Scripts question

Post Reply New Topic

It figures that googleanalytics.com would have that kind of function. I seem to see it on practically every website I visit.

I feel like I'm on the horns of an ethical / privacy dilemma here. On the one hand, I want my visits to be counted in an anonymous way if it's useful to Wrong Planet (I would say "useful to Alex," but I get the impression that he's unofficially left) - I guess the value would be that WP can send the numbers to the advertising sponsors to keep the funding coming in. I can't see much wrong with that. On the other hand, Google may say that they operate a watertight privacy policy, but can they be trusted? I mean, just look at this:

http://gizmodo.com/5895010/the-case-against-google

There's also a bit of a problem with allowing that particular script, because of the way NoScript works. You get the choice of temporarily or permanently allowing any script you want. If you temporarily allow it, then you have to do that every time you open Firefox and visit WP. So it's tempting to permanently allow it, but if you do that, then practically every site you visit that uses it will also run that script, so you do rather need to be sure that you can trust Google. And if there's any truth in that article, I rather fancy that you can't. Though I'm willing to sit back and listen to any arguments to the contrary.

I think a lot of these issues could be avoided if these "offshore" scripts weren't used so much. Is it really so difficult to run statistical counters etc. in-house, without involving these companies over which the actual website has no control?

Here's my response to everything thus far. It all boils down to trust - presumably WP has included these scripts in the design of the page because they trust that these scripts are necessary for the proper functionality of the site, and are safe to include (precluding, obviously, any malicious code that gets inserted via third parties - which as far as I can tell isn't an issue in this particular instance). This code then gets passed to your browser to execute on your behalf, so ultimately you either choose to execute these scripts or you do not.

Fair assumption.



cloudflare runs scripts in the browser mostly to determine if the browser is actually capable of running them. Assumption being that most bots will not have javascript engines, or if they do they will be lacking certain functionality.



Can't speak to these.



My guess is that this is a random subdomain that changes on a regular basis - I would guess that the intent is to sniff out exactly your use-case - whether or not someone has a browser plugin that selectively allows javascript.



Can't speak to these.



Both of these domains are associated with google's advertising platform.



This does exactly what you think it does.



Google Analytics is a service google provides to website owners to track how users engage with their websites.



Google provides a bunch of other services (maps, youtube, etc). All of them would have scripts coming from this domain.



Cloudflare's security requires that they test the ability for the user's browser to be able to do things that typically only browsers are able to do, executing javascript being one of those things. As the browser is only there to render content for the user, there is no good way to do this transparently.



It's true that google analytics gives website owners valuable information, but you're naive to think that google would offer a free service to people without some potential gain for themselves. That gain is twofold: 1) google is able to use the google analytics platform to push site owners to use google's advertising platforms due to tight integration. 2) google is able to use the information from google analytics to compile useful statistics from the web at large. All of the data that comes out regarding which browser is more popular, or what mobile OS has more web usage, or which screen sizes are most common all come out of data feeds like google analytics. Make your own determination whether you're ok with that or not. I, personally, see no problem with it.



The short answer is "yes". It's extremely difficult for site owners to build their own analytics platforms, not to mention ad delivery, integration with third party services (Facebook, twitter), etc. And there are some real, tangible benefits to being able to track user activity across multiple websites. In my opinion, tracking web traffic on the web is not practically different from retail rewards programs using consumer data to craft advertising campaigns and collect statistics. The "enemy", if you will, comes from the ability to run arbitrary code in the user's browser for all kinds of malicious purposes (malware, spam scripts, etc).

I'm quite well aware - Please give me some credit - I tried to avoid telling the OP that, since now he's going to break out the tin-foil hat.

Yes. The problem here for me is that I trust Wrong Planet pretty well, but I'm not so sure that I trust the people that Wrong Planet trusts.

Depends what you mean by malicious code, I think. Is telemarketing, or keeping a database of citizens' personal details, without the target's consent, malicious? Advertisers and Big Brother governments don't particularly wish to harm anybody, but they have a reputation for putting their own agenda before our well-being, which oftan amounts to the same thing.

