31 ms·

Be aware that online service like this one might log your request which could have sensitive data, I'm not saying it does, but those websites give me the creep

by vdfs 3y ago

judge2020 3y ago
I agree that it's possible, and that the majority of utility websites do use a backend to provide their utility, but it seems curlconverter.com doesn't make any requests to a website to convert and instead does so in javascript. It would be nice if more sites offered themselves as PWAs that worked when you set "throttling" to "offline" in the dev menu, so that you could ensure that no data is leaving the browser when working with sensitive info.
- adolph 3y ago
  Maybe that would be a nice browser plugin. Something that blocks any further requests. I guess it would work similarly to ad blockers, only once enabled blocks everything.
  - dotancohen 3y ago
    Just unplug the cord, or disable the WiFi, for a few seconds. As we are presumably discussing sensitive data, nothing is as certain as the end of the cord in your palm.
    - judge2020 3y ago
      Although an attack vector is it saving all that info in a buffer, continuously trying to beam it up until it gets a success response from the server.
diegoperini 3y ago
True. Luckily it's open source. You can do `npx curlconverter --language go example.com` behind a firewall after downloading the npm module.
spdustin 3y ago
I watched the network logs, and it doesn't seem to transmit anything. Additionally, their privacy info clearly states: > We do not transmit or record the curl commands you enter or what they're converted to. This is a static website (hosted on GitHub Pages) and the conversion happens entirely in your browser using JavaScript.
- lp0_on_fire 3y ago
  Privacy policies on most websites mean jack when they can be changed at any time for any reason, imo. Not to mention the pattern nowadays is: offer a free service, pay a little lip service to privacy concerns, then the enshittification train comes rolling down the tracks a few years/ months later. Not saying this site is going to go down that path but IMO giving the benefit of the doubt with regard to privacy on the internet is bad practice for 2024.

Be aware that online service like this one might log your request which could have sensitive data, I'm not saying it does, but those websites give me the creep

by vdfs 3y ago

Be aware that online service like this one might log your request which could have sensitive data, I'm not saying it does, but those websites give me the creep

judge2020 3y ago

I agree that it's possible, and that the majority of utility websites do use a backend to provide their utility, but it seems curlconverter.com doesn't make any requests to a website to convert and instead does so in javascript. It would be nice if more sites offered themselves as PWAs that worked when you set "throttling" to "offline" in the dev menu, so that you could ensure that no data is leaving the browser when working with sensitive info.

adolph 3y ago
Maybe that would be a nice browser plugin. Something that blocks any further requests. I guess it would work similarly to ad blockers, only once enabled blocks everything.
- dotancohen 3y ago
  Just unplug the cord, or disable the WiFi, for a few seconds. As we are presumably discussing sensitive data, nothing is as certain as the end of the cord in your palm.
  - judge2020 3y ago
    Although an attack vector is it saving all that info in a buffer, continuously trying to beam it up until it gets a success response from the server.

diegoperini 3y ago

True. Luckily it's open source. You can do `npx curlconverter --language go example.com` behind a firewall after downloading the npm module.

spdustin 3y ago

I watched the network logs, and it doesn't seem to transmit anything. Additionally, their privacy info clearly states: > We do not transmit or record the curl commands you enter or what they're converted to. This is a static website (hosted on GitHub Pages) and the conversion happens entirely in your browser using JavaScript.

lp0_on_fire 3y ago
Privacy policies on most websites mean jack when they can be changed at any time for any reason, imo. Not to mention the pattern nowadays is: offer a free service, pay a little lip service to privacy concerns, then the enshittification train comes rolling down the tracks a few years/ months later. Not saying this site is going to go down that path but IMO giving the benefit of the doubt with regard to privacy on the internet is bad practice for 2024.