search

Roman-Port / Pebble-Appstore

My PebbleRipper appstore. The SQL API and app assets are not included.
1 stars 0 forks source link

Please make the store a bit more privacy friendly #1

Open IzzySoft opened 6 years ago

IzzySoft commented 6 years ago

I've just tried to access your store site, but the page simply didn't load. Finally figured the reason was it tries to side-load tons of stuff from different Google servers: JQuery, Fonts, etc. I avoid sites doing that, or try to circumvent that loading (so here, it was DecentralEyes replacing your JQuery locally, which collided with your "Same Origin" policy).

So may I suggest you localize those sources? Can't be that hard to provide them locally, from your own server. Fonts won't change that often, and keeping JQuery updated should be worth enhanced privacy.

Privacy is exactly why I selected the Pebble (never ran it with their companion apps, used Gadgetbridge from the first day).

Thanks in advance!

CennoxX commented 6 years ago

Using JQuery from the Google Hosted Libraries has the advance that people may already have cached it. So it is faster that way.

IzzySoft commented 6 years ago

@CennoxX Convenience ≠ Privacy-friendly. That little overhead for loading the JavaScript file once (after that it's cached as well) is nothing in comparison.

Another hint: Many of us "tin foils" with Firefox (or derivates) use the DecentralEyes addon, which then replaces JQuery with a local copy. Unfortunately, in case of the Rebble store, this does break; I could only make the page working by deactivating DecentralEyes for it. Wouldn't need to do so if the script were served from 1st party (RebbleStore itself).

So sorry, that half second speed gain on first load hardly justifies the privacy breach it causes. Especially with the "may" in mind – because if it's not in cache, there's no gain at all :wink: