3 ms·

While the shim idea is interesting, I suspect we could get a lot of privacy and working websites by hard-caching anything that even remotely looks like jquery a

by pdkl95 11y ago

While the shim idea is interesting, I suspect we could get a lot of privacy and working websites by hard-caching anything that even remotely looks like jquery and all the other well-known js libraries. (and do the same thing for fonts). It's trivial to implement - just ship a list of hashes for every published js library on all the popular CDNs (+ anywhere else that comes to midn), and if a HTTP request returns a file that matches one of those hashes, put that URL on a hard cache list. (it would be worht experimenting if wildcarding all query strings is feasible) The only UI change needed would be a menu option to flush the cache for any files associated with current page, so the user can simply reload any website that hasn't figured out how to version their js files. This method wouldn't fix everything, of course, but it would cover a lot. Additionally, it's easy to use, no copyright is violated (the user still downloads any cached file at least once - firefox would only ship hashes). and it would be trivial to extend in the future.

Qantourisc 11y ago
Wouldn't lying be a better option to protect from finger printing ? Like: "what font's do you have" and just return a generic list ?
- pdkl95 11y ago
  There isn't much to fingerprint when you cache a font or javascript library approximately forever. Of course it is a huge data leak to ever let the remote server enumerate fonts, but my ideas is attempting to accommodate the idea that interesting fonts can be used, while the only extra network traffic should be the font down load on first request. I acknowledge that it isn't perfect. Someone who is really determined could (and will) send HTML with unique URLs for every javasscript/css/whatever, effectively making a cache useless. That takes proactive effort on their part, though, and in the meantime there is a lot of low-hanging-fruit. For example, currently Google can track those of use that ban google-analytics at the router when we load any non-Google page that requests jquery fron Google's CDN. Limiting that to "about one" load to fill the cache would be easy and help in the short term..

by pdkl95 11y ago

Qantourisc 11y ago

Wouldn't lying be a better option to protect from finger printing ? Like: "what font's do you have" and just return a generic list ?

pdkl95 11y ago
There isn't much to fingerprint when you cache a font or javascript library approximately forever. Of course it is a huge data leak to ever let the remote server enumerate fonts, but my ideas is attempting to accommodate the idea that interesting fonts can be used, while the only extra network traffic should be the font down load on first request. I acknowledge that it isn't perfect. Someone who is really determined could (and will) send HTML with unique URLs for every javasscript/css/whatever, effectively making a cache useless. That takes proactive effort on their part, though, and in the meantime there is a lot of low-hanging-fruit. For example, currently Google can track those of use that ban google-analytics at the router when we load any non-Google page that requests jquery fron Google's CDN. Limiting that to "about one" load to fill the cache would be easy and help in the short term..