Hacker News Reader

Comment by proactivesvcs | Hacker News Reader

Two steps in the right direction, but this one page still sends requests to soundcloud.com, rawgit.com, cloudflare.com, googleapis.com, amazonaws.com, fontawesome.com, sndcdn.com, stackcommerce.com, stackassets.com, stacksocial.com, and gravatar.com.

Their "self-hosted" Plausible content is pulled from tics.techdirect.com, which resolves to 46.101.161.209 and shares a reverse DNS with custom.plausible.io. Can't tell who runs the web server on the other end of this, so it may well be self-hosted.

The site also dropped a first-party one-year cookie, and let a third party drop a week-long cookie.

My browser is set to send Do Not Track requests, so my explicit wishes are still being flagrantly ignored.

There is still a lot of third-party tracking going on here, as well as execution of remote code under the control of third parties. It's remains a privacy and security clusterfuck but it's better than it was.

View on HN

> ... rawgit.com ...

Wait, they're still serving things via rawgit? They started shutting down in 2018! That service has been deprecated for three years. That sounds like an attack that is just waiting to happen.

> GitHub repositories that served content through RawGit within the last month will continue to be served until at least October of 2019. URLs for other repositories are no longer being served.

> If you're currently using RawGit, please stop using it as soon as you can.

Fire and forget mentality. Wasn't long ago that some advert video hosting site's domain was taken into new ownership to host porn. It must take a lot of effort to integrate all this third-party garbage into a site. If only a site's security was given a similar effort.

I can easily see that after 2 years there is nobody left who remembers what APIs are in the code.

I am not surprised at all. Technical debt, periodic refactors or security analyses are very low on the list of things that get rewarded, and shiny new projects are high. That's until a security incident takes place, then people are reprimanded and things will be okay for a month or two.

Until that's fixed, things like this will keep being commonplace.

> My browser is set to send Do Not Track requests, so my explicit wishes are still being flagrantly ignored.

I have a dollar that says most websites you visit do not respect this setting unless they don’t use trackers at all.

Only a dollar? I'd put my life savings on that bet

> Can't tell who runs the web server on the other end of this, so it may well be self-hosted.

That looks like it's Plausible's "they host it" system.

Who is “they”?

plausible.io

The fact that it took Techdirt, A site which supposedly is read by all leading Big Tech CEOs this long to do away with Google Ads shows how helpless nascent independent writers who have a fraction of audience of that of techdirt are when it comes to monetization without Ads.

I'm myself in that category, I know that my blog has enough visitors to break even at least the running cost with Ads but I could not pull myself to do it when I personally hate Ads, Feel its disrespectful to attention and go all the way to ensure I don't see one(Pi-Hole, UBlock etc.).

My content are distributed randomly across several interests and I don't have regular schedule due to health reasons so a patreon wouldn't work. Paypal donations are blocked for my country. So the best bet is 'Buy Me a Coffee' but then I have to pay both Stripe + BMaC commissions, I have to register a business to be able to get International payments on Stripe anyways.

So a direct stripe payment or similar PG is the only option to monetize open content for this scenario and since tax id is involved due to Intl. payments it's not a donation.

I've never minded reasonable ads, but I don't want tracker ads and cookies. I know people who produce good content deserve at least a chance at making a buck, I just don't want to sacrifice my privacy for it though. So serve up ads related to the article content or generic random ads I suppose.

I agree, But advertising agencies which offer advertisements without tracking are negligible because their competition produces more conversion so obviously advertisers flock to them. Services like ethical ads are available only to select large open-source projects as the advertisers target niche audience.

Affiliate links when the content isn't exactly a review of the said product/book (to avoid conflict of interest) do work in this context to some extent. But the current referral system is a mess with each product/service tying up with different middlemen or having their own system, arbitrary approval, payment issues, publishers gaming the system etc.

I have started to track the need-gap for 'Single referral system for all services' on my problem validation platform[1].

[1] https://needgap.com/problems/274-single-referral-system-for-...

I agree, I think this is why tracking/cookies that do so should be illegal. Then at least the big guys like google will stop doing it. You'll never stop all of it though.

I don't think it's reasonable to expect non-giants to self host a CDN

How much do non-giants really need one? Sure, they have their advantages, but are we really at the point where every website absolutely requires their use?

Depends on what you mean by 'absolutely requires'. With search engines now emphasizing mobile experience and load times, CDNs are more necessary than ever if a site wants to appear/rank in search results.

Isn't self hosting actually a huge legal cluster fuck liability? And as much as I hate Google I think they have better security practices than most websites out there.

A CDN? If you load JavaScript from it, then it has about the same "power" as a server hosting the HTML of a static site. So yes, there's some potential for misuse, but unless you're implying that hosting your own website is a bad idea from a liability perspective, I'd say it's safer to host your own JS instead of using multiple CDNs as many sites do.

FTA

> are now using both Plausible and Matomo (self-hosted),

Is it possible they only meant self hosted Matomo, not Plausible?

Is that DNT deprecated?

It's still an option in my modern Web browser. A site admin can choose not to track me if they wish - my software is making my wishes clear and in according to a standard.

Worth noting that the spec was abandoned in part because enabling it actually makes you more likely to be tracked. It's another datapoint that can be used to fingerprint your device.

Another major reason that the spec was abandoned was that no one could agree on what "tracking" meant, and so what "respecting DNT" would even mean.

If there were legal basis for that header saying "let me use your website without being tracked" and the website owner having to do so, then it would be worth it to enable it - but, in practice, having it enabled becomes a fingerprint datapoint, and since 99% of traffic doesn't have it enabled, it becomes a pretty reliable one.

I leave it enabled out of the principle, and as a data point. Every person who has such a feature enabled is sending a message: we do not want to be tracked. It's a blip in the dark, but you can't stop the signal.

I'm much happier with the GDPR idea where tracking is not allowed by default and the website has to obtain informed consent first. Of course in practice the implementations still need to be improved - both through enforcement (many of the consent dialogs are not legal), through additional standards and legislation to require them (you should be able to set your browser to automatically deny all requests) and through continuing to shame companies and individuals for their excessive tracking (at least the consent dialogs tell you about the extend now).

Nah. People who use certain browsers are sending DNT by default and do not even know it is the case or even what is means.

That behaviour is certainly not software making their wishes clear in the matter.

I think if you'd ask most people if they want to be tracked they'd say no. Of course you could word things differently or promise benefits to manipulate the answers, but just for "do you want to be tracked" the answer will typicall be NO - and some more progressive privacy laws like the GDPR recognize that by making no tracking the default.

Setting DNT to true by default is certainly more in line with user's wishes than the previous assumption by the tech industry to just grab whatever info they can.

A standard that practically no one cares about and is actually used by others as another flag to identify you since most people don't have it turned on. Ideology is great but on the web some of us choose to be pragmatic.

> gravatar.com

That's not tracking right?

I doubt Automattic runs Gravatar for free out of the goodness of their hearts. It can track in two easy ways: firstly the user that requests different avatars, as they move through the web and different sites, and secondly the users whose avatars are requested, as to what services they use. Their privacy policy allows for this at a quick glance.

Personally I proxy Gravatar requests through my web service's backend to get rid of the first type of tracking.

According to their own privacy policy the information they collect and share (read sell) includes "online identifiers", internet and network activity, device activity including cookie information, "other device identifiers", IP addresses, and geolocation data

Neither firefox nor adblock origin are blocking it here.

DNT does not mean no cookies.

Reply on news.ycombinator.com