions that conflict. However if a site can't import any externally hosted resources without getting explicit consent first then that breaks CDNs, payment services that require you to use their versions of scripts for security and/or regulatory reasons, services that host content where providing locally hosted alternatives might not be practical such as video or audio files or mapping data, and the list goes on. Some reasonable middle ground is clearly needed here. Perhaps there could be some reasonable standard for privacy that those external services can meaningfully promise to maintain and then some sort of safe harbour provision where importing resources from privacy-respecting sources is acceptable. Of course that only works if services that promise to respect privacy and then don't will be hit with meaningful sanctions but the same is true of any obligations under GDPR and other privacy laws today.
      - maccard 4y ago
        > that breaks CDN CDNs are already broken unfortunately. Both Firefox and Chrome use per-site caches [0]. > payment services that require you to use their versions of scripts for security, services that host content where providing locally hosted alternatives might not be practical such as video or audio files or mapping data, and the list goes on. That's reasonable, and the GDPR doens't stop you from doing that, but it does mean that you must tell the user that you're loading it from a third party, ask permission to do so, and list the data that you're sharing with that party in exchange for them providing those resources. [0] https://developer.chrome.com/blog/http-cache-partitioning/ https://developer.chrome.com/blog/http-cache-partitioning/
- aix1 4y ago
  Care to provide more details on what you mean by this?
maxehmookau 4y ago
I think the principal is that any page with my medical details on it should not load 3rd party JS from external sources. Regardless of its reported function, it's just not ok.