3 ms·

Yeah, that is an odd decision. Makes you wonder if the “secret” motive of CloudFlare in hosting this, other than to promote their service, is to track and analy

by graue 14y ago

Yeah, that is an odd decision. Makes you wonder if the “secret” motive of CloudFlare in hosting this, other than to promote their service, is to track and analyze your visitors. I don't see a privacy policy on CDNJS.com. I'd definitely like to know what data they collect about my visitors and what they do with it. At least the CDN doesn't itself set any cookies.

untog 14y ago
Honestly, I don't think that it is some conspiracy to track me, rather it was just a mistake. Perhaps I am not cynical enough.
atonse 14y ago
If anything this would only work on other cloudflare users (like people who logged in to cloudflare). Most users won't have any cookies on that domain.
- bigiain 14y ago
  There's nothing to stop them setting cookies in the responses down the track though. Wait until you've got enough users, then one day just switch on your 3rd party multi-site user tracking. Or perhaps less publicly dicoverable, use browser fingerprinting and ip address correlation to do the same thing with somewhat less accuracy, but completely invisibly. And note too, that if you're relying on a 3rd party to serve javascript your users are going to run in their browsers - if that 3rd party isn't trustworthy, you're screwed in much worse ways that cookie tracking privacy violations. Who'd notice if they started occasionally serving a modified version of jQuery which sent all form field keydowns (aka, your usernames and passwords) back to theselves?
  - graue 14y ago
    This is way too paranoid. CloudFlare are a reputable company; they're not blackhats. I think my comment above was too paranoid, as well, but it's too late to edit. All I was suspicious of was that there might be analysis going on.
  - atonse 14y ago
    Following the money will especially help in this situation. How does CloudFlare make its money? It's a CDN company. I mean, that's the CORE of what they do. What is jsCDN? It's a CDN. A simpler theory is that hosting a Javascript CDN (and demonstrating that it's even better than Google's, which is amazing), is going to provide a lot of free advertising for their product. If I use their CDN for JS and it works really well, I'm likely to go back to them for hosting other things, because using jsCDN is almost like doing a free trial of their actual CDN. It's not even like their main form of income is in another industry that we have to make a cognitive leap to see what their ulterior motives are. It's precisely this. CDNs.
  - bisho 14y ago
    Dude, as a good cdn will set cache headers to make browsers store the items forever, without even re-validating content. Definitely not very useable for tracking purposes, they will only know about first visit of a user. Even more if sites a and b use the same js library and version, they will only know about the first that a user visit. Anyway is a bad technical decision not to use a different domain to ensure clients don't need to send extra cookies in the headers.

by graue 14y ago

untog 14y ago

Honestly, I don't think that it is some conspiracy to track me, rather it was just a mistake. Perhaps I am not cynical enough.

atonse 14y ago

If anything this would only work on other cloudflare users (like people who logged in to cloudflare). Most users won't have any cookies on that domain.

bigiain 14y ago
There's nothing to stop them setting cookies in the responses down the track though. Wait until you've got enough users, then one day just switch on your 3rd party multi-site user tracking. Or perhaps less publicly dicoverable, use browser fingerprinting and ip address correlation to do the same thing with somewhat less accuracy, but completely invisibly. And note too, that if you're relying on a 3rd party to serve javascript your users are going to run in their browsers - if that 3rd party isn't trustworthy, you're screwed in much worse ways that cookie tracking privacy violations. Who'd notice if they started occasionally serving a modified version of jQuery which sent all form field keydowns (aka, your usernames and passwords) back to theselves?
- graue 14y ago
  This is way too paranoid. CloudFlare are a reputable company; they're not blackhats. I think my comment above was too paranoid, as well, but it's too late to edit. All I was suspicious of was that there might be analysis going on.
- atonse 14y ago
  Following the money will especially help in this situation. How does CloudFlare make its money? It's a CDN company. I mean, that's the CORE of what they do. What is jsCDN? It's a CDN. A simpler theory is that hosting a Javascript CDN (and demonstrating that it's even better than Google's, which is amazing), is going to provide a lot of free advertising for their product. If I use their CDN for JS and it works really well, I'm likely to go back to them for hosting other things, because using jsCDN is almost like doing a free trial of their actual CDN. It's not even like their main form of income is in another industry that we have to make a cognitive leap to see what their ulterior motives are. It's precisely this. CDNs.
- bisho 14y ago
  Dude, as a good cdn will set cache headers to make browsers store the items forever, without even re-validating content. Definitely not very useable for tracking purposes, they will only know about first visit of a user. Even more if sites a and b use the same js library and version, they will only know about the first that a user visit. Anyway is a bad technical decision not to use a different domain to ensure clients don't need to send extra cookies in the headers.