4 ms·

The question is, what's going on here? Is this Firefox blocking some path/subdomain/cookie on x.com because it's used by their tracking widget, but the same is

The question is, what's going on here? Is this Firefox blocking some path/subdomain/cookie on x.com because it's used by their tracking widget, but the same is also used by some important part of the site itself, so it's essentially a false positive and Mozilla need to adjust the filter to be more specific? Or is the site detecting the ad blocker and purposely refusing to load?

cmeacham98 2y ago
I don't know specifically for X/Twitter, but typically it isn't actively malicious but instead just bad programming. The JS is written in a way that breaks when the <tracking/ad/whatever is blocked> fails to load.
- Ygg2 2y ago
  I'm pretty sure that's a feature not a bug. Same with anti adblock tech.
- intelVISA 2y ago
  Malice and bad programming are interchangeable in most contexts, one day our industry will learn this but not until a few more CrowdStrikes and a few less Js frameworks, runtimes and crapwares.
NewJazz 2y ago
This is a complete guess, but it could have to do with the twitter.com -> x.com migration. Still trying to load twitter.com assets, which are now third party.
- db48x 2y ago
  Don't guess. Just read the source code!
  - anticensor 2y ago
    Yes, it is the case: it still tries to load assets from twitter.com and twimg.com.
db48x 2y ago
Twitter loads some javascript file from edgecastcdn.net and twimg.com. The browser blocks these loads because they are from third–party domains which is a big risk. Loading a script from a third party exposes anything secret or private on the page to the third party. Of course twimg.com is _probably_ owned and operated by Twitter, but it could be anyone. They’re not even registered through the same registrar, they have different registrant information, etc, etc. One is reported to be in Arizona, the other in California. This is exactly how information about you is leaked to advertisers. Maybe the scripts you load from those third–party domains are harmless, or maybe they send everything you see and type back to the third party. There is javascript on the page that detects the failure and puts up the error message blaming the browser. Really the browser is taking a completely legitimate action, and Twitter could get around it by simply hosting all of their javascript on the same domain that you visit. If you visit x.com it would load javascript from x.com. But if you visit twitter.com, it would load the same javascript files from twitter.com urls instead. Or twitter.com could just redirect you to x.com. Either way, the problem would be solved. But by asking you to turn off strict browsing mode, it enables Twitter to load javascript from real third parties that just want to advertise to you.
- walterbell 2y ago
  Can users whitelist select domains that are "trusted"?
- j5155 2y ago
  Strict tracking protection mode does not block third party JavaScript. Are you referring to another extension you have enabled?
  - db48x 2y ago
    Yea, I simplified that a bit. It blocks specific third–party domains that are known to host advertising trackers.
- deleted 2y ago
  [deleted]
- 2y ago
1oooqooq 2y ago
malicious action on xitter. just like google forcing browsers to send full referrer cross domain by strong arming w3c with chrome. because their business model depends on full referrer cross domain. xitter decided it's business model depends on third party cookies. so they're strong arming users into enabling it on the browser globally. everything is simple. there's no complex technological reason for any of those things. it's all access to your data and money. the browser is the battle ground and they win every single time.
- matthewsinclair 2y ago
  > Xitter I fully endorse this use. I’ve been using it myself for some time. I’m so sick of newspapers writing “X (formerly Twitter)” everywhere. And “Xitter” has all of the right connotations for the cess pit that xitter has become.

cmeacham98 2y ago

I don't know specifically for X/Twitter, but typically it isn't actively malicious but instead just bad programming. The JS is written in a way that breaks when the <tracking/ad/whatever is blocked> fails to load.

Ygg2 2y ago
I'm pretty sure that's a feature not a bug. Same with anti adblock tech.
intelVISA 2y ago
Malice and bad programming are interchangeable in most contexts, one day our industry will learn this but not until a few more CrowdStrikes and a few less Js frameworks, runtimes and crapwares.

NewJazz 2y ago

This is a complete guess, but it could have to do with the twitter.com -> x.com migration. Still trying to load twitter.com assets, which are now third party.

db48x 2y ago
Don't guess. Just read the source code!
- anticensor 2y ago
  Yes, it is the case: it still tries to load assets from twitter.com and twimg.com.

db48x 2y ago

Twitter loads some javascript file from edgecastcdn.net and twimg.com. The browser blocks these loads because they are from third–party domains which is a big risk. Loading a script from a third party exposes anything secret or private on the page to the third party. Of course twimg.com is _probably_ owned and operated by Twitter, but it could be anyone. They’re not even registered through the same registrar, they have different registrant information, etc, etc. One is reported to be in Arizona, the other in California. This is exactly how information about you is leaked to advertisers. Maybe the scripts you load from those third–party domains are harmless, or maybe they send everything you see and type back to the third party. There is javascript on the page that detects the failure and puts up the error message blaming the browser. Really the browser is taking a completely legitimate action, and Twitter could get around it by simply hosting all of their javascript on the same domain that you visit. If you visit x.com it would load javascript from x.com. But if you visit twitter.com, it would load the same javascript files from twitter.com urls instead. Or twitter.com could just redirect you to x.com. Either way, the problem would be solved. But by asking you to turn off strict browsing mode, it enables Twitter to load javascript from real third parties that just want to advertise to you.

walterbell 2y ago
Can users whitelist select domains that are "trusted"?
j5155 2y ago
Strict tracking protection mode does not block third party JavaScript. Are you referring to another extension you have enabled?
- db48x 2y ago
  Yea, I simplified that a bit. It blocks specific third–party domains that are known to host advertising trackers.
deleted 2y ago
[deleted]
2y ago

1oooqooq 2y ago

malicious action on xitter. just like google forcing browsers to send full referrer cross domain by strong arming w3c with chrome. because their business model depends on full referrer cross domain. xitter decided it's business model depends on third party cookies. so they're strong arming users into enabling it on the browser globally. everything is simple. there's no complex technological reason for any of those things. it's all access to your data and money. the browser is the battle ground and they win every single time.

matthewsinclair 2y ago
> Xitter I fully endorse this use. I’ve been using it myself for some time. I’m so sick of newspapers writing “X (formerly Twitter)” everywhere. And “Xitter” has all of the right connotations for the cess pit that xitter has become.