3

I'm using Firefox 4 with the popular NoScript-Addon installed.

When I try to access StackOverflow, there is a red bar displayed at the top:

Meta Stack Overflow requires external JavaScript from another domain, which is blocked or failed to load.

To get rid of this bar, I have to whitelist the domain googleapis.com in NoScript. But I don't want to do this, as this will allow Google to track what I'm visiting on SO (by HTTP referrer, cookies and so on). Also there is no way I could whitelist this for SO only - any other website could use googleapis.com after that.

In short: Is there any way to use SO without googleapis.com?

Improve this question
7
  • 6
    ...this will allow Google to track what I'm visiting on SO (by HTTP referrer, cookies and so on). Are you sure? This sounds a little bit paranoid. As I can see it the browser will pull in the dependency without saying what it is for. I'd be surprised if Google would receive any other information then 55.126.77.89 requested the jQuery file.
    – Time Traveling Bobby
    May 30, 2011 at 13:38
  • 3
    @Bobby is correct. Google's jQuery sends the following Expires header: Thu, 24 May 2012 13:25:38 GMT. Unless you force a refresh, no new request will be made until then. It's not possible for Google to track your movements on the site (or any other site that uses Google's hosted jQuery) this way.
    – Pekka
    May 30, 2011 at 13:43
  • 1
    @Bobby there is a referer header when the browser pulls the file, though
    – Pekka
    May 30, 2011 at 13:50
  • 5
    I just did a wireshark capture: The header is always sent when you refresh the page in the browser (e.g. F5), and it includes the full SO-URL. This is nothing I want Google to know.
    – exo_cw
    May 30, 2011 at 13:52
  • 3
    @Pekka: True. I'm very surprised. This can be very easily deactivated, though, at least in Firefox. In about:config setting network.http.sendRefererHeader to 0 will kill the header (not sure with fire or not).
    – Time Traveling Bobby
    May 30, 2011 at 14:46
  • @exo as said, it does that only once, or not at all if jQuery has been loaded on another site. I think you're being paranoid.
    – Pekka
    May 30, 2011 at 15:15
  • 4
    Le gasp. Google will know you've loaded jQuery for the billionth time on the billionth website that uses it. I feel like that's a pretty small 'risk' to take.
    – Nightfirecat
    Oct 13, 2011 at 7:15

3 Answers 3

Reset to default
13

Short answer: No.

Long answer: If you can find a way to include jQuery in the document before the rest of the JavaScript is run, that'll work. Have a proxy that rewrites the request to instead go to a domain of your trust, for example, or maybe there's a Firefox add-on that does this.

You might not want to use Google to find something though; they'd know what you're up to.

Also, ajax.googleapis.com is a cookie-less domain; anything else would be stupid for a CDN.

Improve this answer
3
  • 1
    Thanks, I guess I will get used to that red bar.
    – exo_cw
    May 30, 2011 at 13:54
  • In Firefox it's as easy as setting network.http.sendRefererHeader to 0 in about:config.
    – Time Traveling Bobby
    May 30, 2011 at 20:12
  • @TimeTravelingBobby: Unfortunately, this no longer cures the issue :(
    – Seamus
    Jan 23, 2020 at 17:35
7

You could redirect googleapis.com to 127.0.0.1 via your local hosts file, and set up a lightweight HTTP server that will serve the few files that Stack Overflow needs. Or maybe there are servers out there that mimic the googleapis.com directory layout and that you trust to not track anything, so you can use them instead?

But you can't get around the fact that Stack Overflow needs jQuery.

Improve this answer
6

The RequestPolicy addon allows you to control specific combinations of domains.

I'm using it (along with NoScript, etc.*), but it's slightly tedious:

(A) If you want to enable a script that's included from another new site, you have to enable it in both RequestPolicy and NoScript.

(B) in the specific case of Stack Exchange, I use SE sites that have about half a dozen different domain names. So I have to specifically give permissions to each of them (if using RequestPolicy in the careful way that you and I desire). Segregating the different SE sites isn't protecting my privacy at all... "ping" alone will even tell us that stackoverflow.com, serverfault.com, and superuser.com all have the same IP address.

(IP address is not quite a guarantee of equivalency, if some users/admins are given access to some logs but not others. But. I'm not trying to hide from the SE universe! Only from being tracked across the Web or hacked by shady websites.)

*etc.: disabling Referer via "Change Referer Button" (and/or "RefControl"), and cookie control via "CS Lite (modified by wantora)", and some unrelated addons.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .