We really like #qoto services. Today we came to learn there are #Cloudflare fetches on #qotoDotOrg's mastodon for the instance icons.
To see the fetches use F12 for the Network tab.
It gets CSS from miy.pw, one Cf website, and that CSS gets icons for each instance type at https://34.wtf, another Cf, based on HTML content.
Aside from inefficient couldn't this track/out users to Cf?
@MitiGator
@strypey
@bojkotiMalbona @witchescauldron @msaunders @paulsutton@qoto.org
@lupyuen
@dsfgs @MitiGator@101010.pl @strypey @bojkotiMalbona @witchescauldron @msaunders @lupyuen
Not sure maybe @freemo can help
Good question. This comes from the instance tracker feature added to some of our themes (its how we add a banner to posts that show what instance users are from using unique colors and icons for each instance).
We specifically provide theme versions for most of our themes that are o-ticker versions that wont fetch this css or add the tickers. This is specifically for people who dont want to use the tickers third-party css.
So if anyone is worried about this I'd suggest users simply switch to one of the no-ticker themes.
@dsfgs @MitiGator@101010.pl @strypey @bojkotiMalbona @witchescauldron @msaunders @lupyuen
@freemo @dsfgs @MitiGator@101010.pl @strypey @bojkotiMalbona @witchescauldron @msaunders @lupyuen
This is what I like about fedi, a concern / question is raised, and rather than trying to fob people off, you get a response such as this, that explains the issue and suggest possible solutions.
@zleap I mean, its a pretty legit concern :)
I have just made a Short video on how to change the theme. It is transcoding as I type this.
@zleap I cant view it since im in egypt and internet is god awful slow here. But we should find a good spot to put it for people to find it in the future.
@freemo Good point, it is still transcoding at the moment. I have a few similar videos, so could be useful for tutorials etc.
@zleap Yes thank you, im sure some users will find it helpful.
Hi zleap and Freemo (et al),
Thanks for the prompt reply and a video even, @zleap! Unfortunately, we're unable to watch videos at this time, also.
There are, to us, peculiarities to this ticker plugin. It seems to use JS (node.js) on some pages despite us having JS disabled in Tor? @torproject.
It looks like very inefficient client-side code too, iteratingโฆ1/3
@MitiGator @strypey @bojkotiMalbona @witchescauldron @msaunders @alex @lupyuen
@freemo
@dsfgs @torproject @MitiGator@101010.pl @strypey @bojkotiMalbona @witchescauldron @msaunders @alex @lupyuen @freemo
is it worth this being brought up on the forum, partly as this is a matter of choice for end users but also something that admins can make clear as to the options the end users have, and the pros vs cons of this.
Yea i think the forum would be a good spot to elaborate on the details and inform users. The about page should briefly mention it and then link to the forum for more info.
Since i am in egypt with a broken leg it might be a bit before i get the chance though.
@dsfgs @torproject @MitiGator@101010.pl @strypey @bojkotiMalbona @witchescauldron @msaunders @alex @lupyuen
@freemo @dsfgs @torproject @MitiGator@101010.pl @strypey @bojkotiMalbona @witchescauldron @msaunders @alex @lupyuen
No problem no rush anyway as it is nearly christmas / new year so people may be busy anyway.
@zleap
Hi, everyone well? Has any progress been made on this whole #qotoCloudflare issue?
At a good internet supply, @freemo? It will be good to know the ticker maker to know the instances using it. Is it @yi0713? When you asked the folks about the ticker and they voted for default, did they know it was Cf-hosted?
Is anyone able to address how on postPages the ticker loaded with JS(?) when JS disabled?
@torproject @MitiGator @strypey @bojkotiMalbona @witchescauldron @msaunders @alex @lupyuen
I will likely be back around good internet in a day or two if all goes well. Can you remind me then.
@miyon is the ticker maker i think.
It was quite some time ago we voted about the default theme, pretty sure cloudflare was known at the time of the vote as i had mentioned it when i first put the theme together. I need to search for the vote for and verify.
@zleap @yi0713 @torproject @MitiGator@101010.pl @strypey @bojkotiMalbona @witchescauldron @msaunders @alex @lupyuen
@freemo
Even better if it could be scheduled. Then no remind needed.
Thanks for including @miyon
Cloudflare are only getting more monolitthic/dangerous. It might be interesting to see what your users discuss in a fresh RFC.
We'd be willing to devote time to improving the ticker in future (uses a lot of screen space in addition to being a possible client-side CPU drainer). Ideas @eugen?
@zleap @torproject @MitiGator @strypey @bojkotiMalbona @witchescauldron @msaunders @lupyuen
@freemo @dsfgs @miyon @eugen @torproject @MitiGator@101010.pl @strypey @bojkotiMalbona @witchescauldron @msaunders @lupyuen
I agree there and if we have to use it , then make it clear we are using it and why.
I think the intent here is to just quickly mention it in our about page with a link to a more detailed forum article explaining it. In the forum we can add that link (after review it) so people can be informed. In the end they jave the option to use themes without css hosted on cloudflare so im good with that. All for links to help people be informed but im not trying to make a political issue out if it. As long as people are informed im ok with them deciding for themselves if they care. Some people dont want to be tracked, others really dont care, im ok with either group.
