-2

I dislike running third-party scripts in my browser and have disabled these generally.

I can enable them on an exceptional basis, but it strikes me that Stack Exchange has an unusually heavy reliance on JavaScript code that's hosted externally, that is, on other sites.

In particular, much of Stack Exchange's functionality is dependent on scripts hosted at googleapis.com (although there are several other locations called out to).

Copied from External JavaScript code failed to load, the following functionality is dependent on external sites:

  • Adding comments.
  • Voting.
  • Controls (image, code buttons, etc.) missing from message posting form and the preview does not appear.
  • Automatic recognition that you are 'not a bot'.
  • Notify daily of new answers option.
  • ...

I find this annoying - I consider it to be a (mild) security/privacy problem.

But, also, it must cause problems with Stack Exchange's proper function. If such an external site is down: much of Stack Exchange's functionality will fail.

Can this be changed?

|improve this question
  • 8
    Just to make a note: sstatic.net, which might be one of the "other locations" you refer to, is an SE cookieless domain, so that would not be external. – waiwai933 May 27 '12 at 21:08
  • 2
    What do you propose as an alternative? – ChrisF♦ May 27 '12 at 21:13
  • obvious alternative would be locally hosted scripts? – Ronald May 27 '12 at 21:17
  • 11
    Most of these scripts are from Content Delivery Networks (operated by Google and SE to my awareness). There are major performance reasons this is done, local scripts just don't cut it for sites of this scale. – Ben Brocka May 27 '12 at 21:18
  • 1
    @Ronald meta.stackoverflow.com/faq#vote-differences – yannis May 27 '12 at 21:52
  • 3
    I agree with your sentiments, Ronald, but I guess there is not much to be done. Many people, especially in the US, have become very blunt to privacy issues. That's what happens to people who use their Apple machines to access Google services, I suppose. </fatalistic> – Raphael May 27 '12 at 22:02
  • 3
    @Raphael what is the privacy concern with using Google's CDN? Please explain. – Pekka May 27 '12 at 22:15
  • 6
    @Pekka: I don't know how CDNs work in detail. Every external script loaded from a big corporate domain is a red flag for me. What's quantserve.com? Why is googleapis.com needed? And google-analytics.com? I don't know, and I don't care. Imho, websites should be self-contained. If you want to use a CDN, fine, but please don't feed my data to the kraken. Another gem: microsoft.com is needed for data explorer, no less! – Raphael May 27 '12 at 22:22
  • 6
    @Raphael so big corporate names are evil, and small unknown names are not? That's a bit naive IMO. Anyway, there is no actual privacy/security issue when using the CDN, and there are good reasons for using it. Google Analytics and Quantcast are indeed problematic if you don't trust big business - due to their widespread use, they could track your movements across many sites. However, you can actively choose to block those services, and it won't impede your Stack Overflow experience. – Pekka May 27 '12 at 22:29
  • 2
    @Pekka: I have no reason to trust smaller companies any more, but as you correctly note privacy is at risk the more data a single player holds. The amount of data Google, for example, holds is frightening. Sure, I can block those services, but only because I am aware. Users that do not run script block addons won't even know they are being tracked. – Raphael May 27 '12 at 22:35
  • 4
    @Raphael that's true and I agree that's a problem. But the main thing that we're discussing here, Stack Overflow's use of the Google CDN to serve the core jQuery file, is not a privacy issue for the reasons outlined in the comments below. – Pekka May 27 '12 at 22:42
  • 4
    I suggest you stop going on the internets. That's the only way to be absolutely sure you are secure. Goodbye, and good luck! – user1228 May 28 '12 at 11:04
  • 2
    This kind of disrespectful comment comes from a moderator? Wow. – Ronald May 28 '12 at 21:38
  • 5
    Humour that's designed to shut down any further fair and open discussion - do you think that's funny? OK... be good to each other. – Ronald May 29 '12 at 9:35
  • 2
    I agree with @Ronald. SE sites are the only ones I frequent that break because of my browser's heightened security. The rest of the web has figured out how to serve content politely. And yes, there are terrible mods here. Stack Exchange is a perfect example of "gamification" gone horribly awry. – click_whir May 17 '13 at 4:19
19

No. Keeping the site fast (using CDNs with no cookies and long expiry times) for 99% of users far outweighs the importance of appeasing 1% of extremely persnickety users.

