Hacker News Reader

Comment by af3d | Hacker News Reader

Looks a bit like adware IMO. The library appears to be drenched in analytics. Dependencies include:

https://www.npmjs.com/package/web-vitals/v/0.1.0 https://www.npmjs.com/package/@fingerprintjs/fingerprintjs

Harvesting user's data, most likely...

Author here; some clarification. I use fingerprint to get the number of visits (instead of using something invasive like Google Analytics):

https://github.com/erikmartinjordan/jsonmatic/blob/master/sr...

I get the fingerprint as a UID (which is like a random number for me). I don't harvest any user's data. Code is open-source, you can verify what I'm saying if you wish.

Collecting usage statistics is harvesting data. This is a classic example of why you should never run random NPM modules. Or even install them as all of this is possible in a post install script too.

Putting analytics in a deployed app is your prerogative. Putting it in what touts itself as a reusable component is at best frowned upon.

Ok, I see your point. I update the website.

This commit deletes any kind of data harvesting (removes fingerprint and visit counting):

https://github.com/erikmartinjordan/jsonmatic/commit/7f3fa89...

web-vitals is still there. What is it used for? https://github.com/erikmartinjordan/jsonmatic/blob/f926f197b...

It comes by default on React apps, it’s not used for anything.

It looks like there is some confusion of what it is. The content you see in linked page is the the software not a demonstration of how the library output looks. If it was a library taking in bytes and outputting bytes I would agree that it shouldn't depend on any analytics, but if it's a website that's more of authors choice.

There's nothing wrong with web-vitals...

There's nothing wrong with web-vitals, and it's included in create-react-app, which the author used.

I agree, though for the sake of argument Facebooks tolerance for tracking and fingerprinting far exceeds anyone else’s on the internet so their stamp of approval for web vitals is meaningless.

But there is much wrong with finger printing.

How did you figure this out?

The page has a link at the bottom to the GitHub project where you check the dependencies...

Yes but it’s not a library. It’s an entire website. It even uses Firebase.

Reply on news.ycombinator.com