Cloudflare – Open Thinkering

Sort-of breaking up with Cloudflare

Posted on July 18, 2020July 18, 2020 by Doug Belshaw

Cloudflare provides a few services which a lot of the web relies upon. The ones I have been using are free, namely…

1. Content Delivery Network

A content delivery network, or content distribution network (CDN), is a geographically distributed network of proxy servers and their data centers. The goal is to provide high availability and performance by distributing the service spatially relative to end users.
Wikipedia

In other words, a CDN speeds up your site for users, protects you site if it suddenly becomes popular, and can notify you if your site is down.

Cloudflare was down yesterday for a time, and it made me realise that I don’t really need it for my sites. So I removed it.

2. DNS resolution

A DNS resolver, also known as a resolver, is a server on the Internet that converts domain names into IP addresses.
When you use the Internet, every time you connect to a website using its domain name (such as “computerhope.com”), your computer needs to know that website’s IP address (a unique series of numbers). So your computer contacts a DNS resolver, and gets the current IP address of computerhope.com.
[…]
The DNS resolver contacted by your computer is usually chosen by your ISP (Internet service provider). However, you can configure your network to use a different DNS provider, if you choose. This configuration can be modified in your operating system’s network settings, or in the administration interface of your home network router.
Computer Hope

Although I have an awesome, trustworthy ISP, I’ve used a DNS resolver for years. Recently I switched from using Cloudflare’s 1.1.1.1 service locally on my machines, to using 1.1.1.1 for families on our home router. This blocks both malware and adult content.

I’m going to keep using Cloudflare’s DNS resolver for now as it’s useful, fast, and it’s clear that they make their money from upselling to their VPN services.

This post is day nine of my #100DaysToOffload challenge. Want to get involved? Find out more at 100daystooffload.com

Practice what you preach

Posted on June 16, 2020June 15, 2020 by Doug Belshaw

I spend a lot of time looking at screens and interacting with other people in a mediated way through digital technologies. That’s why it’s important to continually review the means by which I communicate with others, either synchronously (e.g. through a chat app or video conference software) or asynchronously (e.g. via email or this blog).

When I started following a bunch of people who are using the #100DaysToOffload hashtag, some of them followed me back:

@dajbelshaw you have a really beautiful site that doesn't open for me. First it's not compatible with LibreJs and then uMatrix block Cloudflare's ajax and you'll not get further than loading screen.

I know that some people are quite hardcore about not loading JavaScript for privacy reasons, but I didn’t know what ‘LibreJs’ was. Although uMatrix rang a bell, I thought it would be a good opportunity to find out more.

It turns out LibreJS is a browser extension maintained by the GNU project:

GNU LibreJS aims to address the JavaScript problem described in Richard Stallman’s article The JavaScript Trap. LibreJS is a free add-on for GNU IceCat and other Mozilla-based browsers. It blocks nonfree nontrivial JavaScript while allowing JavaScript that is free and/or trivial.

Meanwhile uMatrix seems to be another browser extension that adds a kind of ‘firewall’ to page loading:

Point & click to forbid/allow any class of requests made by your browser. Use it to block scripts, iframes, ads, facebook, etc.

Meanwhile, the extensions that I use when browsing the web to maintain some semblance of privacy, and to block annoying advertising, are:

So just running the tools I use on my own site leads to the following:

Privacy Badger found 18 potential trackers on dougbelshaw.com:
web.archive.org
ajax.cloudflare.com
assets.digitalclimatestrike.net
www.google-analytics.com
docs.google.com
play.google.com
lh3.googleusercontent.com
lh4.googleusercontent.com
lh5.googleusercontent.com
lh6.googleusercontent.com
licensebuttons.net
www.loom.com
public-api.wordpress.com
pixel.wp.com
s0.wp.com
s1.wp.com
stats.wp.com
widgets.wp.com

Disconnect produced a graph which shows the scale of the problem:

Graph produced by Disconnect showing trackers for dougbelshwa.com

This was the output from uBlock Origin:

Output from uBlock Origin for dougbelshaw.com

It’s entirely possible to make a blog that involves no JavaScript or trackers. It’s just that, to also make it look nice, you have to do some additional work.

I’m going to start the process of removing as many of these trackers as I can from my blog. It’s really is insidious how additional functionality and ease-of-use for blog owners adds to the tracking burden for those reading their output.

Recently, I embedded a Google Slides deck in a weeknote I wrote. I’m genuinely shocked at how many trackers just including that embed added to my blog: 84! Suffice to say that I’ve replaced it with an archive.org embed.

I was surprised to see the Privacy Badger was reporting tracking by Facebook and Pinterest. I’m particularly hostile to Facebook services, and don’t use any of them (including WhatsApp and Instagram). Upon further investigation, it turns out that even if you have ‘share to X’ buttons turned off, Jetpack still allows social networks to phone home. So that’s gone, too.

There’s still work to be done here, including a new theme that doesn’t include Google Fonts. I’m also a bit baffled by what’s using Google Analytics, and I’ll need to stop using Cloudflare as a CDN.

But, as ever, it’s a work in progress and, as Antoine de Saint-Exupéry famously said, “Perfection is achieved when there is nothing left to take away.”

This post is day two of my #100DaysToOffload challenge. Want to get involved? Find out more at 100daystooffload.com

Header image by Gordon Johnson