These "broken" firewalls are becoming increasingly common. Besides that, IE8's private browsing mode automatically blocks Google Analytics and similar tracking

These "broken" firewalls are becoming increasingly common. Besides that, IE8's private browsing mode automatically blocks Google Analytics and similar tracking services (and ad networks?). Look for that to be increasingly common in web browsers that care more about the end user than they care about advertisers. By the way, what was "broken"? In this case, everything worked out fairly well for everybody except the website owner and Google, who are likely indifferent to the negative result. Google Analytics doesn't provide any functionality to the user so it doesn't matter to him if the script fails to load or not. The page probably loaded a little faster and his web browser is probably using a little less memory. He probably also got to preserve just a little bit more privacy. The IT team that deployed the firewall got paid to do so and plus they can feel good knowing that their firewall is probably blocking some actual XSS attempts. That reduces IT costs for the company. The manufacturer likely got paid a lot of money for the firewall and the sales guy probably made a nice commission on it.