Hacker News Reader

Comment by ahelwer | Hacker News Reader

My blog (ahelwer.ca) uses Hugo hosted on gitlab pages; I notice that privacy badger flags two trackers on it, cloudflare CDN and google fonts. I'm assuming gfonts is because the Hugo theme I'm using uses a google-provided font and cloudflare CDN is there because it's automatically added by gitlab or something; anyone know how you can create a completely tracker-free experience? Do you basically have to stand up your own webserver on a cloud provider (or at home)? I guess without cloudflare or some other CDN you'd also have to hope your server can handle serving all the traffic directly. Or would a different static site generator like pelican help?

View on HN

You should add a CNAME record for the www subdomain. As it stands now, appending "www." results in a server not found. Browsers append that automatically sometimes.

The cloudflare CDN is there because your theme includes "auto-render.min.js" and "katex.min.js" from cdnjs.cloudflare.com. They are in script tags in your homepage HTML. You can verify this with: > curl -L ahelwer.ca | grep 'auto-render.min.js'

You can check my domain if you want an example of a CNAME record: > dig CNAME www.jeremypoole.ca

I am also using Hugo, I modified a theme called "coder".

As far as avoiding trackers, it would depend on what you mean by tracker. In your case, the external requests are for fonts and a couple of JavaScript dependencies. You could easily host those yourself instead of using the CDN, and then there would be no third-party HTTP requests.

As a fellow .ca HNer, I would gladly help you out. Feel free to hit me up.

GitLab Pages also apparently needs a TXT verification record for the subdomain as well, otherwise it'll serve a 401. (GitHub Pages does not seem to require this.)

I host my blog on netlify.com, works great and automatically builds on git push. Instead of cloudflare CDN they use their own CDN network.

I also use Netlify. On the free tier of Netlify a site is deployed to 6 points on the Netlify Edge CDN (Frankfurt, Singapore, San Francisco, New York, Sao Paolo, Sydney, Moscow as of August this year, but it might have changed).

On the free tier of Cloudflare a site is deployed to 194 locations. That can knock a couple of hundred ms off of a page load time. It might be worthwhile if you need something to be especially fast.

That said, Cloudflare is much more of a hassle to set up. Netlify is ludicrously easy. That's one of the many things I like about it.

Why is Cloudflare more of a hassle? Point your nameservers to them, done.

I use Cloudflare in front of Netlify.

Step 1: set up on Netlify

Step 2: add the domain on Cloudflare and let it grab the DNS entries Netlify made

Gitlab pages doesn't inherently use trackers - See link below showing Privacy Badger for my page that's also built with Hugo. Your trackers probably come from your Hugo template, I had to edit the template to remove them.

https://otekeng.gitlab.io/privacy_badger.PNG

You could get your own hosting, and not use Cloudflare. You could then host the font on your own site.

My site doesn't load any files from a different domain since I removed the Twitter share button javascript[0], except for one page.

I moved the mailchimp signup to a separate page to isolate their JS code to just that page.

[0] https://tacosteemers.com/articles/2020-08-30-twitter-share-b...

To add to my answer:

If we depend on other people's hosting and themes then we just kind of have to accept what they offer.

But getting our own hosting doesn't have to be difficult. There are many cheap providers that give sftp access, for example. Pelican comes with a script for uploading to sftp.

> You could then host the font on your own site.

Only if you have a licence for it — font licences are typically prohibitively expensive for individuals' use.

All Google Fonts are open-source.

That's ... interesting. I must admit, I think somewhere in the back of my mind I knew that, but I'm so used to font services requiring to be used remotely, I hadn't even really considered that. So there's absolutely no breach of any kind of law or terms if you host them locally? That could be a game-changer, thanks!

So there's absolutely no breach of any kind of law or terms if you host them locally?

Open source doesn't necessarily mean free to use for whatever you want. Which licence a font on Google Fonts uses varies - common ones are Apache and Open Font Licence, but you should check the licence file in any font pack you download.

You can 'npm install' any of the google fonts, there are a variety of options like webpack plugins. The only thing you miss out on is apparently they serve slightly different variants to different OS/device types if you use google directly.

Personally, I avoid third-party requests. CDNs are so HTTP1.1.

The licenses used are quite liberal, so pretty much. (I'm not a lawyer)

I quick look on what happens, it would seem cloudflare is used to load katex.js

You may be able to disable this in the theme config if you don't use it.

Ahhh thank you, looks like that's used to render MathML, which I do use. Perhaps I can add katex.js to the git repo and serve it from wherever it is gitlab hosts their websites.

I'm no hugo expert, but that's likely possible. After all, the JS files are static content. You can probably modify the theme's template to load the js from the origin.

I guess the whole point of using cloudflare as the cdn is so that people can reuse this from cache.

That's an interesting trade-off. I guess static sites are small enough that downloading an extra script wouldn't be terrible, by modern heavyweight website standards. Still, maybe I should look into what cloudflare CDN actually does with its data.

I use pelican-katex plugin to render math once during website generation, and then not have to load the katex.js file at all. Only a katex.css file and fonts loaded from my own server.

https://github.com/cqql/pelican-katex

The google font issue is obviously down to you, but GitHub pages doesn't add anything that gets flagged by Privacy Badger.

Thanks for this question, it allowed me to tune some of the cloudflare optimizations I didn't need (Rocket Loader) and remove the dependency for the script pull and thus the tracking flag with privacy badger! I hadn't even thought to check if my own site met my own personal bar/criteria for trackers and ads!

Your posts seems to highlight why I'm wary about these extractable site generator things - it appears that people much smarter than I use them out of the box but don't really peer into that box, so end up with queries like yours.

Whereas dumb people like me hand code a site and keep small chunks of code or 'boot strap' type folders where we can re-use old assets quickly and with the knowledge of exactly what's in them.

I don't use Hugo, etc, but it seems odd to me that it's not abundantly clear how to nix CDN and Google asset references from the site generation code.

No disrespect intended, I've just never enjoyed all the tinkering that comes with managing this stuff myself. I just want to write & publish my posts somehow; used to use medium but then they added all these popups and annoying things, so I switched to Hugo. Now, it might be a good stepping stone to eventually just setting this all up myself, since I've been frustrated with the limitations of markdown & hugo shortcodes and occasionally just want to write things in HTML (yes I know you can write HTML in hugo markdown pages). But I never would get to that stage straight from hosted blogs like medium, so it is good that static site generators exist I think.

No disrespect assumed! :) tbh, when I see people using things like Hugo, i tend to assume they're on a part of the web dev spectrum that is equal-to or further-along than mine. This my failing. I made assumptions about your situation. I just tend to assume that people default to things like Wordpress when they need to exist in that hinterland between publication and bother.

Perhaps I need to look into these things a bit more!

> I don't use Hugo, etc, but it seems odd to me that it's not abundantly clear how to nix CDN and Google asset references from the site generation code.

All static site generators do is take a bunch of inputs (markdown files, templates, config, images, etc.) and process them to output a directory of HTML and assets. It's usually trivial to do a search on the input side and identify the source of the problem code. Commenting it out and reprocessing results in it being removed.

You only run into complications when there is some odd dependency between the static site generator and the inputs. Generally, it'll delegate everything to the templates it uses (good separation of concerns), but sometimes there is a weird config option, or convention you are supposed to use.

Static site generators are really useful for ongoing projects with new pages being added all the time. I hand-roll my discrete "here's a page for a thing" sites, and use SSGs for things like blogs, classes, etc., stuff where I might just decide to add a page when I'm sitting on a train, and would like to just be able to type it out in markdown on my phone, push a commit, and have it appear.

Reply on news.ycombinator.com