Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

691–700 of 786 posts

Re: Firefox 85 cracks down on supercookies

#691

Post by ekianjo »

scrollaway wrote: post #586
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

> It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development.

And wasted zillions of man hours to relearn the latest web framework every 2 years. Good job JS. We all love you.

Re: Firefox 85 cracks down on supercookies

#692

Post by aarchi »

ogre_codes wrote: post #294
abcd_f wrote: post #68

Per-site caching negates the principal selling point of centrally-hosted JS and resources, including fonts. The convenience remains, but all speed-related perks (due to the resources being reused from earlier visits to unrelated sites) are no more... which is actually great, because it reduces the value that unscrupulous free CDN providers can derive from their "properties". It also means that I can remove fonts.goog…

> It also means that I can remove fonts.google.com from the uBlock blacklist. Yay. If you are downloading fonts from Google, Google harvests your IP and likely the referring site from the request. Even if your browser doesn't sent the referrer, many sites have a unique enough font-fingerprint that Google can figure out where you are.

Would this bypass most Google Font tracking? An extension that makes Google Font requests on behalf of the requesting site and caches the response indefinitely and for all sites, somewhat like LocalCDN/Decentraleyes, but on demand.

Re: Firefox 85 cracks down on supercookies

#693

Post by ogre_codes »

aarchi wrote: post #692
ogre_codes wrote: post #294

Earlier quoted context omitted.

> It also means that I can remove fonts.google.com from the uBlock blacklist. Yay. If you are downloading fonts from Google, Google harvests your IP and likely the referring site from the request. Even if your browser doesn't sent the referrer, many sites have a unique enough font-fingerprint that Google can figure out where you are.

Would this bypass most Google Font tracking? An extension that makes Google Font requests on behalf of the requesting site and caches the response indefinitely and for all sites, somewhat like LocalCDN/Decentraleyes, but on demand.

That would prevent Google from getting every request.

FWIW, I'm not sure how much of an issue this even is. My comment was a hypothetical. Sadly the way Google/ Facebook/ etc operate, I just assume that whatever I think of, they've already done it plus 1000s of other things which would never occur to me.

Re: Firefox 85 cracks down on supercookies

#694

Post by andrewflnr »

scrollaway wrote: post #683
andrewflnr wrote: post #682

Earlier quoted context omitted.

I think that asking users "do you want to let this site run JavaScript?" would have been an acceptable trade-off in availability.

Look up alert fatigue.

I've heard of it, actually. I don't think that's a good reason to enable JavaScript by default any more than it's a good reason to give webpages access to my camera, microphone, and filesystem by default.

Re: Firefox 85 cracks down on supercookies

#695

Post by Zardoz84 »

PaulHoule wrote: post #122
abcd_f wrote: post #68

Per-site caching negates the principal selling point of centrally-hosted JS and resources, including fonts. The convenience remains, but all speed-related perks (due to the resources being reused from earlier visits to unrelated sites) are no more... which is actually great, because it reduces the value that unscrupulous free CDN providers can derive from their "properties". It also means that I can remove fonts.goog…

That idea of having JS files hosted elsewhere always struck me as a Girardian scam (e.g. "everybody else does it") and always getting voted down when I showed people the reality factor. Nobody seemed to think it was hard to host a file before this came along, just as nobody thought it was hard to have a blog before Medium. Of course this creates the apocalyptic possibility that one of these servers could get hacked (…

We at some point, we where retrieving some javascript (jQuery) and fonts dependencies from a CDN. At the end, we need that change and include all in out web application as we saw all kind of problems... Like that someone trying to use behind a intranet or not working fine when it's accessed a develop version behind a weird VPN. Or that funny moment when a CDN get down and simultaneously a lot of our webs get half broken.

Re: Firefox 85 cracks down on supercookies

#696

Post by emptyparadise »

scrollaway wrote: post #684
emptyparadise wrote: post #675

Earlier quoted context omitted.

Applications can exist outside of the web too.

That's not my point. You wouldn't have had the development speed we've had the last 30 years. You wouldn't have had the same amount of devs. The same pickup on the web. The same worldwide connectivity. Javascript is one of the, if not the, most influential technologies of the past 100 years. It changed the course of history. Can you say the same of, like, wxWidgets or whatever UI toolkit you'd be using for your nativ…

>Javascript is one of the, if not the, most influential technologies of the past 100 years.

That's... one hell of a claim.

Re: Firefox 85 cracks down on supercookies

#697

Post by zwkrt »

newscracker wrote: post #91

Use uBlock Origin, Multi Account Containers, Privacy Badger, Decentraleyes and CookieAutoDelete with Firefox. Make sure you aggressively clear cache, cookies, etc., periodically (with CookieAutoDelete). You’ll probably load the web servers more and also add more traffic on your network, but it will help protect your privacy since most websites don’t care about that. When websites are user hostile, you have to take pr…

If you’re doing all that it seems like a lot of cognitive dissonance to keep using the internet. It is optional, you know!

Re: Firefox 85 cracks down on supercookies

#698

Post by 2Gkashmiri »

nofunsir wrote: post #611
scrollaway wrote: post #586

Earlier quoted context omitted.

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

I agree with simias. What does JS have to do with my VPN? What was wrong with Skype? Still beats the pants off others for quality. I cannot think of much good agressive whitespace, hamburger menus, infinite scrolling, HID hijacking, copy-paste preventing, trackers etc, etc etc, has brought us, besides into the world of Aggressive Ad Arbitrage. Need https://motherfuckingwebsite.com/ be mentioned? The real powerhouse w…

946ms for me. has google analytics

Re: Firefox 85 cracks down on supercookies

#699

Post by fauigerzigerk »

emptyparadise wrote: post #675
scrollaway wrote: post #586

Earlier quoted context omitted.

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

Applications can exist outside of the web too.

Yes but if it was „incredibly naive“ to download and run JavaScript in the browser sandbox how naive would it have been to download and run native code outside of any sandbox?

The browser runtime is what enabled us to use software provided by a huge number of developers of varying aptitude and motivation without putting in place some centralised gatekeeper with its own vested interests.

Post reply on HN