4 ms·

From the website: "Doesn't use analytics = respects your privacy" Meanwhile, Brave stopped this tracker: https://static.cloudflareinsights.com/beacon

From the website: "Doesn't use analytics = respects your privacy" Meanwhile, Brave stopped this tracker: https://static.cloudflareinsights.com/beacon.min.js/vef91dfe02fce4ee0ad053f6de4f175db1715022073587

Dalewyn 2y ago
On a similar token: >Doesn't use a server = no downtimes Except there is a server, whatever and wherever it is behind notepadtab.com.
- jimbobthrowawy 2y ago
  Is there anything in the HTML spec that tells browsers to always show a cached version a page if it can't be loaded the next time you try to access it? I think PWAs might have something like that, but haven't tested it in a normal browser or tried building one.
  - Dalewyn 2y ago
    HTML dictates how webpages should be structured and then rendered. You're probably asking about HTTPS, in which case: No. The first rule about HTTPS is no caching, because you want to validate that what you see is from the server and you can't prove that with a cache.
  - dntbrsnbl 2y ago
    Yeah, you can do something like that with a ServiceWorker - it does require some JavaScript though. https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Guides/Offline_and_background_operation https://developer.mozilla.org/en-US/docs/Web/Progressive_web...
  - etaioinshrdlu 2y ago
    Maybe the entire page could be a self-updating data-url? edit: I tried this and common browser security no longer allows this type of thing. 10 years ago it may have worked.
    - greyface- 2y ago
      Here: data:text/html,<body contenteditable oninput="history.replaceState(0,0,'%23'+btoa(document.body.innerHTML))" onload="if(location.hash)document.body.innerHTML=atob(location.hash.substring(1))">#SGVsbG8sIHdvcmxkIQ==
      - TimTheTinker 2y ago
        Beautiful. Beat me to it. Much better than a relying on an HTTP response from someone else's computer.
      - mro_name 2y ago
        Wonderful! How can I silence the Firefox security error messages?
      - cvak 2y ago
        Unfortunately this doesn't work on FF due to security Uncaught NS_ERROR_FAILURE
        jimbobthrowawy 2y ago
        I'm not getting anything like that, for some reason. I assume I changed a setting and forgot. (probably something to make bookmarklets work) Pasted in URL bar in a new tab, private browsing, FF version 126.0, up to date fedora, history doesn't save.
        cvak 2y ago
        Yeah probably(or corp profile), it works in chrome... Anyway this one works in FF with my settings https://gist.github.com/joakin/f05fd565e8df77a805e21d2d3469d13c https://gist.github.com/joakin/f05fd565e8df77a805e21d2d3469d...
- kapep 2y ago
  Also > - Doesn't need cookies = immune to data loss by accident How is this immune if you have to remember to save it manually? That seems much worse than relying on cookies. Sure you can maybe restore it from the browser history, but if cookies are not considered reliable, then the history even more so. It's easier to delete history than cookies.
derefr 2y ago
While you might assume that Cloudflare "insights" is an advertising/analytics system, this is actually part of Cloudflare's anti-DDoS infrastructure. This "beacon" gets injected at random on Cloudflare-served HTML pages, to track you throughout your use of all Cloudflare-proxied sites, as an alternative to an evercookie in building a long-term reputation profile of "human browsing" for your browser. This reputation profile is then used as part of the heuristic behind CloudFlare Turnstile's "Are you human?" checkbox. This is why browsers that have NoScript enabled by default for all sites (e.g. Tor Browser), cause Cloudflare-proxied sites to throw endless security interstitials and never let you through, even when you disable NoScript for the protected website. Without reputation-profile data gathered from other sites, Cloudflare just sees a fresh browser profile making its first connection ever to some obscure site that nobody would ever actually visit as the first thing they do on a new computer. And so it thinks your browser is a (not-very-clever) bot. I don't think it's possible for a site owner to opt out of this reputation-profile data gathering, while still relying on Cloudflare's DDoS protection. However, I also don't believe that the data Cloudflare gathers via this route is sold to third parties. (Someone please correct me if that's wrong.)
- madeofpalk 2y ago
  Builds a persistent profile of you across the web… this is directly at odds with "Doesn't use analytics = respects your privacy" I’m sure the author isn’t aware of it and it’s just an oversight, but still. Why does a single static html file even need a CDN?
  - pard68 2y ago
    Probably not a CDN, persay, but is using Cloudflare Pages as a host. Hosts static HTML for free on CF's CDNs. I use it for all my sites.
  - arnorhs 2y ago
    "need", probably not. But anything that can be served from a cdn is better off if it fits. From a latency and bandwidth efficiency perspective
- 2y ago
JonathonW 2y ago
And the data that's collected here includes the full page URL-- which, in this case, includes the fragment and therefore whatever data is being "stored", at the time of capture. This is probably beyond the author's control, but they shouldn't host it somewhere that can inject scripts outside their control (like Cloudflare) and then claim "privacy". (The Cloudflare script makes a request to `/cdn-cgi/rum`, with the full page URL in its JSON payload at `timingsV2.name`.)

