If you have a website where privacy is absolutely essential, you should NEVER include any third party content.
I find it unfathomable someone needs to say that.
I find it unfathomable someone needs to say that.
With a question as sensitive and personal as “am I transgender or not and how would I know,” it’s deeply important to me that visiting my website won’t accidentally get my users into trouble, even indirectly through tracking or federated cohort ad targeting.
- The only JavaScript is that which is necessary to run the site;
- The site only listens on HTTPS;
- There are no cookies;
- I explicitly opt users out of FLoC to prevent other sites targeting ads to my users based on my site’s content;
- I use a third-party hosting provider that only supplies aggregate passive server logs for a 30-day rolling window, which only shows me the domain name of the Referer, so I can’t know exactly where my users came from.
No JS is required to 'run' a site. I can and do use Hackernews without ever requiring JS to be enabled. Everything works via POST, it's quick and simple.
Yes. A Non-JS world is painful, and there are many difficulties, but ensuring your site works with noscript would do the world a huge favor.
But yeah, that’s certainly a bit of a novelty.
But I think "this site doesn't use JS so it must be safe" is...a really bad assumption.
My post above was concerned most of all with privacy, and the only scripts are for page rendering, they’re hosted from my domain, and they make no network calls. Bytecode in, DOM nodes out, all on the user’s device.