Hacker News Reader

Comment by mrspeaker | Hacker News Reader

I think if the next few years are going to be entertaining. At the moment a handful of shitty companies are abusing their ability to track users - but for me (and I think for many non profit-affected nerds) the outcome seems clear: ANY AND ALL third-party script have to go.

Even when that means losing all the third-party goodness (CDNs, analytics, cloud providers...) that we've come to depend on. Yep, they save an uncountable amount of time and effort - but at the cost of tracking users' every step... We can't have one without the other!

View on HN

Honestly, if all third party scripts are blocked, the ad networks will just start making their participant sites serve the javascript direct and/or run local applications to proxy the data back to them. And unfortunately most management will force the changes through, because they want in on that ad revenue gravy train.

This is much harder to do, especially in larger enterprises where changes can take months. This includes updates and bug fixes.

If this is where we push the industry, it will be a huge win for users.

I'm willing to bet that IF this happens it'll amount to a lot of companies just including something like this on every page:

    <?PHP echo(file_get_contents("http://google.com/nefarious_crap.html")); ?>

Correct, one method is via a subdomain to serve the 3rd party through. Bummer is when it’s mixed with data so blocking it isn’t as straight forward.

There is nothing inherent in any of those that require tracking. Nor scripts that run in the browser.

Third-party should not be the qualifier here.

Cloudflare's CDNJS sets, by default, crossorigin=anonymous and subresource integrity. Add a "Referrer-Policy: no-referrer" header, and all the CDN sees is either a) nothing, because the client has the resource cached or b) a request for a certain version of jQuery without knowing where it came from.

If you think this is a good idea because it enables technical enforcement, do you also want to ban static.example.com? Because if you don't, you'll soon have pointstothirdpartyadserver.example.com. If you do, you'll have https://example.com/proxytothirdpartyadserver/ instead...

This is not a problem that can be completely solved on a technical level. Enforce the hell out of GDPR and see the problem shrink.

It sounds like mitigating the CDN problem could be done like what the Decentraleyes browser addon does: replacing CDN hosted files by local versions.

What are the difficulties for a browser to provide such a feature by default?

You need to decide which CDN files to ship locally, you need to store them, do the initial fetching, etc.

There is already a system for all of that. It's called the browser cache.

Reply on news.ycombinator.com