Well, you have the choice to consent or not if you happen to know about scripts and script blockers. Otherwise you don't, and even if you're in the know, it can be quite difficult to find out which scripts are good and which are bad.

Yes, though as we've discovered, one can get by without it for the most part.

Interestingly, as Tallyman pointed out, this script can be blocked without loss of access to WP. So how come cloudflare doesn't think my browser is a bot?

Hmmm........
http://www.viglink.com/
"Powering content-driven commerce. VigLink is the platform on which site-to-site clicks are
priced, bought, and sold." Sounds a little risque to me, though for all I know the only effect of blocking it could be to cost WP money. I get the feeling that I'd need a degree in e-commerce to understand what that place is up to.
http://www.scorecardresearch.com/Home.aspx
Well, the description is at least layman-friendly, and they claim they don't collect personal information. Can we believe them, and if so, can we be sure that they will never change tack without telling us?

You mean like a NoScript detector? Well, I guess if they know I've got a script blocker, they're less likely to put me on a sucker list. Or am I totally misunderstanding this?

gosquared says it's a Web analytics service.
I've just found this about quantserve.com:
http://www.theguardian.com/technology/2 ... monitoring
"Quantcast uses the measurement and insight data help companies find people to target with their advertising." If targeted advertising worked properly, I'd have little concern about it, but in practice so far, it always ends up shoving ads in the faces of people who don't want them. Frankly I resent companies treating people as passive "targets." If I want something, I'm perfectly able to get off my butt and actively go look for it.

Sounds like a must to avoid then.

Yup. A dummied-down way of sharing WP stuff on mainstream social media sites etc. Personally I find the buttons distracting - if the mouse goes over one, a menu jumps out at me. But it's all a matter of personal preference I guess.

That one has aroused enough concern to prompt Google to offer its own opt-out:
https://tools.google.com/dlpage/gaoptout?hl=None
Only problem is that it's made by Google. I guess they'd be in deep trouble if it didn't do what it said on the tin, though I've noticed before that when it comes to privacy invasion, the Gov seems reluctant to nail the culprits, so I think I'll just block it with NoScript.

Yes, Google gets everywhere, doesn't it?


Makes sense. I've seen websites that display a 5-second countdown like that, and if you don't allow the relevent script (usually the one with the same name as the website), the countdown doesn't start. I often wondered why they did that. I suppose it would be a bit silly to let the user continue while the checking ran in the background, because a bot could do a lot of damage in 5 seconds. And I guess if it tried to do the test invisibly, it would look like a system hang and confuse people.


As you say, it's a matter of trust. Which is unfortunate because I'm a man of little faith, so I generally try to take reasonable, calculated risks. Trouble is, simple questions such as "what do these scripts actually do? Are they harmful?" have led to complicated answers. I don't see any great harm in the Google activities you've listed in the above paragraph, but I don't think they can reasonably be trusted to resist the temptation to go further, given their somewhat tarnished reputation. Better safe than sorry. Yet there's still the ethical problem of potentially harming the money side of WP, and I have no data about that.


I get that it's going to be hard to run a website without offsetting the costs via advertising sponsorship. But you think that tracking user activity across multiple websites has benefits?

I'll give you an example of why I'm suspicious of such tracking and big business in general. Not long ago I saw the word "twerking" for the first time, and not knowing what it meant, I googled it. So far, no problem. Next time I visited YouTube, it brought up a (somewhat) pornographic video clip which had the word "twerking" in its title, complete with a rauinchy still from the clip. Whatever you may think of soft porn, the thing is that I don't like it being pushed at me, and that it was pushed at me because of a tracking system which had assumed that anybody typing the word "twerking" was fair game for an offer of porn at the click of a button. Another time, I googled the phrase "never be rude to an Arab," and for my troubles I was entreated to "buy n****r jokes on Ebay." I don't believe that such an item was on sale. I typed "cigarette smoke" into the search engine and was also offered that commodity too. I'm sure all these sites have beautiful mission statements about honesty and privacy, but my experience is that they don't really mean it. And these are big companies, not sleazy little backstreet charlatans.

