Hacker News Reader

Comment by blauwbilgorgel | Hacker News Reader

You can try to combat a part of this by installing Ghostery. It will block a lot of these third-party requests. As a website owner you could link to the share page, instead of loading the widgets, or load the widgets only after the user requests them.

As for those server logs, I understand they record my movements, but I don't think it is my right to stop them from doing that. The one who owns the server/web property should be allowed to analyze requests to that server. This can get icky though in the case of major CDN's.

You could choose not to keep server logs as a search engine (forgoing DOS protection), but then what happens when a user clicks on an advertisement? Privacy seems only as strong as the weakest chain.

View on HN

Ghostery, the last time I checked it out was closed-source, subject to control or influence by advertisers, and reporting to the vendor about users' browsing. Clearly lots of people like it, but I would consider it gross breach of my security policy.

My recommendation for anyone who's serious about controlling his/her online footprint is Request Policy. It's open source and simply blocks requests according to user directions - you can put it on a whitelist or blacklist basis, and decide for yourself what servers to contact from each page. Of course this is too inconvenient for most people, but it gets asyptotically less troublesome as the list is perfected.

Ghostery doesn't default to phoning home, last time I installed it.

1. Closed-source javascript is not a thing, and Ghostery's code is very readable.

2. Technically, anything is subject to influence by third parties, but I'm quite certain you possess zero evidence that Ghostery is actually influenced by advertisers. Implying that Ghostery might do something nefarious at the behest of advertisers (based on nothing but personal paranoia) seems maliciously disinformational.

3. Ghostrank is opt-in by default. You have to intentionally check a box that plainly says you agree to send "anonymous statistical data" to them.

The source is not just very readable, we make it publicly available for review. Here are some links: - AMO: https://addons.mozilla.org/en-US/firefox/files/browse/254748... - Chrome: https://www.ghostery.com/ghosteries/chrome/

We are most definitely not influenced by third parties, if anything, companies now contact us directly to provide their registration information for monitoring by Ghostery. Additionally, we keep the database changes public here: https://www.ghostery.com/en/database/changelog

FYI there is also Disconnect.me (Open Source see Github) and the EFF Privacy Badger (also Open Source)

That's one of the advantage of my extension, HTTP Switchboard [1], over many others out there: it shows you everywhere a web page tries to connect -- and then let you act on what you find. First step is being properly informed. It also shows you behind the scene connections (those from other extensions or the browser). Anything that goes through webRequest API is reported.

[1] https://github.com/gorhill/httpswitchboard

Ghostery is an excellent piece of software but it caused me a few issues. For instance I logged in to my bank and couldn't view any statements. It was Ghostery blocking something so I whitelisted the site. Not a big issue but it took me some time to realise it wasn't a problem with my bank's website.

I went on to uninstall Ghostery because I was worried the unpredictable behaviour it introduces might cause some frustrating issues, particularly when going through a process like filling out a long online form only for it to fail at the end.

> Not a big issue but it took me some time to realise it wasn't a problem with my bank's website.

Actually, it likely was. Your bank probably did not realize it but depended on some external component blocked by ghostery being loaded. I've seen the weirdest cases of this, such as one instance where a missing function in some javascript code was fixed for backwards compatibility in an ad-tag served by someone else...

So disabling the ad tag caused the site to fail with a javascript error.

In general, a banking website should work A-Ok with ads disabled and if it does not it is likely not Ghostery that is at fault but the bank (if only for not testing that their site works with ghostery or adblock installed).

I've also seen behavior like this with NoScript. Sometimes it's a total crap shoot as to which functionality works/doesn't work when you enable/disable certain scripts.

Use EFF's Privacy Badger. Easier to deal with when problems appear.

https://www.eff.org/privacybadger

I use a more radical step: browse in incognito mode all the time. No cookies survive a browser restart. If you have a fast connection, the cache is actually makes your browsing slower. As for the "convenience" of being logged in all the time on the sites I visit, I would rather not. Coupled with a dynamic IP, they can't correlate any of my traffic and search data.

> Coupled with a dynamic IP

How dynamic is your IP really, though? My "dynamic" IP from Comcast will go unchanged for months or even years (I think the last time it changed was when I replaced my modem about a year and a half ago).

Give RefControl a try as well, it blocks the HTTP "referer".

You could use this little bookmarklet as well:

http://lee-phillips.org/norefBookmarklet/

Reply on news.ycombinator.com