▲ 222 points
back
80 comments
> To learn more, or to download and install the free browser extension:
Edit: After re-reading this multiple times, I don't think this wording is helpful. There should be a transparent description of what this extension offers before users navigate to download and install options.
You likely misread the sentence. It doesn't say "To learn more, download and install the free browser extension:" - it says, "To learn more, or to download and install the free browser extension:" and then provides you with links to the stores that contain the description for the extension:
> Websites have increasingly begun to rely much more on large third-parties for content delivery. Canceling requests for ads or trackers is usually without issue, however blocking actual content, not unexpectedly, breaks pages. The aim of this add-on is to cut out the middleman by providing lightning speed delivery of local (bundled) files to improve online privacy.
I agree that it's a very weird frontpage and means of describing an extension, but you don't need to run their code before reading what the extension does.
Yeah, a little oddly worded. It's basically saying visit the Firefox/Chrome store to either download OR find out more about the add-on. I'm not sure why the website I'm on can't tell me more about it.. But I agree with the other poster in that you parsed the sentence incorrectly.
Yeah exactly... It just says how to install it. Not what it is or why it should want it ;)
It should have a description on their own site, not rely on one in an app store. I wouldn't even click on that until I'm convinced I want it.
In fact I didn't, I saw the page, was like "???" and then went to the comments here to read what this was about ;)
But yeah I always wondered what Google does with all these calls to the javascript libraries they're hosting... I bet they milk them for data somehow. It's a good effort but I'm not sure I'll install it as I already have so many plugins in Firefox that it constantly complains about slow startup.
I like the idea of the extension, but the implementation in lacking. According to the project's gitlab[1], there's only a dozen or so libraries are actually being served. It doesn't seem to cache google web fonts, for instance. Some sibling comments mentioned LocalCDN, which has more libraries and also includes fontawesome, but still lacks google fonts.
[1] https://git.synz.io/Synzvato/decentraleyes/-/tree/master/res...
We should all be turning off web fonts anyway.
I feel like that's a little unfair; it's a first step, an MVP, no?
I run decentraleyes and I like it.
The only thing I wish for is to add my own entries.
See also LocalCDN
https://codeberg.org/nobody/LocalCDN
Its a fork from decentraleyes with some more libraries included.
Interesting. However, not a part of the Recommended Extensions program. Decentraleyes is.
It's a cool idea, even if just for performance reasons. So many things come from CDNs these days, we may as well start shopping the common ones ahead of time.
But recently I learned something unexpected. Lots of extensions are terrible with their resources. On a page targeting tech-savvy people, around 1% of requests has some extension content injected into the website which requests an external font file. (info comes from CSP reports) There's so much tracking opportunity exposed through them.
In recent years libraries haven't been used off CDN like this much but rather bundled, tree-shaken, and uploaded to a CDN with the library baked into a JavaScript app.
> "even if just for performance reasons"
I don't think it matters for performance because it's cached in the browser anyway... So the purpose of the extension is privacy.
This addon is also useful when traveling in China. Since everything Google is blocked by the Great Firewall, the Google CDN is, by extension, also blocked. This breaks a lot of sites that would otherwise be reachable. Since with Decentraleyes, no requests to CDNs need to be made, those sites will continue to work as expected.
After clicking through several more times and ending up in a gitlab wiki, this seems to be how it works:
> It comes bundled with a fair amount of commonly used files, and serves them locally whenever a site tries to fetch them from a delivery network.
The docs, both on the site that is linked to and on the wiki is extremely bare bones, but the gist of it is that a CDN can track you through the `referer` header of the request for (say) jquery, since even if the browser has jquery already cached it will send out a request to check if the resource might have been modified.
They can also track you by IP and other means... It is better to avoid CDNs if you can (mostly because they are so popular and centralized).
Would a simpler solution be to just drop referrers from CDN requests? It would probably require fewer updates to the package itself
I had a friend who worked at a CDN and they are basically huge tracking networks.
I've used Decentraleyes for a while now and it works great. I would actually like to see it—or more specifically, the idea—integrated into browsers. It would improve privacy, (potentially) security, and speed at the cost of disk space.
Was Opera's "Turbo" mode not a similar feature? A feature launched in the early mobile/late dail-up days. Albeit the proxy CDN was provided by Opera. It would take proxy JPEGs, compress them more, serve them from an edge node. It don't think it was marketed as a privacy feature but mostly bandwidth/speed. But in theory if you trust Opera, you'd get more privacy?
