4 ms·

> Users are not tracked nor re-targeted Have a look at code delivered by Superfish: https://www.superfish.com/ws/sf_preloader.jsp https://www.superfish.com/ws

> Users are not tracked nor re-targeted Have a look at code delivered by Superfish: https://www.superfish.com/ws/sf_preloader.jsp https://www.superfish.com/ws/sf_preloader.jsp https://www.superfish.com/ws/sf_code.jsp https://www.superfish.com/ws/sf_code.jsp And grep for track and retarget. Just two snippets: var url = sfDomain + "trackSession.action?userid=" + similarproducts.b.qsObj.userid + "&sessionid=-10&action=ud_host_failed"; and: function isRetargetingEnabled(){ if( similarproducts.b.enableRetargetingUnit && !isRetargetingBlackList()){ return 1; } else{ return 0; } }

gabn 12y ago
LOL
omegaham 12y ago
Outstanding. It's like a ridiculous Law & Order episode where the defendant goes "I wasn't even in town that night." "So what's your face doing on all of these security cameras at the scene of the crime?" "... uh..."
- shpx 12y ago
  so just to be clear, because I find this hard to believe, they are straight up, 100% lying? Or is this taking some hash generating code out of context or something?
  - throwaway41597 12y ago
    It's hard to judge without digging into this spaghetti mess of files. But having the word retarget in your code seems like straight up lying to me. Tracking is more ambiguous a word and I couldn't find where they define the userid. But however it is generated, it reads like it's unique. And in order to retarget users, you'd have to track which products they've viewed in the first place, that would imply storing browsing history (they deny storing user info as well) and uniquely identifying users across websites. Given the coding style, I don't think the person(s) who wrote this code is/are doing anything clever other than what it seems.
- shpx 12y ago
  so just to be clear, because I find this hard to believe, they are straight up, 100% lying? Or is this taking some hash generating code out of context or something?
ThatGeoGuy 12y ago
Not to be too snarky, but I don't think I'd trust somebody who wrote that function to have code where one could "not find any evidence to substantiate security concerns." Perhaps this is some sort of style thing specific to javascript, but wouldn't: function isRetargetingEnabled(){ return (similarproducts.b.enableRetargetingUnit && !isRetargetingBlackList()); } be the better way to write it? Sure say what you want about micro-optimizations, but the function appears to be used in a boolean context, so shouldn't it just return the if condition? Things like this are why I have trouble trusting security claims. EDIT: Fixed double-negative
- samspot 12y ago
  I like your style better, but your function doesn't return 0 || 1 (yours returns true || false). I also wouldn't read too much into it. It's unlikely that the same person wrote all the code involved, and many smart people I know write these kinds of functions, no matter how much I complain about it.

gabn 12y ago

LOL

omegaham 12y ago

Outstanding. It's like a ridiculous Law & Order episode where the defendant goes "I wasn't even in town that night." "So what's your face doing on all of these security cameras at the scene of the crime?" "... uh..."

shpx 12y ago
so just to be clear, because I find this hard to believe, they are straight up, 100% lying? Or is this taking some hash generating code out of context or something?
- throwaway41597 12y ago
  It's hard to judge without digging into this spaghetti mess of files. But having the word retarget in your code seems like straight up lying to me. Tracking is more ambiguous a word and I couldn't find where they define the userid. But however it is generated, it reads like it's unique. And in order to retarget users, you'd have to track which products they've viewed in the first place, that would imply storing browsing history (they deny storing user info as well) and uniquely identifying users across websites. Given the coding style, I don't think the person(s) who wrote this code is/are doing anything clever other than what it seems.
shpx 12y ago
so just to be clear, because I find this hard to believe, they are straight up, 100% lying? Or is this taking some hash generating code out of context or something?

ThatGeoGuy 12y ago

Not to be too snarky, but I don't think I'd trust somebody who wrote that function to have code where one could "not find any evidence to substantiate security concerns." Perhaps this is some sort of style thing specific to javascript, but wouldn't: function isRetargetingEnabled(){ return (similarproducts.b.enableRetargetingUnit && !isRetargetingBlackList()); } be the better way to write it? Sure say what you want about micro-optimizations, but the function appears to be used in a boolean context, so shouldn't it just return the if condition? Things like this are why I have trouble trusting security claims. EDIT: Fixed double-negative

samspot 12y ago
I like your style better, but your function doesn't return 0 || 1 (yours returns true || false). I also wouldn't read too much into it. It's unlikely that the same person wrote all the code involved, and many smart people I know write these kinds of functions, no matter how much I complain about it.