Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Twitter loads some javascript file from edgecastcdn.net and twimg.com. The browser blocks these loads because they are from third–party domains which is a big risk. Loading a script from a third party exposes anything secret or private on the page to the third party. Of course twimg.com is _probably_ owned and operated by Twitter, but it could be anyone. They’re not even registered through the same registrar, they have different registrant information, etc, etc. One is reported to be in Arizona, the other in California.

This is exactly how information about you is leaked to advertisers. Maybe the scripts you load from those third–party domains are harmless, or maybe they send everything you see and type back to the third party.

There is javascript on the page that detects the failure and puts up the error message blaming the browser. Really the browser is taking a completely legitimate action, and Twitter could get around it by simply hosting all of their javascript on the same domain that you visit. If you visit x.com it would load javascript from x.com. But if you visit twitter.com, it would load the same javascript files from twitter.com urls instead. Or twitter.com could just redirect you to x.com. Either way, the problem would be solved. But by asking you to turn off strict browsing mode, it enables Twitter to load javascript from real third parties that just want to advertise to you.



Strict tracking protection mode does not block third party JavaScript. Are you referring to another extension you have enabled?


Yea, I simplified that a bit. It blocks specific third–party domains that are known to host advertising trackers.


Of course twimg.com is _probably_ owned and operated by Twitter.

https://www.whois.com/whois/twimg.com

Looking at the registrant email confirms that it is. I've seen the twimg domain a lot as it's used for their images (pbs.twimg.com) too.


I know, I was being slightly sarcastic. But on a serious note there’s nothing about the registration info for x.com that indicates that it is owned by twitter.


It’s certainly owned by them at the moment


Kinda like the same issue with running zoom in browser and not having a persistent login session

https://devforum.zoom.us/t/stay-signed-in-doesnt/63329/3


Can users whitelist select domains that are "trusted"?


What are some tools/techniques that one can use to figure out the above using Firefox?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: