search

disconnectme / disconnect

Disconnect is a browser extension that makes the web faster, more private, and more secure.
https://disconnect.me/
GNU General Public License v3.0
781 stars 136 forks source link

log entry: XMLHttpRequest cannot load effective_tld_names.dat #291

Open dwt opened 10 years ago

dwt commented 10 years ago

Full error below:

XMLHttpRequest cannot load https://mxr.mozilla.org/mozilla-central/source/netwerk/dns/effective_tld_names.dat?raw=1. 
Origin http://localhost:8080 is not allowed by Access-Control-Allow-Origin.

I see this regular in my console which is quite annoying as I really want to debug my web apps and not disconnect.

Several Issues I have with this log message: a) it is not apparent that it is from Disconnect. b) Why do you try to load this file at all? Ship it with disconnect and make a new release if it changes enough. maybe c) Why do you try to load this file in a browser context that allows this to fail? You shouldn't try to load it in the context of the page if you really need to.

Browser: Safari Version 7.0.2 (9537.74.9)

discern commented 10 years ago

Second!

dwt commented 10 years ago

Any progress on this? I'd really like not to get my console spammed.

superawesome commented 10 years ago

I'll just note that since this connects to a 3rd party (mxr.mozilla.org), that party can easily farm that data. In an attempt to "disconnect" users from tracking, by referencing this file from a 3rd party the disconnect.me service is effectively creating a 3rd party tracker. Mozilla is not malicious in this way, but clearly this is a terrible precedent to set.

The mxr.mozilla.org service is also not intended to be used in this way, and there is a risk of access to this file getting cut off altogether due to abuse of the service.

The best solution is to pull this file into your own code rather than relying on a 3rd party service. However, if you absolutely must access this file remotely, a much better source is https://publicsuffix.org/list/effective_tld_names.dat. This is also hosted by Mozilla so it doesn't avoid the first (and IMO, bigger) problem of being a 3rd party, but at least it avoids the second.

(source: I work for Mozilla)

dwt commented 10 years ago

Yes please! Ship this file with the plugin and update the plugin if there are sufficient changes to warrant that.

I really do not want disconnect constantly accessing info on the web.