I was thinking the same but then browsers have caches and most of the CDNs (e.g. jsdeliver) set max-age to a year and immutable so you're only tracked once
Careful with performance if you're on an underpowered machine, as with all content injectors, it could provoke frequent freezes if you have a decent to large amount of tabs open.
I kind of wonder how effective these extensions are for js libraries since dependencies are often bundled into a single file. I have been using decentraleyes for a while and when I have spot checked it on occasion it hasn’t intercepted any requests on the page. I am assuming this is due to bundling.
From a security standpoint bundling is not an issue as no additional requests are made but from a speed and performance standpoint I don’t think there is much extensions like this or browser caching can do. It kind of makes me wish bundling wasn’t a thing now that we have QUIC/HTTP3 being adopted.
With all that said I am still glad to have this extension around.
Note that Decentraleyes appears to break some sites due to CSP and SRI issues. I uninstalled it months/years ago, but forgot which sites broke. The bug tracker link is at https://git.synz.io/Synzvato/decentraleyes/-/issues/16 .
According to their whitelist[1], cdnjs.com, dropbox.com, glowing-bear.org, minigames.mail.ru, report-uri.io, scotthelme.co.uk, securityheaders.io, stefansundin.github.io, udacity.com, yadi.sk, and yourvotematters.co.uk are known to have issues. For as long as I can remeber, you can also whitelist sites yourself.
[1]https://git.synz.io/Synzvato/decentraleyes/blob/b3931febc234...
Couldn’t the browser extensions modify response headers and HTML attributes to avoid CSP and SRI issues?
Decentraleyes, HTTPS everywhere, and uBlock Origin are the three set-it-and-forget-it extensions that everyone should have to improve their privacy.
Somewhat noob here. Would you suggest LocalCDN instead of Decentraleyes?
The whole maintainers and forks thingy between Decentraleyes and LocalCDN seems so strange to me that I'm left with more suspicious about which should I use, if I ever should use any given their both behavior regarding the forks. I don't feel "safe" to use something so critical privacy-wise in that situation.
EDIT: refs
https://codeberg.org/nobody/LocalCDN/issues/51
What's strange about it? Decentraleyes isn't being maintained very actively. The author of LocalCDN found the pace too slow and forked to update things for themselves. They are very civil about it.
Another of the million huge enhancements that could be built natively into browsers if browsers weren’t intentionally stuck in the 90s by advertising/tracking companies.
I wonder when we’ll see a real browser alternative that includes no-brainer features like bundling the most common libraries in local forever-cache by SRI hash.
To summarize some of the limitations I’ve read in sibling comments:
– Recent trend appears to be bundling resources (e.g. Webpack) instead of using CDNs.
– This trend is complemented by browsers moving to per-site caches that limit the benefit of CDNs.
– Content-Security-Policy and/or Subresource Integrity restrictions can break some websites.
– Only a limited set of resources are included with Decentraleyes.
All that said, this is a really cool idea from both privacy and performance standpoints. Would love to see ways to address those limitations in the future.
Decentraleyes breaks sites that use subresource integrity, which is why I sadly needed to stop using it, until I find time to land a PR.
Just chiming in to say I think the name is brilliant and perfectly matched to such a software project.
I want this on a mobile browser too
If you use mobile Firefox, you can use any extensions you like.
This extension is available for FF on Android
I find localcdn to be a better option, it's a fork of Decentraleyes.
Make sure to read the directions, though, to integrate properly with uBO/uMatrix.
I’ve been using this for years and it works a charm, It has my endorsement for sure.
Would be nice to see this published to the Microsoft Edge Addons store - https://microsoftedge.microsoft.com/addons
Does this addon have any security implications when used in combination with uBlock or NoScript? If the JS is being injected, does that induce any risks of JS being executed when it should be blocked?
Blocking a resource has precedence over redirecting a resource. If your blocker blocks a resource, Decentraleyes or any other extension won't be able to redirect it.
I think it intercepts the requests to load from CDN and then loads it locally. The instructions for the extension tell you to whitelist the CDNs in uBlock/uMatrix. If you are blocking them then they won't load from Decentralyze either.
I’m pretty sure it works with ublock origin and umatrix. If the JS is blocked it won’t run. Not sure about NoScript though.
If it is taking third party resources and inlining them then this extension will be breaking the protections offered by the domain and JavaScript security model.
isn't your browser already caching these resources for you.