Naw, I'll just keep blocking it with NoScript. Tinfoil hats give you cancer.

Sure. If I'm going to look at ads on websites, the least they could do is try to make them ads for stuff I could conceivably want to buy.

But it goes further than this - I want to know things like which mobile OS is most popular globally - and to get an accurate picture of what that is really like I have to participate in the collection of that data.

And there are tons of applications outside of marketing as well - if you go from one website protected by cloudflare to another, they're able to correlate that across web domains and you might not have to go through as much scrutiny the second time.

And the reality is that we are being tracked just as much offline as we are online - no one complains when a store has security cameras, even though those systems can be used to determine when and where you are. No one thinks twice to sign up for a retail rewards program or store credit card to save money, even though those programs feed everything you buy into a database to determine what products to sell you with coupons.

The fact of the matter is that companies are spying on you for one simple reason: to sell you stuff. I have no problem with companies trying hard to sell me stuff that I actually want to buy.

I just find it all too invasive of my privacy. If I want to buy something I'll research it myself then go in search of a good deal. I grew sick of advertising when it became too much in my face - flashing adverts, sound based adverts. BUY BUY BUY. YOU'VE WON XYZ CLICK HERE FOR DETAILS NOW!! ! I have a problem with flashing (or even animated) adverts, they take my attention and I can't focus on what I'm trying to read (this may be autism related). Also some adverts position themselves in pop up windows on top of what I'm trying to read. Up until recently I was stuck with slow dial-up internet access in this remote rural location and if I'd allowed adverts to display, they would have gobbled up most of my bandwidth with their graphics.

The second thing I've got against adverts is they sometimes push malware. I take the view that the less that runs in my browser with the exception of what I actually want to see, the better. So I use NoScript and Adblock Plus. I even block flash most of the time too as that often has security vulnerabilities allowing malware to propagate. Strangely a few websites seem to be built entirely in flash... in that case rather than enabling flash I close the window and go to another/competitors site.

Ah, that's the difference between our preferences. I haven't seen many Web ads for a long time, apart from ads masquerading as social posts on Facebook, the login screen of my email account that kept showing me a picture of an ipad and telling me to get into their new lines, and those stupid Amazon searches which insert irrelevent items that get in the way, just because I've looked at something like them before. My philosophy is that I target the suppliers when I decide that I want something. I can see an upside to being accurately and respectfully targetted, but I don't think it's been properly sorted out yet, and maybe never will be, and in the meantime, I doubt the benefits would outweigh the annoyance factor, the distraction and wasted time. I can approach suppliers all by myself.



Can't you get that from the sales figures? I'm happy to supply some personal information of that kind, but my prices are likely to be high.

5 seconds a day isn't a lot to me.

I'm used to them but I don't think I'm alone in feeling uncomfortable about them. And they don't use the footage to follow me about suggesting I think again about the stuff I've looked at but walked away from.


I've resisted loyalty cards so far. The management of the local store made its checkout staff ask every shopper if they had one, and if not, whether they wanted one, for some months. I used to hate that, like a broken record. If you hit the button quickly on the self-checkout these days, you don't have to hear the robot voice asking you if you've swiped your loyalty card. I've heard they the store doesn't pay customers a very high proportion of the money they make from them.


If there's something I want to buy, I'm happy to include them as a source of information, but it can be laborious sifting out the persuasive tricks from the hard facts, and the opinions and experiences of existing users are more valuable to me.

There's a question on an Aspie questionnaire that asks "if you are distracted, does it take you a long time to resume what you were doing?" I said yes for that one. I can't concentrate on a movie that has sign language, just can't screen out the guy waving his arms around. Anything moving near the screen has the same kind of effect.