Hacker News Reader

Comment by nikcub | Hacker News Reader

this shouldn't be hosted on the cloudflare.com domain. since I am a customer every request sends my cloudflare session cookie and a bunch of Google Analytics cookies.

Not only is it 2.5KB of extra header info sent, but I don't think cloudflare should know which websites their customers have been visiting.

View on HN

Yeah, that is an odd decision. Makes you wonder if the “secret” motive of CloudFlare in hosting this, other than to promote their service, is to track and analyze your visitors.

I don't see a privacy policy on CDNJS.com. I'd definitely like to know what data they collect about my visitors and what they do with it.

At least the CDN doesn't itself set any cookies.

Honestly, I don't think that it is some conspiracy to track me, rather it was just a mistake. Perhaps I am not cynical enough.

If anything this would only work on other cloudflare users (like people who logged in to cloudflare). Most users won't have any cookies on that domain.

There's nothing to stop them setting cookies in the responses down the track though. Wait until you've got enough users, then one day just switch on your 3rd party multi-site user tracking. Or perhaps less publicly dicoverable, use browser fingerprinting and ip address correlation to do the same thing with somewhat less accuracy, but completely invisibly.

And note too, that if you're relying on a 3rd party to serve javascript your users are going to run in their browsers - if that 3rd party isn't trustworthy, you're screwed in much worse ways that cookie tracking privacy violations. Who'd notice if they started occasionally serving a modified version of jQuery which sent all form field keydowns (aka, your usernames and passwords) back to theselves?

This is way too paranoid. CloudFlare are a reputable company; they're not blackhats.

I think my comment above was too paranoid, as well, but it's too late to edit. All I was suspicious of was that there might be analysis going on.

Following the money will especially help in this situation.

How does CloudFlare make its money? It's a CDN company. I mean, that's the CORE of what they do. What is jsCDN? It's a CDN.

A simpler theory is that hosting a Javascript CDN (and demonstrating that it's even better than Google's, which is amazing), is going to provide a lot of free advertising for their product. If I use their CDN for JS and it works really well, I'm likely to go back to them for hosting other things, because using jsCDN is almost like doing a free trial of their actual CDN.

It's not even like their main form of income is in another industry that we have to make a cognitive leap to see what their ulterior motives are. It's precisely this. CDNs.

Dude, as a good cdn will set cache headers to make browsers store the items forever, without even re-validating content.

Definitely not very useable for tracking purposes, they will only know about first visit of a user. Even more if sites a and b use the same js library and version, they will only know about the first that a user visit.

Anyway is a bad technical decision not to use a different domain to ensure clients don't need to send extra cookies in the headers.

Microsoft just changed their CDN url because of this: http://www.asp.net/ajaxlibrary/cdn.ashx

Though for the most part, people will not have cookies set on the domain unless they have visited the main site (i.e. they are developers).

Could you set up a CNAME on your website that points cdnjs.mycompany.com to cdnjs.cloudflare.com to solve this (for your site visitors)?

Or would that mess up cloudflare's anycast DNS?

Wouldn't the browser still send cdnjs.mycompany.com in the Host: header and break the page?

that is exactly what happens. the server isn't setup to respond to requests to the cdnjs.mycompany.com hostname and it returns a 409 error.

Ah, thanks for the info. Damn virtual hosts!

There is no cookie information (CloudFlare, Google, or otherwise) sent for requests to CDNJS resources.

In addition the reason to host this on single domain vs your own site is that the users only have to download the resource once it once for all the sites they visit.

the first thing I did is request backbone.min.js and open the web console to check the response time. looked at the request, saw cookies:

http://i.imgur.com/Qqzc3.jpg

Reply on news.ycombinator.com