@zleap @lupyuen @msaunders @witchescauldron @strypey @MitiGator@101010.pl @torproject @eugen @miyon @dsfgs
@freemo @bojkotiMalbona @lupyuen @msaunders @witchescauldron @strypey @MitiGator@101010.pl @torproject @eugen @miyon @dsfgs
I think this is a good way forward, provide information and allow people to make informed choices as to which themes they want to use.
@freemo
It worth mentioning, knowingly exposing users to Cloudflare tracking by default, in today's age, is political already. They're absorbing the internet. On this occasion its nothing that can't be solved with a 'wget', 'sed -i' and some checks. We admit a server-side solution would be better.
@bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @MitiGator @Gargron
Hi @miyon,
Greetings from Australia. Do you offer a selfHost option for ticker out of the box? May you be so helpful as to provide a list of instances that are using miy.pw or 34.wtf as they are (now?) Cloudflare-surveilled, your help would be greatly appreciated.
@freemo @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @MitiGator @Gargron
Hello everyone.
I'm Miyon-Miyon.
I am the image character of #InstanceTicker, but since September, I have been removed from the management project members due to my busy schedule, and the actual operator (comitter) is @weepjp .
Please wait for @weepjp 's reply.
@dsfgs @freemo @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @MitiGator @Gargron
@miyon
Thanks Miyon,
Maybe there is one thing you can help with. How was the decision made to become Cloudflare? Was there extreme difficulty with the requests?
We are trying to understand how websites become cf'd in the first place.
@weepjp @freemo @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
Thanks @dsfgs ,
1) I am currently preparing a "Non CloudFlare version" of #InstanceTicker.
2) This version will replace all reference images with dataURIschemes instead of externalURLimages. This will increase the capacity of the CSS.
3) Due to the nature of customCSS, I have decided that all images need to be converted to webp format to optimize size and data volume.
This will take some time to prepare.
@freemo @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
@weepjp
Thanks weepjp,
Sounds like a project!
In the interim is there a version of the current ticker for selfHost? Not to be too alarmist but everyday is another day Cf are gathering data on Fedi.
Which instances are currently running it?
What is currently being done to trick Tor into loading content dynamically(?) on Post pages?
Other technical matters discussed below without tagging others.
@freemo @miyon @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
OTHER TECHNICAL MATTERS:
You mentioned embedding images in CSS via #dataURLs yes? Will you consider testing this in Tor browser and FOSS browsers generally first?.
Maybe an #imageMap will work better (for all users). Then depending on the icon you want to use you offset the background image in a ':before' element?
There's a way to address this server-side and we think it would likely improve UX. If updating ticker, maybe think about going server-side?
#TickerBlue - #InstanceTicker NON-CF Version!
https://ticker.blue
> #TickerBlue - #InstanceTicker NON-CF Version!
ticker.blue
Congrats on producing a non-Cloudflare option, @weepjp. We look forward to seeing good instances like qoto using it?
BTW today we noticed #qoto also uses #hCaptcha. The cloudflare captcha used to train #autonomousDrones.
In what places other than login page does qoto use hCaptcha? Maybe a FOSS and non-proprietary #captcha can remedy this?
@freemo @miyon @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
We only use it for registration, not needed for login. Didnt know it was cloudflare based though.
I will look into switching to the non-cf version of the ticker for the next update. I am ok switching captchas too if someone wants to submit a pr, i didnt implement the captcha code myself.
@weepjp @miyon @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
ใใคใใไธ่ฉฑใซใชใฃใฆใใพใใ
I think #Qoto should be a "Non #InstanceTicker site theme" when not logged in, like https://fedibird.com .
I recommend a design that allows only logged-in users to select #InstanceTicker (miy.pw) or #TickerBlue .
@dsfgs @miyon @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
Any reason you suggest that? Can you even view the instance tocker when not logged in now?
@dsfgs @miyon @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
#Qoto will display #InstanceTicker even for visitors who are not currently logged in.
I hope that only those who are logged in can use it.
This is just a suggestion.
@dsfgs @miyon @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
> selfHost
It seems that another person made something similar.
https://github.com/cutls/OpenSticker
> Which instances are currently running it?
Display ticker list:
https://miy.pw/css/0.php
Custom server (Req ranking): https://miyon.miyon.org/@InstanceTicker/107271136119363709
> Tor
I have no knowledge of Tor.
I can't improve for Tor.
From now on, if you have a lot of questions and requests, I will close #InstanceTicker.
@dsfgs @freemo @miyon @bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
Yes ideally it can and should be avoided. No reason it needs to be the case here that they get exposed to it.
@bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @MitiGator@101010.pl @Gargron
@freemo
Yes, and its important to be consistant on any opposition to Cloudflare (all CAGEFAM, really but Cloudflare is the 'elephantine tentacle-squid in all the rooms').
@bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
I am not as vigilant about it as you. Like i do try to avoid it on any services i host, mostly because i know some of my community cares and i want them to feel safe and protected. But its not a big fight for me other than avoiding them where i can. Like i dont invest much time in spreading the word and all the things that a more active person like yourself might do. For me its just common sense to avoid it.
@bojkotiMalbona @zleap @lupyuen @msaunders @witchescauldron @strypey @Gargron
@zleap @lupyuen @msaunders @witchescauldron @strypey @MitiGator @torproject @eugen @miyon @dsfgs @freemo If youโre going for honest transparency, why not go a step further & refer people to this article so people learn why #Cloudflare is a bad idea โ https://git.disroot.org/dCF/deCloudflare/src/branch/master/subfiles/rapsheet.cloudflare.md