3 ms·

Strict tracking in firefox blocks the following: Social media trackers, Cross-site cookies in all windows, Tracking content in all windows, Cryptominers, Known

Strict tracking in firefox blocks the following: Social media trackers, Cross-site cookies in all windows, Tracking content in all windows, Cryptominers, Known and suspected fingerprinters. I wouldn't wanna use a site that relies on any of the above to function anyway.

AnthonyMouse 2y ago
The question is, what's going on here? Is this Firefox blocking some path/subdomain/cookie on x.com because it's used by their tracking widget, but the same is also used by some important part of the site itself, so it's essentially a false positive and Mozilla need to adjust the filter to be more specific? Or is the site detecting the ad blocker and purposely refusing to load?
- cmeacham98 2y ago
  I don't know specifically for X/Twitter, but typically it isn't actively malicious but instead just bad programming. The JS is written in a way that breaks when the <tracking/ad/whatever is blocked> fails to load.
  - Ygg2 2y ago
    I'm pretty sure that's a feature not a bug. Same with anti adblock tech.
  - intelVISA 2y ago
    Malice and bad programming are interchangeable in most contexts, one day our industry will learn this but not until a few more CrowdStrikes and a few less Js frameworks, runtimes and crapwares.
- NewJazz 2y ago
  This is a complete guess, but it could have to do with the twitter.com -> x.com migration. Still trying to load twitter.com assets, which are now third party.
  - db48x 2y ago
    Don't guess. Just read the source code!
    - anticensor 2y ago
      Yes, it is the case: it still tries to load assets from twitter.com and twimg.com.
- db48x 2y ago
  Twitter loads some javascript file from edgecastcdn.net and twimg.com. The browser blocks these loads because they are from third–party domains which is a big risk. Loading a script from a third party exposes anything secret or private on the page to the third party. Of course twimg.com is _probably_ owned and operated by Twitter, but it could be anyone. They’re not even registered through the same registrar, they have different registrant information, etc, etc. One is reported to be in Arizona, the other in California. This is exactly how information about you is leaked to advertisers. Maybe the scripts you load from those third–party domains are harmless, or maybe they send everything you see and type back to the third party. There is javascript on the page that detects the failure and puts up the error message blaming the browser. Really the browser is taking a completely legitimate action, and Twitter could get around it by simply hosting all of their javascript on the same domain that you visit. If you visit x.com it would load javascript from x.com. But if you visit twitter.com, it would load the same javascript files from twitter.com urls instead. Or twitter.com could just redirect you to x.com. Either way, the problem would be solved. But by asking you to turn off strict browsing mode, it enables Twitter to load javascript from real third parties that just want to advertise to you.
  - walterbell 2y ago
    Can users whitelist select domains that are "trusted"?
  - j5155 2y ago
    Strict tracking protection mode does not block third party JavaScript. Are you referring to another extension you have enabled?
    - db48x 2y ago
      Yea, I simplified that a bit. It blocks specific third–party domains that are known to host advertising trackers.
  - deleted 2y ago
    [deleted]
  - 2y ago
- 1oooqooq 2y ago
  malicious action on xitter. just like google forcing browsers to send full referrer cross domain by strong arming w3c with chrome. because their business model depends on full referrer cross domain. xitter decided it's business model depends on third party cookies. so they're strong arming users into enabling it on the browser globally. everything is simple. there's no complex technological reason for any of those things. it's all access to your data and money. the browser is the battle ground and they win every single time.
  - matthewsinclair 2y ago
    > Xitter I fully endorse this use. I’ve been using it myself for some time. I’m so sick of newspapers writing “X (formerly Twitter)” everywhere. And “Xitter” has all of the right connotations for the cess pit that xitter has become.
kapitanjakc 2y ago
Cross site cookies are required for educational content sharing via LTI. Every time I enable that feature, I have to write essays to client's security team for allowing it. So frustrating.
- EdwardDiego 2y ago
  Sorry, what's LTI?
  - widea 2y ago
    Probably 'Learning Tools Interoperability'.
  - MikeTheGreat 2y ago
    "Learning Tools Interoperability": https://www.imsglobal.org/spec/lti/v1p3/ https://www.imsglobal.org/spec/lti/v1p3/ From the page: "The IMS Learning Tools Interoperability (LTI)® specification allows Learning Management Systems (LMS) or platforms to integrate remote tools and content in a standard way." If you haven't used an LMS ("Learning Management System") it's kinda like WordPress for teaching - teachers create course materials without needing to know HTML. I'm not super familiar with LTI, but it looks like the company that does this also does the Common Cartridge spec (which I'm more familiar with) To answer your question: Let's say that I'm teaching at course at University A using the Canvas LMS. At the end of the quarter the teacher asks the LMS to "Export The Course", which produces a file in the Common Cartridge format (essentially a .ZIP file with XML manifests and any supporting files bundled along with it). Later if you wanted to copy that course into an LMS then you can upload the Common Cartridge format and it should just work (at which point you can copy the course contents, in part or in whole, to the new course). I'm guessing the LTI is the same idea, but for the LMSs to talk to each other while they're running.
    - tialaramex 2y ago
      I'm currently on leave but this (LTI) is what we do at work much of the time. Typically LTI is used to add third party components (or in-house ones) to an LMS. For example we have our own Teams Integration, lecturers can make a Microsoft Team corresponding to any course they teach, their students can see the URL of the team if they've lost it but can't leave or create a team.
deleted 2y ago
[deleted]

