Hacker News Reader

Comment by makeworld | Hacker News Reader

Hmm, my Pi-Hole blocks this. I wonder why.

    Exact matches for instant.page found in:
     - https://block.energized.pro/blu/formats/hosts.txt 
     - https://v.firebog.net/hosts/AdguardDNS.txt

View on HN

It’s due to bullshit from EasyList: https://github.com/easylist/easylist/issues/4023

You said it yourself:

> it’s a theoretical minor violation of privacy

Their goal is to protect privacy. It makes sense to me.

> theoretical

Like everything until it's used.

Then why doesn't easylist add google.com and facebook.com to their list? I'm sure G/FB track every single click you do on their pages. Huge privacy violation. Not even theoretical. Block youtube also, they are tracking your viewing habits, how much you watched, where you skipped, etc. Just block all this.

I wish there was a way to easily override individual entries in easylist/ubo.

Because those are services that people use and consent to (implicitly at least) violating their privacy. There's a huge difference between YouTube tracking my habits to improve my YouTube experience (as well as for marketing reasons) and a third party tracking them solely for marketing reasons.

Except it’s not bullshit. EasyList does exactly what they promise: privacy. Prefetching is always privacy issue because you don’t know what’s running on the server side. They will log what I’m looking at and which sites I’m probable to view next. That’s almost Amazon level on page tracking. I think I could probably build an invisible grid and use that script to track users more precisely, but I haven’t looked into it. Prefetching can be misused and therefore should not be allowed. And yes, it’s theoretical. So are XSS, CSRF, and others.

I'm sorry, but I'll gladly take 100ms of wait over a script fetching every link I hover over. There's a reason I disable stuff like DNS preloading in my browser and this is no different.

I can see how some website benefit from preloading everything, but if they should self-host the script (which won't get it blocked by EasyList) and leverage HTTP/2 Push to load the script in, instead of relying on an external domain that has full access to my IP and the URL I was visiting (through the Referer header).

To be clear, I have nothing against your project; it's just the centralized hosting that I don't trust. Unfortunately, you hosted the JS on the main page so the blocklist now also blocks your homepage; had you hosted the domain on a separate domain (cdn.instant.page) you wouldn't have had to deal with this. Because of the way links are generated, I don't disagree with the decision by EasyList though. Even if you did it by accident, you've created a tracker and that means you end up on tracker blocking lists.

This is such a shame. While I don't blame the people at EasyList, this is a huge drawback.

>huge

I'd estimate it's roughly a 1% drawback.

If you don't care about the extra privacy you could just not use EasyList.

If you self-host the JS, the script won't get blocked by EasyList. You can still use the project, you just need to disable your ad blocker to download the script from the main website.

Thank you for those lists!

Reply on news.ycombinator.com