4 ms·

What's your main risk?

JohnFen 1y ago
In this context, the main risk is the exfiltration of data about me or my use of my machines to others without my active informed consent. This tool is designed and proudly intended to allow exactly that. After all, someone taking actions to prevent data collection is unambiguously signalling that they do not consent to being spied on, and this tool intentionally subverts their wishes.
- nikitaeverywher 1y ago
  I see your point – it's valid, but perhaps a bit overgeneralized. Let me explain. You don't wear a balaclava to walk down the street just to avoid being seen – you still share some minimal data with the world, like your appearance. Similarly, on the Internet, some minimal metadata is inevitably shared, even if you're privacy-conscious. So a genuine question is: what do you consider acceptable "minimal data" to share with websites? None?
  - JohnFen 1y ago
    "Minimal data" would be my IP address, as that's necessary in order for traffic to be exchanged. Everything else should only be collected with my informed consent. If I've consented, then whatever I've consented to is acceptable. There is absolutely a gray area, though, where data collection may be unobjectionable. The reason I consider it a "gray area" is because it requires trusting whoever is collecting the data, and history has very clearly shown that trust is misplaced. I'm talking about things like: just counting, in the aggregate, how many times users have clicked a button is OK, but recording entire sessions is not (even if that recording is "anonymized"). But as an end user, it's impossible for me to tell who is being well-behaved and who isn't, so I have to assume that everyone is ill-behaved.
    - nikitaeverywher 1y ago
      There's more, let me enrich the list of data a bit: (1) Minimal data (as per your comment): - Your IP address (hence, your location and the internet provider you use) (2) Inevitably collected data (you can't avoid not giving this data for things to operate): - The website domain (goes to DNS and your internet provider / VPN) - The page URL you access (goes to your website and Cloud/CDN provider they use) - Timestamp of the request (goes to all) - Cookies, user agent, referral and other headers your browser typically sends (goes to your website and Cloud/CDN provider they use) (3) Client-side collected data (arbitrary JavaScript and what blockers typically block): - Same data as above (but let's say, instead being fed to a third party like Google) - Some client-only data (screen dimensions, session duration) - Behavioral data (page element clicks, cursor moves, etc) - Whatever the website itself wants to collect (typically, ad conversions, attribution, purchases etc) It's absolutely valid (3) can be misused and it's fair to be minimized. But to same extent (2) can. It all just narrows down to giving less data, to less third parties. A random ad-heavy site on the internet still has a little chance to know you've purchased a new pair of shoes in some random store. There are truly genuine and legit cases when website owners would like to use (3) for whatever purpose, but they can't get accurate data (and with some blocker extensions, even after the consent has been granted). Like, you may want to see how many scroll it down, read and to what extent. There's value. Each website decides this for themselves – they are the builders.

In this context, the main risk is the exfiltration of data about me or my use of my machines to others without my active informed consent. This tool is designed and proudly intended to allow exactly that. After all, someone taking actions to prevent data collection is unambiguously signalling that they do not consent to being spied on, and this tool intentionally subverts their wishes.

nikitaeverywher 1y ago
I see your point – it's valid, but perhaps a bit overgeneralized. Let me explain. You don't wear a balaclava to walk down the street just to avoid being seen – you still share some minimal data with the world, like your appearance. Similarly, on the Internet, some minimal metadata is inevitably shared, even if you're privacy-conscious. So a genuine question is: what do you consider acceptable "minimal data" to share with websites? None?
- JohnFen 1y ago
  "Minimal data" would be my IP address, as that's necessary in order for traffic to be exchanged. Everything else should only be collected with my informed consent. If I've consented, then whatever I've consented to is acceptable. There is absolutely a gray area, though, where data collection may be unobjectionable. The reason I consider it a "gray area" is because it requires trusting whoever is collecting the data, and history has very clearly shown that trust is misplaced. I'm talking about things like: just counting, in the aggregate, how many times users have clicked a button is OK, but recording entire sessions is not (even if that recording is "anonymized"). But as an end user, it's impossible for me to tell who is being well-behaved and who isn't, so I have to assume that everyone is ill-behaved.
  - nikitaeverywher 1y ago
    There's more, let me enrich the list of data a bit: (1) Minimal data (as per your comment): - Your IP address (hence, your location and the internet provider you use) (2) Inevitably collected data (you can't avoid not giving this data for things to operate): - The website domain (goes to DNS and your internet provider / VPN) - The page URL you access (goes to your website and Cloud/CDN provider they use) - Timestamp of the request (goes to all) - Cookies, user agent, referral and other headers your browser typically sends (goes to your website and Cloud/CDN provider they use) (3) Client-side collected data (arbitrary JavaScript and what blockers typically block): - Same data as above (but let's say, instead being fed to a third party like Google) - Some client-only data (screen dimensions, session duration) - Behavioral data (page element clicks, cursor moves, etc) - Whatever the website itself wants to collect (typically, ad conversions, attribution, purchases etc) It's absolutely valid (3) can be misused and it's fair to be minimized. But to same extent (2) can. It all just narrows down to giving less data, to less third parties. A random ad-heavy site on the internet still has a little chance to know you've purchased a new pair of shoes in some random store. There are truly genuine and legit cases when website owners would like to use (3) for whatever purpose, but they can't get accurate data (and with some blocker extensions, even after the consent has been granted). Like, you may want to see how many scroll it down, read and to what extent. There's value. Each website decides this for themselves – they are the builders.