Suggestion: replace CDN with local scripts

[hibbitts-design]

Suggestion: replace CDN with local scripts

[paulhibbitts]

Thanks very much @programmieraffe for the detailed info and background! Of the two possible approaches I am tending towards exploring a "local" version of my Docsify projects vs. consent form - any comments/thoughts?

[mandrasch]

Hey Paul, of course. :-)

Shortest version: The CDN can track/protocolize and see the page (URL) you visit, your IP, your web browser information, etc.

I guess the usage of Google Fonts is a good example, the concerns are expressed here:

By including Google Fonts the users web browser will contact the Google Fonts CDN and therefore personal user data can be protocolized by a third party service, in this case Google or the CDN provider can profile a users behaviour (and track them through the web and target them via advertisment networks [tracking cookies])

This means for a siteowner using Google Fonts in EU, there are the following concers:

„

• you may need to ask for a consent from a visitor if Google is logging personal data
• you’re sending personal data to the processor who’s not in the EU
• Google as a processor might be performing profiling“

(https://www.lifehacker.com.au/2018/06/how-to-be-gdpr-compliant-if-you-use-google-fonts-on-your-website/)

For every third party service the site owner is required to express it at least in the privacy notice page (thumb rule), in Germany we have these tools to generate GDPR-compliant privacy information pages where we tick all the services we use https://datenschutz-generator.de/datenschutzerklaerung/

Borlabs Cookie Demo is a practical example, how you would get users consent before loading the content/contact the third party service provider of videos/media:
https://de.borlabs.io/borlabs-cookie/iframe-demo/

Google Fonts can be selfhosted via:
https://google-webfonts-helper.herokuapp.com/fonts

Higher Education Institutions - at least in Germany - are also very careful, because they can be held accountable for transferring user data without a valid reason or users consent.

Also Privacy Shield (EU <-> US) was invalidated, therefore it is kind of uncertain how to use a US-CDN in a EU-compliant way https://www.cpomagazine.com/data-privacy/eu-us-privacy-shield-invalidated-with-immediate-effect/

Long story short: Without the usage of any third party servers/services such as CDNs, you avoid a lot of discussions regarding privacy and it is possible to host the course page on an institutional webspace without third party tracking.

[paulhibbitts]

Thanks for the issue @programmieraffe , let me look into this and get back to you.

[paulhibbitts]

Hi @programmieraffe , I've taken an initial look and with the --local option you can get a local theme and Docsify JS file, but not the other plugins used (i.e. Search) etc. Likely it is possible to manually do that, but then updates will be an issue as well.

In case you want to further explore, here is a ZIP of a local test Docsify install:
docsify-local.zip

Perhaps at some point I could explore putting a local version demo together, once I can figure out if everything would work🙂

[paulhibbitts]

I was wondering @programmieraffe if you could share with me the specific privacy concerns about using CDN packages with a site generator like Docsify would be? I am not an expert on privacy and would like to learn more about what issues CDN packages could present etc.

[mandrasch]

(EFF has built https://privacybadger.org/ to check and avoid third party trackers)

[mandrasch]

The consent form adds a new layer of complexity and even consent is still problematic for some educational use cases, therefore I personally would prefer the local version to avoid any pitfalls.

(I recently saw a solution in https://startbootstrap.com/ themes, where the needed files are copied from /node_modules/ to a /vendor/ directory with help of nodejs and gulp, used it here https://github.com/programmieraffe/klimakriseschnelldurchlauf/blob/master/gulpfile.js#L59

This gulp script can be used in Github Actions https://github.com/programmieraffe/klimakriseschnelldurchlauf/blob/master/.github/workflows/main.yml

But maybe this is overkill for your approach, idk :))

[davidlohner]

A "local" version would make much more sense to me, as it can also be easily made available for students to download. They could also use them long after they have attended a course (offline use).

[paulhibbitts]

Thanks for your input @programmieraffe @davidlohner , I've done a proof-of-concept Local version of Open Course Starter Kit at https://paulhibbitts.github.io/test-docsify-open-course-starter-kit-local/#/

https://github.com/paulhibbitts/test-docsify-open-course-starter-kit-local/blob/master/docs/index.html

Gulp is beyond me (right now) so I manually obtained/linked the needed js/css files. Please let me know what you think.
Paul

[davidlohner]

Is it possible to get those (or other) icons in the sidebar locally? (e.g. local font awesome?)

[paulhibbitts]

Ah, thanks for finding that issue @davidlohner , I will look into it and get back to you.

[paulhibbitts]

I've added a way to locally support FontAwesome now @davidlohner , please look/test and let me know what you think. You will notice I had to change the syntax in the sidebar for the icons.

BTW, if this all looks good I will likely then make a new repo for this hibbitts-design account on GitHub for the project etc.

[davidlohner]

Looks good from my side, but @programmieraffe should take a look at it again. I cannot say with 100% certainty that it is technically perfect.

[paulhibbitts]

Do you think things are looking good @programmieraffe for me to make an official repo on my hibbitts-design GitHub account? From my perspective the only issue is that I need to periodically manually update the local CND resources - so far my search for an easy-to-do method for this on Mac OS has not resulted in any viable options.

[davidlohner]

I've just "upgraded" my L2D2-Course to the local version: Uploading a ton of small files (local Font Awesome) takes some time. Maybe you should put that information into your readme, @paulhibbitts.

[paulhibbitts]

Thanks for the update and suggestion @davidlohner, any performance differences local vs. previously CDN? The only other potential downside of local is that updates are no longer automatic and must be done manually. I also ended up needing to do a manual process to make this local version.

[davidlohner]

No, it's only the initial upload which takes some time.

[paulhibbitts]

That sounds good, thanks for letting me know @davidlohner.