4 ms·

this shouldn't be hosted on the cloudflare.com domain. since I am a customer every request sends my cloudflare session cookie and a bunch of Google Analytics co

by nikcub 14y ago

this shouldn't be hosted on the cloudflare.com domain. since I am a customer every request sends my cloudflare session cookie and a bunch of Google Analytics cookies. Not only is it 2.5KB of extra header info sent, but I don't think cloudflare should know which websites their customers have been visiting.

graue 14y ago
Yeah, that is an odd decision. Makes you wonder if the “secret” motive of CloudFlare in hosting this, other than to promote their service, is to track and analyze your visitors. I don't see a privacy policy on CDNJS.com. I'd definitely like to know what data they collect about my visitors and what they do with it. At least the CDN doesn't itself set any cookies.
- untog 14y ago
  Honestly, I don't think that it is some conspiracy to track me, rather it was just a mistake. Perhaps I am not cynical enough.
- atonse 14y ago
  If anything this would only work on other cloudflare users (like people who logged in to cloudflare). Most users won't have any cookies on that domain.
  - bigiain 14y ago
    There's nothing to stop them setting cookies in the responses down the track though. Wait until you've got enough users, then one day just switch on your 3rd party multi-site user tracking. Or perhaps less publicly dicoverable, use browser fingerprinting and ip address correlation to do the same thing with somewhat less accuracy, but completely invisibly. And note too, that if you're relying on a 3rd party to serve javascript your users are going to run in their browsers - if that 3rd party isn't trustworthy, you're screwed in much worse ways that cookie tracking privacy violations. Who'd notice if they started occasionally serving a modified version of jQuery which sent all form field keydowns (aka, your usernames and passwords) back to theselves?
    - graue 14y ago
      This is way too paranoid. CloudFlare are a reputable company; they're not blackhats. I think my comment above was too paranoid, as well, but it's too late to edit. All I was suspicious of was that there might be analysis going on.
    - atonse 14y ago
      Following the money will especially help in this situation. How does CloudFlare make its money? It's a CDN company. I mean, that's the CORE of what they do. What is jsCDN? It's a CDN. A simpler theory is that hosting a Javascript CDN (and demonstrating that it's even better than Google's, which is amazing), is going to provide a lot of free advertising for their product. If I use their CDN for JS and it works really well, I'm likely to go back to them for hosting other things, because using jsCDN is almost like doing a free trial of their actual CDN. It's not even like their main form of income is in another industry that we have to make a cognitive leap to see what their ulterior motives are. It's precisely this. CDNs.
    - bisho 14y ago
      Dude, as a good cdn will set cache headers to make browsers store the items forever, without even re-validating content. Definitely not very useable for tracking purposes, they will only know about first visit of a user. Even more if sites a and b use the same js library and version, they will only know about the first that a user visit. Anyway is a bad technical decision not to use a different domain to ensure clients don't need to send extra cookies in the headers.
byoung2 14y ago
Microsoft just changed their CDN url because of this: http://www.asp.net/ajaxlibrary/cdn.ashx http://www.asp.net/ajaxlibrary/cdn.ashx Though for the most part, people will not have cookies set on the domain unless they have visited the main site (i.e. they are developers).
cypherpunks01 14y ago
Could you set up a CNAME on your website that points cdnjs.mycompany.com to cdnjs.cloudflare.com to solve this (for your site visitors)? Or would that mess up cloudflare's anycast DNS?
- marshray 14y ago
  Wouldn't the browser still send cdnjs.mycompany.com in the Host: header and break the page?
  - nikcub 14y ago
    that is exactly what happens. the server isn't setup to respond to requests to the cdnjs.mycompany.com hostname and it returns a 409 error.
    - cypherpunks01 14y ago
      Ah, thanks for the info. Damn virtual hosts!
eastdakota 14y ago
There is no cookie information (CloudFlare, Google, or otherwise) sent for requests to CDNJS resources.
- dknecht 14y ago
  In addition the reason to host this on single domain vs your own site is that the users only have to download the resource once it once for all the sites they visit.
- nikcub 14y ago
  the first thing I did is request backbone.min.js and open the web console to check the response time. looked at the request, saw cookies: http://i.imgur.com/Qqzc3.jpg http://i.imgur.com/Qqzc3.jpg

by nikcub 14y ago

graue 14y ago

Yeah, that is an odd decision. Makes you wonder if the “secret” motive of CloudFlare in hosting this, other than to promote their service, is to track and analyze your visitors. I don't see a privacy policy on CDNJS.com. I'd definitely like to know what data they collect about my visitors and what they do with it. At least the CDN doesn't itself set any cookies.

