I wish all website would wait for the user to turn on social features before offering them. I'm not interested in any of them, the scripts shouldn't be loaded for nothing.
As a user I use uBlock Origin to block all 3rd party JS by default. This protects me from loading ads, social widgets(trackers), and trackers. A lot of the web is completely broken when you don't run 3rd party JS so each site requires a bit of whitelisting before it will function correctly.
As a website owner I try to lead by example by not including any 3rd party JS(or any JS at all for that matter). Specifically avoiding trackers from Google or Facebook.
Agreed. I use PrivacyBadger[1] to block the download of assets from third-party domains. That way I can selectively enable anything that I want from the blocked domains.
Heise now uses a new tool they developed called Shariff. Looks better imho and is easy to use. It also shows a like counter if you proxy requests to FB's Graph API through your server.
This tracking stuff is a plaque and I'm part of the problem. I run an unpopular site with random bits of information on it that uses AdSense to give me a few bucks a month and Disqus to allow comments.
Uhg. I really need to think about whether I want to be part of the problem.
somebody in the other thread mentioned https://www.discourse.org/ as an open-source alternative to disqus, although there were some people that downvoted it, so I don't know how good it is.
As mentioned in the article there was a related discussion yesterday, where removal of ad network stuff doesn't really matter since Disqus is used for comments:
I've removed all ad network code from my blog (troyhunt.com)
I'm reviving my blog, and currently plan to explicitly ask:
1. May we retrieve common libraries from third party CDNs? Doing so helps support this site by saving on our bandwidth costs, but may expose information about you to those third parties.
2. This site allows commenting through Disqus. We have no control over what Disqus does with your data, and so your information may be exposed to Disqus and any third parties they communicate with. Would you like to enable comments?
3. (Similar for tracking, if I decide to do something other than log parsing.)
Default 'no' to all, and I still need to find a way to ask the questions in a way that doesn't disrupt simply viewing a blog post that someone linked. Perhaps if someone returns, I'll prompt then.
Just code your site to do something sane with 3rd-party content blocked. E.g. handle load errors with fallbacks.
That way people with µMatrix or similar blockers can use the control tools they have instead of needing to do something site-specific.
Also, such decisions can't be remembered if cookies/localstorage are disabled. So prompting over and over again could also be annoying.
> 1. May we retrieve common libraries from third party CDNs? Doing so helps support this site by saving on our bandwidth costs, but may expose information about you to those third parties.
In an ideal world browsers would never send a cache-refresh request for resources tagged with SRI[0] because the hashes would guarantee that the content is 100% stable. Alas, it has non-trivial privacy implications, so they don't do that.
Maybe it could be implemented as a privacy addon with a whitelist for CDN domains, but then sites would still have to adopt SRI for that addon to do its work. Or maybe an addon that injects cache-control: immutable[1] to CDN could work too, but that's limited to https.
1. All local. Unless you don't want and a 100-200kb JS file is too much of a strain on your server bandwidth. Or are you serving 15Mb of JS files?
2. Screw Disqus. Screw Facebook Comments. Start thinking about your visitors, as someone said on another related thread, you are responsible for the tracking of your visitors by 3rd-party sites. Local comments or turn them off if you don't care about what others are saying. Don't save any information about the commenters except what they enter in the boxes. One-way hash the IPs if you need to compare for spam reasons.
3. If you need your ego stroked when you see you had xx visitors on your site, go ahead, use Google Analytics and screw us all. We're gonna block it anyway.
[1] This is a privacy policy I use and respect very much when interacting with the visitors/commenters on my personal blog.
1. If you're only interested in saving bandwidth and don't care about cache hits from overlapping with other sites, maybe you can host static content somewhere free (GitHub Pages?) or even just set a long cache header (ensure version numbers in filenames, cache for > 1 month) since presumably you're going to serve them the first time before the user has answered anyway?
2. I'm thinking of putting a "Click to load comments" box in place of Disqus on my blog so nothing gets loaded unless the user clicks. Seems better than bothering the user up-front.
3. I use Google Analytics - I figure it's common enough that if people don't like that, they'll already have it blocked, so there isn't really any additional tracking they won't want (unless the twitter timeline widget is tracking; which it might be, but I suspect I'll remove it soon anyway).
One of my early design decisions is to be as lightweight and fast as possible. This means no oauth, no ads, and only core features that you would expect to find in a comment system.
For me, the problem is that the smaller a service is, the less reputation they have to lose by screwing everyone over. I don't know who you are or that you won't inject ads or affiliate links into my site in a few months (or sell your domain to someone for a few quid that will). (This doesn't mean I think your intentions are bad; I just think it's a bad idea to trust people you don't know on the internet!).
I don't mind included scripts on my page from huge orgs that have a lot to lose by doing bad things but there aren't that many companies that fall into this (Disqus did, but possible shouldn't ;))
Sure, I just posted a link to make it easy to find their comment. I'm giving them the benefit of the doubt that this is an accident and they're working on it, but I'll believe they care when the fix is live and I can see it with my own eyes :-)
PrivacyBadger blocked his Disqus embed. I think a good test of whether your site/blog is privacy conscious is to see if PrviacyBadger reports any tracker.
TLDR: it was because Disqus added the Facebook SDK in the last week or so, for some new feature they're testing. They're looking into this.
^ That sounds legit to me... I believe this was the primary reason why Facebook made an SDK and Like button in the first place...for data mining. Pretty clever.
This is the consequence of building on a platform like FB, you exchange your visitors browsing habit data for access and FB expands their graphs of IP<>websites to improve their ad targeting. And with Disqus is won't be as obvious because the publisher might not be aware that it leads to an FB connection.
So regardless if it was unintentional this is a relevant story for the trade offs of using platforms.
I noticed the same thing about a week ago when I was setting up comments for my blog [1]. I hate bloated websites, so I copied the Disqus markup and opened up Chrome dev tools, and saw the Facebook URL along with dozens of other resources being loaded.
I ended up researching WAY too many comment systems, and eventually settled on Reddit. Not ideal, but better than all the alternatives.
Blog commenting is pretty broken right now, I guess due to the dominance of social networks. I wanted to write my own blog comment service in rage but thought better of it.
Disqus seems pretty sloppy. I was surprised to learn that they were an early YC company.
Ugh, thanks for this. I've made it a goal to start understanding all the little tricks and details of modern day tracking techniques that allow Facebook, Amazon, etc., to know everything that I do. Anyone know if there's a good one-stop-shop website for this topic? I've found lots of separate articles about the it but no central clearinghouse of information.
Some years ago I looked at Facebook's ToS for implementing "log in with Facebook" and at that time it looked like it precluded an implementation that would only send requests to Facebook if the user chose Facebook login. I don't think it's for sure that disqus could fix this problem if they wanted to.
[+] [-] Raphmedia|9 years ago|reply
Take a look at this way to do it: http://panzi.github.io/SocialSharePrivacy/
[+] [-] K0nserv|9 years ago|reply
As a website owner I try to lead by example by not including any 3rd party JS(or any JS at all for that matter). Specifically avoiding trackers from Google or Facebook.
[+] [-] __derek__|9 years ago|reply
[1]: https://www.eff.org/privacybadger
[+] [-] WA|9 years ago|reply
https://github.com/heiseonline/shariff
Would recommend this over their old two click social share. Your link is a fork of the old Heise tool. It looks dated on mobile.
[+] [-] dylanfw|9 years ago|reply
https://www.schneier.com/
[+] [-] em3rgent0rdr|9 years ago|reply
[+] [-] SkyMarshal|9 years ago|reply
[+] [-] codazoda|9 years ago|reply
Uhg. I really need to think about whether I want to be part of the problem.
[+] [-] em3rgent0rdr|9 years ago|reply
[+] [-] j_s|9 years ago|reply
I've removed all ad network code from my blog (troyhunt.com)
https://news.ycombinator.com/item?id=13326792
This included a screenshot of DoubleClick still being blocked on Troy Hunt's blog.
[+] [-] GrinningFool|9 years ago|reply
1. May we retrieve common libraries from third party CDNs? Doing so helps support this site by saving on our bandwidth costs, but may expose information about you to those third parties.
2. This site allows commenting through Disqus. We have no control over what Disqus does with your data, and so your information may be exposed to Disqus and any third parties they communicate with. Would you like to enable comments?
3. (Similar for tracking, if I decide to do something other than log parsing.)
Default 'no' to all, and I still need to find a way to ask the questions in a way that doesn't disrupt simply viewing a blog post that someone linked. Perhaps if someone returns, I'll prompt then.
Anyone have thoughts on if this sounds sane?
[+] [-] the8472|9 years ago|reply
That way people with µMatrix or similar blockers can use the control tools they have instead of needing to do something site-specific.
Also, such decisions can't be remembered if cookies/localstorage are disabled. So prompting over and over again could also be annoying.
> 1. May we retrieve common libraries from third party CDNs? Doing so helps support this site by saving on our bandwidth costs, but may expose information about you to those third parties.
In an ideal world browsers would never send a cache-refresh request for resources tagged with SRI[0] because the hashes would guarantee that the content is 100% stable. Alas, it has non-trivial privacy implications, so they don't do that.
Maybe it could be implemented as a privacy addon with a whitelist for CDN domains, but then sites would still have to adopt SRI for that addon to do its work. Or maybe an addon that injects cache-control: immutable[1] to CDN could work too, but that's limited to https.
[0] https://developer.mozilla.org/en-US/docs/Web/Security/Subres... [1] https://bitsup.blogspot.de/2016/05/cache-control-immutable.h...