Graceful degradation only goes so far, and once you're at the point of appeasing people who don't want to run JavaScript code or third-party scripts you're looking into seriously degrading the experience while significantly increasing the workload and all to appease an extremely small, extremely problematic subset of users.

Unlike accessibility, you're being hard to support by choice. You shouldn't be surprised when the decision is made not to support you.

|improve this answer
  • 8
    Umm... I was just asking, but thanks. I'm not surprised really, but I am disappointed. I feel increasingly uncomfortable with Google tracking me across 95% of the web - so I choose to block them - and I've noticed very few sites (i.e. no other site that I use regularly) which lose all their functionality if I block Google. If that's not considered a problem here, and it obviously isn't, then fair enough. – Ronald May 27 '12 at 21:43
  • 3
    "and all to appease an extremely small, extremely problematic subset of users" -- so people concerned about privacy are "extremely problematic" for you. Huh. I guess you won't understand this caricature, then. – Raphael May 27 '12 at 22:04
  • 6
    @Ronald You are free to block whatever you want, but I don't understand your concern. Google CDN's jQuery file has cache-expire headers that are set one year into the future. That means that if a browser loads a file on the CDN for the first time today, it will not make any further calls to Google until May 27, 2013. How would they track you then? Analytics is a different matter - but you can block them separately from the CDN. – Pekka May 27 '12 at 22:13
  • 1
    @Pekka This doesn't seem to be correct. If the file does not need to be called, then why does the functionality break? It may be that I clear my cookies after the session (about the cache I'm not sure) – Ronald May 27 '12 at 22:30
  • 4
    @Ronald there are no further actual requests made to the Google CDN once the file is loaded. Hence it's impossible for Google to actually track your movements across pages that use a CDN file as you fear. But if you block the loading entirely, it will of course break because it can't fetch the CDN file even that one time. If you are worried about privacy, block Google Analytics and Quantcast (whcih you can do without problems). – Pekka May 27 '12 at 22:32
  • 1
    @Pekka Google Analytics and Quantcast are blocked, don't worry about that. Based on Google's privacy policy/attitude, it would be naive to imagine that they do anything other than permanently record information about time and frequency that data is downloaded from their own CDN, attached to as many personal identifiers as they have access to. I'd rather not even give them that information. – Ronald May 27 '12 at 22:45
  • 2
    @Ronald the amount of data they can collect this way is exceedingly small, but fair enough. FWIW, I support Ben's suggestion to have a local fallback. – Pekka May 27 '12 at 22:50
  • 3
    FYI: You're going to have a hard time avoiding Google's servers because they host a lot of JavaScript libraries on their CDN - and a lot of websites reference these (including a lot of my sites / apps / blogs / whatnot). – uɐɯsO uɐɥʇɐN May 27 '12 at 23:42
  • It is possible to at least host GoogleAPI scripts locally. It has been the only way I have been able to visit some (needlessly >_>) Google-heavy sites via a SOCKS proxy. – Luis Machuca Apr 24 '13 at 18:21
  • 3
    @ben-brocka I don't understand why you seem to think enforcing a naive security policy on 100% of your users is in any way appropriate? – click_whir May 17 '13 at 4:21
  • 3
    What's worse, Ben gives the idea that people who care about their own welfare ought to be treated as pests and worse than people who are just complacent. I definitively would not support such policy, or such kinds of expressions of policy. – Luis Machuca Dec 13 '13 at 0:40
  • 1
    That "1% of persnickety users" also includes every (non-VPN'd) user in China, btw. Which increasingly is not just local residents, but also business travellers (if that is even a relevant distinction, considering how dismissive this answer is of "certain" users.) meta.stackoverflow.com/questions/258288/… – michael Nov 1 '15 at 7:53
  • This made some sense at the time, but has been superseded by HTTP2. There is no longer a speed advantage to using an external CDN, and it's likely to be the other way around. – mc0e Sep 3 '18 at 12:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .