3 ms·

I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it. So m

I have "Enhanced Tracking Protection" strict mode enabled in Firefox and surprise surprise it is allowing `static.cloudflareinsights.com` not blocking it. So much for "Firefox shields you as you browse, blocking trackers automatically so you’re in control of your digital trail" Mozilla..... Edit to add: I have been doing a little experimenting, it looks like there might be some sort of hardcoded whitelist somewhere in Firefox ? When I first wanted to check, I visited `cloudflare.com` as it seemed the obvious place to find `static.cloudflareinsights.com` and Firefox shield blocks nothing there (hence I made this post) However, then I tried to find a different site, and after a bit of random searching/clicking around I found `www.tenforums.com` and `static.cloudflareinsights.com` is blocked on there. Its not a first-party domain thing, since cloudflare.com != cloudflareinsights.com. Surely `static.cloudflareinsights.com` should be blocked everywhere in strict mode, no exceptions ? Interestingly, when testing other sites, I have also been discovering other things Firefox shield is failing to block, e.g. `browser.events.data.microsoft.com` (tested on a non microsoft.com site)

Topfi 2mo ago
Standard, Strict or Custom? Strict should block that one for sure, will check once at home.
- traceroute66 2mo ago
  I just double checked `about:preferences#privacy` is "Enhanced Tracking Protection: Strict" and clicking "Advanced Settings" confirms the radio button is indeed under "Strict". Firefox 153.0.4
  - Topfi 2mo ago
    Just saw the edit, all clicked now. As described this is expected behavior. The entitieslist (can't link right now because Github is down but got a local copy for some experiments) contains exceptions for owners of tracking URLs, in this case as a resource for Cloudflare.com and others owned by them only. Basically, because they are the same entity, they are considered one. Whether that could be communicated better by upstream, that's worth a discussion. Anyone besides Cloudflare.com has cloudflareinsights blocked. Here the specific entry for context from my local copy of ESR 153: { "entities": { "Cloudflare": { "properties": [ "cloudflare-quic.com", "cloudflare.com", "cloudflare.tv", "cloudflarestatus.com", "cloudflareworkers.com" ], "resources": [ "cloudflare.com", "cloudflareinsights.com", "cloudflarestream.com" ] } } } On a side note, spent a while learning how upstream Firefox works in-depth over the last few months, if ETP didn't block cloudflareinsights on pages outside Cloudflare.com I'd have lost any confidence build up and my project would likely linger even longer. Might just add a setting that totally excludes such exceptions if I can properly test it before release, seems there might be demand. Admittedly more for UX and honest communication clarity reasons (top setting truly prevents everything) then privacy, not the main goal of Hominis as a project.
    - traceroute66 2mo ago
      Yeah, I was trying to get hold of the list from Github myself before posting the edit. It is unfortunate strict isn't truly strict, but at least now I know. Thanks for that. Pending Github fixing itself, could you confirm if `browser.events.data.microsoft.com` is on your local copy ?
      - Topfi 2mo ago
        Yeah, agree, purely from a user expectation perspective, strict sounds like it'd suppress everything, not just third-party, especially with lower compatibility turned on. Yeah "browser.events.data.microsoft.com" is in, but mainly because it just ends up under microsoft.com anyways, subdomains are accepted inside the entitieslist. Here the full copy (initially wanted to share via Pastebin but some links triggered a spam filter): https://cdn.jsdelivr.net/gh/mozilla-services/shavar-prod-lists@e3dc3016f654286992ad51275585580e748bd379/disconnect-entitylist.json https://cdn.jsdelivr.net/gh/mozilla-services/shavar-prod-lis... If you or anyone else reading is interested, Mozilla has written some pleasant docs, lots to learn, easy to understand, comprehensive. Could not even consider what I am attempting without the resources they've provided: https://firefox-source-docs.mozilla.org/toolkit/components/antitracking/anti-tracking/tracking-lists/index.html https://firefox-source-docs.mozilla.org/toolkit/components/a...
cryptonym 2mo ago
cloudflareinsights.com seems to be part of their list. If you see unexpected tracking, it could be worth reporting it to Mozilla.
kg 2mo ago
I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections?
- traceroute66 2mo ago
  > I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections? I also daily-drive Brave and Mullvad browsers, both of which correctly block `static.cloudflareinsights.com` and I never have issues with Cloudflare sites.

Topfi 2mo ago

Standard, Strict or Custom? Strict should block that one for sure, will check once at home.

traceroute66 2mo ago
I just double checked `about:preferences#privacy` is "Enhanced Tracking Protection: Strict" and clicking "Advanced Settings" confirms the radio button is indeed under "Strict". Firefox 153.0.4
- Topfi 2mo ago
  Just saw the edit, all clicked now. As described this is expected behavior. The entitieslist (can't link right now because Github is down but got a local copy for some experiments) contains exceptions for owners of tracking URLs, in this case as a resource for Cloudflare.com and others owned by them only. Basically, because they are the same entity, they are considered one. Whether that could be communicated better by upstream, that's worth a discussion. Anyone besides Cloudflare.com has cloudflareinsights blocked. Here the specific entry for context from my local copy of ESR 153: { "entities": { "Cloudflare": { "properties": [ "cloudflare-quic.com", "cloudflare.com", "cloudflare.tv", "cloudflarestatus.com", "cloudflareworkers.com" ], "resources": [ "cloudflare.com", "cloudflareinsights.com", "cloudflarestream.com" ] } } } On a side note, spent a while learning how upstream Firefox works in-depth over the last few months, if ETP didn't block cloudflareinsights on pages outside Cloudflare.com I'd have lost any confidence build up and my project would likely linger even longer. Might just add a setting that totally excludes such exceptions if I can properly test it before release, seems there might be demand. Admittedly more for UX and honest communication clarity reasons (top setting truly prevents everything) then privacy, not the main goal of Hominis as a project.
  - traceroute66 2mo ago
    Yeah, I was trying to get hold of the list from Github myself before posting the edit. It is unfortunate strict isn't truly strict, but at least now I know. Thanks for that. Pending Github fixing itself, could you confirm if `browser.events.data.microsoft.com` is on your local copy ?
    - Topfi 2mo ago
      Yeah, agree, purely from a user expectation perspective, strict sounds like it'd suppress everything, not just third-party, especially with lower compatibility turned on. Yeah "browser.events.data.microsoft.com" is in, but mainly because it just ends up under microsoft.com anyways, subdomains are accepted inside the entitieslist. Here the full copy (initially wanted to share via Pastebin but some links triggered a spam filter): https://cdn.jsdelivr.net/gh/mozilla-services/shavar-prod-lists@e3dc3016f654286992ad51275585580e748bd379/disconnect-entitylist.json https://cdn.jsdelivr.net/gh/mozilla-services/shavar-prod-lis... If you or anyone else reading is interested, Mozilla has written some pleasant docs, lots to learn, easy to understand, comprehensive. Could not even consider what I am attempting without the resources they've provided: https://firefox-source-docs.mozilla.org/toolkit/components/antitracking/anti-tracking/tracking-lists/index.html https://firefox-source-docs.mozilla.org/toolkit/components/a...

cryptonym 2mo ago

cloudflareinsights.com seems to be part of their list. If you see unexpected tracking, it could be worth reporting it to Mozilla.

kg 2mo ago

I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections?

traceroute66 2mo ago
> I wonder if this is necessary for Firefox users to get past Cloudflare's various bot/scraping protections? I also daily-drive Brave and Mullvad browsers, both of which correctly block `static.cloudflareinsights.com` and I never have issues with Cloudflare sites.