Decentraleyes is a new open source Firefox add-on that aims to improve your privacy while browsing. It does this by hosting CND resources locally. When your browser makes a request for one of these CDN resources, the request is blocked and you are served up a local version instead.
What the hell?
Building websites from scratch is hard work. Rather than reinvent the wheel each time, web developers share libraries of useful open source code that do common tasks. For example, JavaScript libraries or web frameworks such jQuery or Ember.
So rather than write the code themselves, developers can simply reference these shared scripts from within web pages. These shared scripts are hosted on content delivery networks (CDNs) - globally distributed networks of proxy servers deployed in multiple data centers.
Not only can scripts hosted on these distributed networks be easily shared among developers, but CDNs are a very efficient means of delivering content. Using resources hosted on them, therefore, makes pages load faster. It also removes the financial burden from developers of hosting the resources themselves.
As a consequence, a very large percentage of all websites in existence make regular use of libraries shared on CDNs.
So yay! That sounds great. Go CDNs?
The problem
The problem is that CDN hosting costs money. And companies such as Google, Facebook and Microsoft offer such hosting for free. Free is as much the favorite price for web developers as it is for the rest us, so a very large amount of all website resources are now hosted on CDNs hosted by these companies.
And as always with Google et al., although there is no monetary cost, we pay for their use with our privacy. As the old adage goes, if you are not paying for a product then you are the product!
Every time you visit a website that references a library hosted on one of these CDNs, Google, Facebook, Microsoft, etc. will know about it and can track you as you go from website to website.
Even more alarmingly, there is nothing to prevent these companies from replacing the hosted code with something more malicious. And there is no way your browser (or antivirus software) would be able to prevent this.
Possible Solutions
One solution to this problem is to use add-ons such as NoScript or uMatrix to prevent scripts from running. But these add-ons are very much for advanced users. Properly configuring them is a difficult and time-consuming task. And even then, they will “break” many websites that rely on these external scripts in order to work.
Another possible solution would be for web developers to club together and form a publicly audited non-profit organization to host web resources. But this would take time and money, so no such move is currently being planned.
Enter Decentraleyes
The Decentraleyes Firefox add-on stores commonly used resources locally. When a website tries to access them on a supported network, Decentraleyes will block the request and load the locally stored resource instead.
- Supported Networks: Google Hosted Libraries, Microsoft Ajax CDN, CDNJS (Cloudflare), jQuery CDN (MaxCDN), jsDelivr (MaxCDN), Yandex CDN, Baidu CDN, Sina Public Resources, and UpYun Libraries.
- Bundled Resources: AngularJS, Backbone.js, Dojo, Ember.js, Ext Core, jQuery, jQuery UI, Modernizr, MooTools, Prototype, Scriptaculous, SWFObject, Underscore.js, and Web Font Loader.
Not only does this prevent Google etc. from tracking you via CDN requests, but local resources always load faster than remote ones. So web pages load faster. Win!
Conclusion
Decentraleyes is a great idea, and is completely transparent in use. In fact, it is possibly a little too transparent. It would be nice if it could display a visual representation of how many CDN resources have been blocked in this way. As it is, you need to wade into Firefox’s developer console in order to find out this information
It would also be nice of if Decentraleyes worked for more resources than is currently the case.
But it is still early days, and I can think of no reason not to install this nifty add-on. On its own, it will not prevent you from being tracked online, but it is nevertheless a valuable tool in your privacy toolkit.