3 ms·
I just looked at the source of the page: A) external CSS which might leak about a visitor to Google B) <!--~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
by chinathrow 11y ago
I just looked at the source of the page:
A) external CSS which might leak about a visitor to Google
B) <!--~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
No Google Analytics or other 3rd party hosted script tags on Keybase.
And this has the added bonus that we'll never be able to serve ad code.
\o/ \o/
chris max
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~-->
No 3rd party JS: good.
Still leaking visitor info: bad.
- malgorithms 11y agohah, I forgot about that note. Good point - our stance was to protect from targeted code injections (by a coerced or hacked Google). But of course you're right, there's no point letting Google know at all. I've made an issue to move font/css hosting off Google.
- chinathrow 11y agoThank you very much - great reaction.
- brandon 11y agoYou might also consider setting Content-Security-Policy headers to enforce your intent. http://content-security-policy.com/ http://content-security-policy.com/