AnthonyMouse 2y ago

The question is, what's going on here? Is this Firefox blocking some path/subdomain/cookie on x.com because it's used by their tracking widget, but the same is also used by some important part of the site itself, so it's essentially a false positive and Mozilla need to adjust the filter to be more specific? Or is the site detecting the ad blocker and purposely refusing to load?

cmeacham98 2y ago
I don't know specifically for X/Twitter, but typically it isn't actively malicious but instead just bad programming. The JS is written in a way that breaks when the <tracking/ad/whatever is blocked> fails to load.
- Ygg2 2y ago
  I'm pretty sure that's a feature not a bug. Same with anti adblock tech.
- intelVISA 2y ago
  Malice and bad programming are interchangeable in most contexts, one day our industry will learn this but not until a few more CrowdStrikes and a few less Js frameworks, runtimes and crapwares.
NewJazz 2y ago
This is a complete guess, but it could have to do with the twitter.com -> x.com migration. Still trying to load twitter.com assets, which are now third party.
- db48x 2y ago
  Don't guess. Just read the source code!
  - anticensor 2y ago
    Yes, it is the case: it still tries to load assets from twitter.com and twimg.com.
db48x 2y ago
Twitter loads some javascript file from edgecastcdn.net and twimg.com. The browser blocks these loads because they are from third–party domains which is a big risk. Loading a script from a third party exposes anything secret or private on the page to the third party. Of course twimg.com is _probably_ owned and operated by Twitter, but it could be anyone. They’re not even registered through the same registrar, they have different registrant information, etc, etc. One is reported to be in Arizona, the other in California. This is exactly how information about you is leaked to advertisers. Maybe the scripts you load from those third–party domains are harmless, or maybe they send everything you see and type back to the third party. There is javascript on the page that detects the failure and puts up the error message blaming the browser. Really the browser is taking a completely legitimate action, and Twitter could get around it by simply hosting all of their javascript on the same domain that you visit. If you visit x.com it would load javascript from x.com. But if you visit twitter.com, it would load the same javascript files from twitter.com urls instead. Or twitter.com could just redirect you to x.com. Either way, the problem would be solved. But by asking you to turn off strict browsing mode, it enables Twitter to load javascript from real third parties that just want to advertise to you.
- walterbell 2y ago
  Can users whitelist select domains that are "trusted"?
- j5155 2y ago
  Strict tracking protection mode does not block third party JavaScript. Are you referring to another extension you have enabled?
  - db48x 2y ago
    Yea, I simplified that a bit. It blocks specific third–party domains that are known to host advertising trackers.
- deleted 2y ago
  [deleted]
- 2y ago
1oooqooq 2y ago
malicious action on xitter. just like google forcing browsers to send full referrer cross domain by strong arming w3c with chrome. because their business model depends on full referrer cross domain. xitter decided it's business model depends on third party cookies. so they're strong arming users into enabling it on the browser globally. everything is simple. there's no complex technological reason for any of those things. it's all access to your data and money. the browser is the battle ground and they win every single time.
- matthewsinclair 2y ago
  > Xitter I fully endorse this use. I’ve been using it myself for some time. I’m so sick of newspapers writing “X (formerly Twitter)” everywhere. And “Xitter” has all of the right connotations for the cess pit that xitter has become.

kapitanjakc 2y ago

Cross site cookies are required for educational content sharing via LTI. Every time I enable that feature, I have to write essays to client's security team for allowing it. So frustrating.

EdwardDiego 2y ago
Sorry, what's LTI?
- widea 2y ago
  Probably 'Learning Tools Interoperability'.
- MikeTheGreat 2y ago
  "Learning Tools Interoperability": https://www.imsglobal.org/spec/lti/v1p3/ https://www.imsglobal.org/spec/lti/v1p3/ From the page: "The IMS Learning Tools Interoperability (LTI)® specification allows Learning Management Systems (LMS) or platforms to integrate remote tools and content in a standard way." If you haven't used an LMS ("Learning Management System") it's kinda like WordPress for teaching - teachers create course materials without needing to know HTML. I'm not super familiar with LTI, but it looks like the company that does this also does the Common Cartridge spec (which I'm more familiar with) To answer your question: Let's say that I'm teaching at course at University A using the Canvas LMS. At the end of the quarter the teacher asks the LMS to "Export The Course", which produces a file in the Common Cartridge format (essentially a .ZIP file with XML manifests and any supporting files bundled along with it). Later if you wanted to copy that course into an LMS then you can upload the Common Cartridge format and it should just work (at which point you can copy the course contents, in part or in whole, to the new course). I'm guessing the LTI is the same idea, but for the LMSs to talk to each other while they're running.
  - tialaramex 2y ago
    I'm currently on leave but this (LTI) is what we do at work much of the time. Typically LTI is used to add third party components (or in-house ones) to an LMS. For example we have our own Teams Integration, lecturers can make a Microsoft Team corresponding to any course they teach, their students can see the URL of the team if they've lost it but can't leave or create a team.

deleted 2y ago

[deleted]