Dalewyn 2y ago

On a similar token: >Doesn't use a server = no downtimes Except there is a server, whatever and wherever it is behind notepadtab.com.

jimbobthrowawy 2y ago
Is there anything in the HTML spec that tells browsers to always show a cached version a page if it can't be loaded the next time you try to access it? I think PWAs might have something like that, but haven't tested it in a normal browser or tried building one.
- Dalewyn 2y ago
  HTML dictates how webpages should be structured and then rendered. You're probably asking about HTTPS, in which case: No. The first rule about HTTPS is no caching, because you want to validate that what you see is from the server and you can't prove that with a cache.
- dntbrsnbl 2y ago
  Yeah, you can do something like that with a ServiceWorker - it does require some JavaScript though. https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Guides/Offline_and_background_operation https://developer.mozilla.org/en-US/docs/Web/Progressive_web...
- etaioinshrdlu 2y ago
  Maybe the entire page could be a self-updating data-url? edit: I tried this and common browser security no longer allows this type of thing. 10 years ago it may have worked.
  - greyface- 2y ago
    Here: data:text/html,<body contenteditable oninput="history.replaceState(0,0,'%23'+btoa(document.body.innerHTML))" onload="if(location.hash)document.body.innerHTML=atob(location.hash.substring(1))">#SGVsbG8sIHdvcmxkIQ==
    - TimTheTinker 2y ago
      Beautiful. Beat me to it. Much better than a relying on an HTTP response from someone else's computer.
    - mro_name 2y ago
      Wonderful! How can I silence the Firefox security error messages?
    - cvak 2y ago
      Unfortunately this doesn't work on FF due to security Uncaught NS_ERROR_FAILURE
      - jimbobthrowawy 2y ago
        I'm not getting anything like that, for some reason. I assume I changed a setting and forgot. (probably something to make bookmarklets work) Pasted in URL bar in a new tab, private browsing, FF version 126.0, up to date fedora, history doesn't save.
        cvak 2y ago
        Yeah probably(or corp profile), it works in chrome... Anyway this one works in FF with my settings https://gist.github.com/joakin/f05fd565e8df77a805e21d2d3469d13c https://gist.github.com/joakin/f05fd565e8df77a805e21d2d3469d...
kapep 2y ago
Also > - Doesn't need cookies = immune to data loss by accident How is this immune if you have to remember to save it manually? That seems much worse than relying on cookies. Sure you can maybe restore it from the browser history, but if cookies are not considered reliable, then the history even more so. It's easier to delete history than cookies.

derefr 2y ago

While you might assume that Cloudflare "insights" is an advertising/analytics system, this is actually part of Cloudflare's anti-DDoS infrastructure. This "beacon" gets injected at random on Cloudflare-served HTML pages, to track you throughout your use of all Cloudflare-proxied sites, as an alternative to an evercookie in building a long-term reputation profile of "human browsing" for your browser. This reputation profile is then used as part of the heuristic behind CloudFlare Turnstile's "Are you human?" checkbox. This is why browsers that have NoScript enabled by default for all sites (e.g. Tor Browser), cause Cloudflare-proxied sites to throw endless security interstitials and never let you through, even when you disable NoScript for the protected website. Without reputation-profile data gathered from other sites, Cloudflare just sees a fresh browser profile making its first connection ever to some obscure site that nobody would ever actually visit as the first thing they do on a new computer. And so it thinks your browser is a (not-very-clever) bot. I don't think it's possible for a site owner to opt out of this reputation-profile data gathering, while still relying on Cloudflare's DDoS protection. However, I also don't believe that the data Cloudflare gathers via this route is sold to third parties. (Someone please correct me if that's wrong.)

madeofpalk 2y ago
Builds a persistent profile of you across the web… this is directly at odds with "Doesn't use analytics = respects your privacy" I’m sure the author isn’t aware of it and it’s just an oversight, but still. Why does a single static html file even need a CDN?
- pard68 2y ago
  Probably not a CDN, persay, but is using Cloudflare Pages as a host. Hosts static HTML for free on CF's CDNs. I use it for all my sites.
- arnorhs 2y ago
  "need", probably not. But anything that can be served from a cdn is better off if it fits. From a latency and bandwidth efficiency perspective
2y ago

JonathonW 2y ago

And the data that's collected here includes the full page URL-- which, in this case, includes the fragment and therefore whatever data is being "stored", at the time of capture. This is probably beyond the author's control, but they shouldn't host it somewhere that can inject scripts outside their control (like Cloudflare) and then claim "privacy". (The Cloudflare script makes a request to `/cdn-cgi/rum`, with the full page URL in its JSON payload at `timingsV2.name`.)