[+] [-] maglavaitss|9 years ago|reply
1. All local. Unless you don't want and a 100-200kb JS file is too much of a strain on your server bandwidth. Or are you serving 15Mb of JS files?
2. Screw Disqus. Screw Facebook Comments. Start thinking about your visitors, as someone said on another related thread, you are responsible for the tracking of your visitors by 3rd-party sites. Local comments or turn them off if you don't care about what others are saying. Don't save any information about the commenters except what they enter in the boxes. One-way hash the IPs if you need to compare for spam reasons.
3. If you need your ego stroked when you see you had xx visitors on your site, go ahead, use Google Analytics and screw us all. We're gonna block it anyway.
[1] This is a privacy policy I use and respect very much when interacting with the visitors/commenters on my personal blog.
1. https://vox.space/pages/106/privacy-policy
[+] [-] d2p|9 years ago|reply
2. I'm thinking of putting a "Click to load comments" box in place of Disqus on my blog so nothing gets loaded unless the user clicks. Seems better than bothering the user up-front.
3. I use Google Analytics - I figure it's common enough that if people don't like that, they'll already have it blocked, so there isn't really any additional tracking they won't want (unless the twitter timeline widget is tracking; which it might be, but I suspect I'll remove it soon anyway).
[+] [-] foxhop|9 years ago|reply
One of my early design decisions is to be as lightweight and fast as possible. This means no oauth, no ads, and only core features that you would expect to find in a comment system.
[+] [-] ploggingdev|9 years ago|reply
My suggestion would be to make the design more appealing, it looks a little bland now.
And also promote the privacy oriented mission of the service a lot more. Currently there is no mention of privacy/tracking, you only mentioned no ads.
And https is a must in 2017.
Just a few question:
* When do you plan to launch?
* What is the backend built with?
Good luck man.
[+] [-] d2p|9 years ago|reply
I don't mind included scripts on my page from huge orgs that have a lot to lose by doing bad things but there aren't that many companies that fall into this (Disqus did, but possible shouldn't ;))
[+] [-] rsync|9 years ago|reply
It is possible for someone to say "hugs"[1] at the end of their discourse and still be a liar and a cheat and a terribly bad actor.
No idea, of course, about any of these people - but don't let cost-free, content-free expressions alter your (bullshit/fraud) detector.
[1] See comment on OPs blog from "disqus here"
[+] [-] d2p|9 years ago|reply
[+] [-] BYK|9 years ago|reply
I'm @madbyk on Twitter and you can also Google my full name to catch my other lies and bad acting on some of my recorded talks.
[+] [-] em3rgent0rdr|9 years ago|reply
[+] [-] d2p|9 years ago|reply
[+] [-] dmix|9 years ago|reply
^ That sounds legit to me... I believe this was the primary reason why Facebook made an SDK and Like button in the first place...for data mining. Pretty clever.
This is the consequence of building on a platform like FB, you exchange your visitors browsing habit data for access and FB expands their graphs of IP<>websites to improve their ad targeting. And with Disqus is won't be as obvious because the publisher might not be aware that it leads to an FB connection.
So regardless if it was unintentional this is a relevant story for the trade offs of using platforms.
[+] [-] chubot|9 years ago|reply
I ended up researching WAY too many comment systems, and eventually settled on Reddit. Not ideal, but better than all the alternatives.
Blog commenting is pretty broken right now, I guess due to the dominance of social networks. I wanted to write my own blog comment service in rage but thought better of it.
Disqus seems pretty sloppy. I was surprised to learn that they were an early YC company.
[1] http://www.oilshell.org/blog/2016/12/29.html
[+] [-] daurnimator|9 years ago|reply
[+] [-] jzl|9 years ago|reply
[+] [-] brlewis|9 years ago|reply
[+] [-] the8472|9 years ago|reply
Ads should be loaded into <iframe sandbox referrerpolicy="no-referrer">
It would still give them some information (affiliate ID and user IP) but no cookies or tracking of user interaction with the page itself.
[+] [-] rebuilder|9 years ago|reply
[+] [-] d2p|9 years ago|reply
https://blog.dantup.com/2017/01/visiting-a-site-that-uses-di...
[+] [-] unknown|9 years ago|reply
[deleted]
[+] [-] Spooky23|9 years ago|reply
[+] [-] sfblah|9 years ago|reply
[+] [-] grp|9 years ago|reply
Sort of a meta-tracker. But maybe I'm too paranoid.
[+] [-] pg_is_a_butt|9 years ago|reply
[deleted]
[+] [-] harmafelicia|9 years ago|reply
[deleted]
[+] [-] unknown|9 years ago|reply
[deleted]
[+] [-] rasz_pl|9 years ago|reply
most likely they are getting paid for this tracking
[+] [-] d2p|9 years ago|reply
[+] [-] balls187|9 years ago|reply