As a privacy-concerned user, I try to make sure that Google, Facebook and the like do not get informed of whatever page I visit through web bug like Google Analytics and the Facebook "I like" button. Thus I block them using a combination of Ghostery and AdBlock Plus on Firefox.

However, jQuery is another script that gets often downloaded from Google's CDN, and I cannot blindly block it since it is needed by other (beneficial) scripts. So, question:

Is there a way to block downloading jQuery from Google's CDN without losing completely its functionality? The ideal would be replacing it with a locally-hosted copy (well, several, depending on the needed version), or one hosted on a server of my choice. Is there any privacy tool offering this functionality without much tweaking?

  • Is it really necessary? I think the main reason that many pages use google hosted files is that they got cached everywhere. So from the second visit to any page using jquery from google on, you should have no probelem. There might be other concern with jquerz however - googleanalytic via jquery itself. – gorn Jul 22 '12 at 23:03
  • I am not an expert, but I think the browser performs an expiration check by talking to google's servers whenever jquery if requested --- only if the requests is successful is jquery loaded from the cache. – Federico Poloni Jul 23 '12 at 21:33
  • 1
    No, (one of) the main arguments for using jquery is that it is served from cache. The expiration on this browser is set to one year, so browser downloads it once a year. – gorn Jul 23 '12 at 21:42
  • @gorn: I checked several docs and it seems that you are right --- thanks for debunking my myth. – Federico Poloni Aug 8 '12 at 7:48

What you are asking is technically possible with Ghostery for Firefox in its current state, though its not for the lighthearted

Ghostery for Firefox offers 2 features that you are trying together in your question:

  1. User defined tracker list -- this feature will allow you to create your own match list, in the example above, lets say jquery served by ajax.googleapis.com and will allow you to block based on this rule

  2. Script surrogate support -- this feature will allow you to replace contents of a blocked tracker with a locally stored contents.

| improve this answer | |
  • Please do not suggest moving things to other sites, it's better to just give a more detailed answer, or respond to comments – Simon Sheehan Dec 23 '11 at 1:10
  • This seems very interesting. Could you please add more detail? Googling for Ghostery+surrogate script returns nothing interesting. – Federico Poloni Dec 23 '11 at 23:09

jQuery is usually the core functionality for most sites, most that I create are based solely around jQuery. Though, on larger organizations' websites, they usually tend to use JavaScript for animation, this is a dependency based on what sites you visit.

What you want to do, could probably be done through Google Chrome, on a custom built extension that voids all <script> tags that have the word 'jquery' in their sources, and replacing them with your own library hosted on a server, or through the official jquery CDN. I did do a search through the Chrome webstore, and did not find anything that does this, but you could request a developer to build an extension that does do this!

Though, Google's jQuery sources are usually open to everyone, unless the kind you are referencing is on a gstatic.com domain.

| improve this answer | |

There is a Firefox setting that disables sending the HTTP referrer header with each request. This would mean that downloading jQuery from the CDN looks to Google like you just typed in the address and hit enter; there is no reference to where it was linked from.

In about:config go to network.http.sendRefererHeader. Valid values are 0 (don't send with any requests), 1 (send only on clicked links), 2 (send on everything). Setting to 1 would take care of your concern without potentially breaking some functionality that depends on HTTP referrer.

| improve this answer | |
  • Interesting approach, thanks. Though, paradoxically, this will make me easier to track, since it leaves a very peculiar browser fingerprint... – Federico Poloni Dec 23 '11 at 23:11

This is simple with a proxy HTTP server.

Just tell the proxy server to rewrite the URLs of the script files that you don't want to download into the URLs of your privately served copies. With adzapper and squid, for example, this is a simple REWRITE rule in the pattern file. With privoxy, for another example, this is a redirect in the user.actions file.

There are, at minimum, four benefits of this approach over doing this sort of thing with extensions:

  • You aren't running around the perpetual upgrade treadmill that Google and the Mozilla Foundation put plug-ins and extensions on.
  • A proxy HTTP server is browser-neutral. You don't have the hassle of finding yet more extensions and plug-ins when you find yourself needing this capability on Opera, or Safari, or Internet Explorer, or …
  • A proxy server is centralizable, and one server can serve an entire LAN. You don't have the hassle of installing and configuring the extensions and plug-ins all over again when you switch machines (or even, sometimes, user accounts).
  • You gain the ability to impose draconian restrictions to limit softwares from doing things over HTTP that you don't know about. If you configure every legitimate HTTP client that you know about, on every machine, to use the HTTP proxy, you can set up restrictions on your border routers to stop all HTTP traffic from every machine apart from the one running the proxy server.

Of course, once you have something like privoxy up and running, you can do all sorts of things with the HTTP transactions — not just redirect requests to your private content HTTP servers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.