2

As a privacy-concerned user, I try to make sure that Google, Facebook and the like do not get informed of whatever page I visit through web bug like Google Analytics and the Facebook "I like" button. Thus I block them using a combination of Ghostery and AdBlock Plus on Firefox.

However, jQuery is another script that gets often downloaded from Google's CDN, and I cannot blindly block it since it is needed by other (beneficial) scripts. So, question:

Is there a way to block downloading jQuery from Google's CDN without losing completely its functionality? The ideal would be replacing it with a locally-hosted copy (well, several, depending on the needed version), or one hosted on a server of my choice. Is there any privacy tool offering this functionality without much tweaking?

Federico Poloni
  • 385

4 Answers4

3

jQuery is usually the core functionality for most sites, most that I create are based solely around jQuery. Though, on larger organizations' websites, they usually tend to use JavaScript for animation, this is a dependency based on what sites you visit.

What you want to do, could probably be done through Google Chrome, on a custom built extension that voids all <script> tags that have the word 'jquery' in their sources, and replacing them with your own library hosted on a server, or through the official jquery CDN. I did do a search through the Chrome webstore, and did not find anything that does this, but you could request a developer to build an extension that does do this!

Though, Google's jQuery sources are usually open to everyone, unless the kind you are referencing is on a gstatic.com domain.

soandos
  • 24,600
  • 29
  • 105
  • 136
unicornication
  • 214
3

What you are asking is technically possible with Ghostery for Firefox in its current state, though its not for the lighthearted

Ghostery for Firefox offers 2 features that you are trying together in your question:

  1. User defined tracker list -- this feature will allow you to create your own match list, in the example above, lets say jquery served by ajax.googleapis.com and will allow you to block based on this rule

  2. Script surrogate support -- this feature will allow you to replace contents of a blocked tracker with a locally stored contents.

Simon Sheehan
  • 9,204
fixanoid
  • 211
2

There is a Firefox setting that disables sending the HTTP referrer header with each request. This would mean that downloading jQuery from the CDN looks to Google like you just typed in the address and hit enter; there is no reference to where it was linked from.

In about:config go to network.http.sendRefererHeader. Valid values are 0 (don't send with any requests), 1 (send only on clicked links), 2 (send on everything). Setting to 1 would take care of your concern without potentially breaking some functionality that depends on HTTP referrer.

pdubs
  • 121
1

This is simple with a proxy HTTP server.

Just tell the proxy server to rewrite the URLs of the script files that you don't want to download into the URLs of your privately served copies. With adzapper and squid, for example, this is a simple REWRITE rule in the pattern file. With privoxy, for another example, this is a redirect in the user.actions file.

There are, at minimum, four benefits of this approach over doing this sort of thing with extensions:

  • You aren't running around the perpetual upgrade treadmill that Google and the Mozilla Foundation put plug-ins and extensions on.
  • A proxy HTTP server is browser-neutral. You don't have the hassle of finding yet more extensions and plug-ins when you find yourself needing this capability on Opera, or Safari, or Internet Explorer, or …
  • A proxy server is centralizable, and one server can serve an entire LAN. You don't have the hassle of installing and configuring the extensions and plug-ins all over again when you switch machines (or even, sometimes, user accounts).
  • You gain the ability to impose draconian restrictions to limit softwares from doing things over HTTP that you don't know about. If you configure every legitimate HTTP client that you know about, on every machine, to use the HTTP proxy, you can set up restrictions on your border routers to stop all HTTP traffic from every machine apart from the one running the proxy server.

Of course, once you have something like privoxy up and running, you can do all sorts of things with the HTTP transactions — not just redirect requests to your private content HTTP servers.

JdeBP
  • 27,556
  • 1
  • 77
  • 106