1593185 - Embedded Facebook content from friends2follow.com missing on http://www.therepublic.com

Status: RESOLVED WONTFIX

(Core :: Privacy: Anti-Tracking, defect)

Description

[Ciprian Georgiu, Desktop QA]

Attachment: ad-facebook.png

Affected versions

• latest Nightly 72.0a1
• latest Beta 71.0b6
• dot-Release 70.0.1

Affected platforms

• Windows 10 x64
• macOS 10.13
• Ubuntu 18.04 x64

Steps to reproduce

1. Go to about:preferences#privacy and from Custom section, un-check all items expect for "Fingerprinters".
2. Access http://www.therepublic.com/.

Expected result

• The embedded Facebook content from the right side of the page is displayed in the ad.

Actual result

• The embedded Facebook content is NOT displayed in the ad.

Regression range

• Not a regression.

Additional notes

• It looks that the blocked domain in Privacy panel is "therepublic.friends2follow.com".
• Please observe the attached screenshot.

Comment 1

[Ciprian Georgiu, Desktop QA]

Attachment: ad-facebook2.png

I can observe this issue on https://www.herald-dispatch.com/ website as well, where the Facebook content is missing from the page. The blocked domain in this case is heralddispatch.friends2follow.com

Comment 2

[Steven Englehardt [:englehardt]]

I've verified that blocking therepublic.friends2follow.com is causing this breakage. Specifically, we block “https://therepublic.friends2follow.com/f2f/widget/async/socialstack/72/0/8/140/1/2/1/5?click=&cache= from loading in an embedded frame (which subsequently loads other resources from this origin and Facebook origins).

The breakage on https://www.herald-dispatch.com/ does indeed have the same cause. Specifically blocking: https://heralddispatch.friends2follow.com/f2f/widget/html/socialstack/72/0/12/140/1/1/1/10

Comment 3

[Steven Englehardt [:englehardt]]

It looks like the fingerprinting script is served from a CDN (see: https://github.com/disconnectme/disconnect-tracking-protection/blob/master/descriptions.md#Friends2Follow). The computed fingerprint is sent back to friends2follow.com (e.g., https://therepublic.friends2follow.com/f2fi.php?wi=72&it=...&ha=...&fi=...).

Comment 4

[Steven Englehardt [:englehardt]]

We've decided to accept this breakage.