Tell HN: Toptal's HTML minification API occasionally injects tracking JavaScript

https://news.ycombinator.com/item?id=33013873

by cududa • 4 years ago

97 25 4 years ago

news.ycombinator.com

Just a heads up for anyone using their API - about 1 in 5 requests will return with Cloudflare Insights tracking JS. It's not mentioned anywhere in the API documentation, Privacy Policy, or ToS.

Fairly certain this is the package they based their service on https://github.com/tdewolff/minify

Edit: Here's a tweet I posted with a screenshot of the code: https://twitter.com/cullend/status/1575243757624360960?s=20&t=JVhqXDJExBnrEVOXeFH4Jg

Nicksil• 4 years ago

Good lookin out. Appreciate the heads-up.

Bilal_io• 4 years ago

Are you sure that's not Cloudflare injecting the JS it on behalf of TopTal because they have CF analytics enabled?

But I agree with your point, this should have been mentioned in their ToS and/or Privacy Policy.

cududa6• 4 years ago

Can't be sure, but that would be rather frightening if cloudflare is just injecting JS willynilly

joshmn5• 4 years ago

If CF is acting as a reverse proxy as it so often does — it's one of their core features — it's not exactly willynilly.

jffry• 4 years ago

If you proxy your site through Cloudflare and turn on Cloudflare analytics, its default behavior appears to be to automatically add the JS tag for you in HTML responses [1] (you can also disable that and manually add the tag to your HTML)

They provide a lot of this type of thing - rewriting HTML responses with optimizations "at the edge" instead of you doing it at your origin.

[1] https://developers.cloudflare.com/analytics/web-analytics/ge...

Alupis3• 4 years ago

I really would like to know why anyone would use an API to minify javascript/css/html instead of using a local library, built-in webserver features, or relying on some front-end service like Cloudflare.

Feels like we've jumped the shark if you need to send un-minified stuff to another server to get minified, sort of defeating the point in the first place...

simlevesque• 4 years ago

Closure compiler has been a thing since forever. Some people don't want to fiddle and don't care about owning their tools.

cududa6• 4 years ago

Well the API was easy to implement, took minutes. Was more just out of convenience for producing a lot of assets that then get served to a lot of people. None of it ever went into production because we caught the requests pretty quickly this morning. As well, most of the python packages would mangle the minification - the one I linked to in the top post works great - documentation isn't up to date for python, but not horribly hard to setup

bagels• 4 years ago

Using some node library you pull down is still vulnerable to exactly this same kind of injection attack vector.

Alupis3• 4 years ago

Except you're not then pounding on some pet side-project "API" stood up by a poaching agency...

Seems insane anyone would even entertain the thought... it's trivially easy to minify whatever you want right within your app.

And now here's OP bagging on this company for not disclosing this in some ToS or whatever, even though OP is the one abusing a free, obviously not-serious service.

vlunkr• 4 years ago

It's like left-pad.io but real. Incredible

joshmn5• 4 years ago

My guess as to what is happening:

1. Toptal uses Cloudflare for DNS

2. Toptal uses Cloudflare Insights, which automagically inserts the tracking snippet of `https://static.cloudflareinsights.com/beacon.min.js/\\*`

3. You send the request to Toptal and somewhere along the line, Cloudflare misinterprets the request and injects the tracking code

It's not anything nefarious by Toptal. It's not their minify script. It's a misconfigured page rule, or similar. It's a bug.

cududa6• 4 years ago

Sounds pretty accurate! Hopefully they get it configured properly!

codegeek• 4 years ago

I think it is part of cloudflare's browser insights which is now part of their "Web Analytics". You will see this almost with any site using cloudflare that has web analytics enabled.

https://community.cloudflare.com/t/beacon-min-js-as-malware/...

https://developers.cloudflare.com/analytics/web-analytics/

The site owner needs to configure cloudflare correctly to add analytics on certain pages only otherwise cloudflare injects it by default.

Tell HN: Toptal's HTML minification API occasionally injects tracking JavaScript

Related Stories