Decentraleyes – Local CDN Emulation
decentraleyes.org
decentraleyes.org
Edit: After re-reading this multiple times, I don't think this wording is helpful. There should be a transparent description of what this extension offers before users navigate to download and install options.
> Websites have increasingly begun to rely much more on large third-parties for content delivery. Canceling requests for ads or trackers is usually without issue, however blocking actual content, not unexpectedly, breaks pages. The aim of this add-on is to cut out the middleman by providing lightning speed delivery of local (bundled) files to improve online privacy.
I agree that it's a very weird frontpage and means of describing an extension, but you don't need to run their code before reading what the extension does.
It should have a description on their own site, not rely on one in an app store. I wouldn't even click on that until I'm convinced I want it.
In fact I didn't, I saw the page, was like "???" and then went to the comments here to read what this was about ;)
But yeah I always wondered what Google does with all these calls to the javascript libraries they're hosting... I bet they milk them for data somehow. It's a good effort but I'm not sure I'll install it as I already have so many plugins in Firefox that it constantly complains about slow startup.
[1] https://git.synz.io/Synzvato/decentraleyes/-/tree/master/res...
The only thing I wish for is to add my own entries.
https://codeberg.org/nobody/LocalCDN
Its a fork from decentraleyes with some more libraries included.
But recently I learned something unexpected. Lots of extensions are terrible with their resources. On a page targeting tech-savvy people, around 1% of requests has some extension content injected into the website which requests an external font file. (info comes from CSP reports) There's so much tracking opportunity exposed through them.
I don't think it matters for performance because it's cached in the browser anyway... So the purpose of the extension is privacy.
So this might be a performance gain too
https://stackoverflow.com/questions/29704811/why-isnt-the-br...
* example.com -> GET cdnjs.com/jquery
* another.com -> GET cdnjs.com/jquery (not cached from example.com)
No caching of the CDN assets between sites within the browser, regardless of HTTP caching headers.
> It comes bundled with a fair amount of commonly used files, and serves them locally whenever a site tries to fetch them from a delivery network.
The docs, both on the site that is linked to and on the wiki is extremely bare bones, but the gist of it is that a CDN can track you through the `referer` header of the request for (say) jquery, since even if the browser has jquery already cached it will send out a request to check if the resource might have been modified.
> What does it do to protect me when it has no choice but to allow a request?
> Even if a resource is not locally available, Decentraleyes offers improved protection by stripping optional headers from intercepted CDN-requests. This keeps specific data, such as what page you are on, from reaching delivery networks. Whitelisting a domain does not affect this measure.
https://git.synz.io/Synzvato/decentraleyes/-/wikis/Frequentl...
> Sadly, no. Even if the file in question is stored inside of your cache, your browser might still contact the referenced Content Delivery Network to check if the resource has been modified.
https://git.synz.io/Synzvato/decentraleyes/-/wikis/Frequentl...
Of course, this should be super explicit and opt-in, but Mozilla is in a position where a lot of people would trust them (you can agree or disagree whether that trust is misplaced) and if the goal is privacy and/or saving bandwidth on poor connections, this could be very useful.
From a security standpoint bundling is not an issue as no additional requests are made but from a speed and performance standpoint I don’t think there is much extensions like this or browser caching can do. It kind of makes me wish bundling wasn’t a thing now that we have QUIC/HTTP3 being adopted.
With all that said I am still glad to have this extension around.
[1]https://git.synz.io/Synzvato/decentraleyes/blob/b3931febc234...
EDIT: refs
https://codeberg.org/nobody/LocalCDN/issues/51
I wonder when we’ll see a real browser alternative that includes no-brainer features like bundling the most common libraries in local forever-cache by SRI hash.
– Recent trend appears to be bundling resources (e.g. Webpack) instead of using CDNs.
– This trend is complemented by browsers moving to per-site caches that limit the benefit of CDNs.
– Content-Security-Policy and/or Subresource Integrity restrictions can break some websites.
– Only a limited set of resources are included with Decentraleyes.
All that said, this is a really cool idea from both privacy and performance standpoints. Would love to see ways to address those limitations in the future.
Make sure to read the directions, though, to integrate properly with uBO/uMatrix.