untog 14y ago
Honestly, I don't think that it is some conspiracy to track me, rather it was just a mistake. Perhaps I am not cynical enough.
atonse 14y ago
If anything this would only work on other cloudflare users (like people who logged in to cloudflare). Most users won't have any cookies on that domain.
- bigiain 14y ago
  There's nothing to stop them setting cookies in the responses down the track though. Wait until you've got enough users, then one day just switch on your 3rd party multi-site user tracking. Or perhaps less publicly dicoverable, use browser fingerprinting and ip address correlation to do the same thing with somewhat less accuracy, but completely invisibly. And note too, that if you're relying on a 3rd party to serve javascript your users are going to run in their browsers - if that 3rd party isn't trustworthy, you're screwed in much worse ways that cookie tracking privacy violations. Who'd notice if they started occasionally serving a modified version of jQuery which sent all form field keydowns (aka, your usernames and passwords) back to theselves?
  - graue 14y ago
    This is way too paranoid. CloudFlare are a reputable company; they're not blackhats. I think my comment above was too paranoid, as well, but it's too late to edit. All I was suspicious of was that there might be analysis going on.
  - atonse 14y ago
    Following the money will especially help in this situation. How does CloudFlare make its money? It's a CDN company. I mean, that's the CORE of what they do. What is jsCDN? It's a CDN. A simpler theory is that hosting a Javascript CDN (and demonstrating that it's even better than Google's, which is amazing), is going to provide a lot of free advertising for their product. If I use their CDN for JS and it works really well, I'm likely to go back to them for hosting other things, because using jsCDN is almost like doing a free trial of their actual CDN. It's not even like their main form of income is in another industry that we have to make a cognitive leap to see what their ulterior motives are. It's precisely this. CDNs.
  - bisho 14y ago
    Dude, as a good cdn will set cache headers to make browsers store the items forever, without even re-validating content. Definitely not very useable for tracking purposes, they will only know about first visit of a user. Even more if sites a and b use the same js library and version, they will only know about the first that a user visit. Anyway is a bad technical decision not to use a different domain to ensure clients don't need to send extra cookies in the headers.

byoung2 14y ago

Microsoft just changed their CDN url because of this: http://www.asp.net/ajaxlibrary/cdn.ashx http://www.asp.net/ajaxlibrary/cdn.ashx Though for the most part, people will not have cookies set on the domain unless they have visited the main site (i.e. they are developers).

cypherpunks01 14y ago

Could you set up a CNAME on your website that points cdnjs.mycompany.com to cdnjs.cloudflare.com to solve this (for your site visitors)? Or would that mess up cloudflare's anycast DNS?

marshray 14y ago
Wouldn't the browser still send cdnjs.mycompany.com in the Host: header and break the page?
- nikcub 14y ago
  that is exactly what happens. the server isn't setup to respond to requests to the cdnjs.mycompany.com hostname and it returns a 409 error.
  - cypherpunks01 14y ago
    Ah, thanks for the info. Damn virtual hosts!

eastdakota 14y ago

There is no cookie information (CloudFlare, Google, or otherwise) sent for requests to CDNJS resources.

dknecht 14y ago
In addition the reason to host this on single domain vs your own site is that the users only have to download the resource once it once for all the sites they visit.
nikcub 14y ago
the first thing I did is request backbone.min.js and open the web console to check the response time. looked at the request, saw cookies: http://i.imgur.com/Qqzc3.jpg http://i.imgur.com/Qqzc3.jpg