# Privacy Badger blocks this site **URL:** \ **Category:** Site Feedback\ **Created:** [July 16, 2016, 8:00pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976 "2016-07-16T20:00:40Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![iankelling](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iankelling/32/8037_2.png) [@iankelling](https://community.letsencrypt.org/u/iankelling)\ **Post date:** [July 16, 2016, 8:00pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/1 "2016-07-16T20:00:40Z")
"Privacy Badger detected 1 potential trackers on this page. [cdn-business.discourse.org](http://cdn-business.discourse.org)" Causing there to be just a blank page. I changed the privacy badger setting from "block" to "just block cookies" and it started to work. After the site loaded and I logged in, I see that it is also blocking [avatars.discourse.org](http://avatars.discourse.org). Browsing to the root of those domains provides zero info. Googling [discourse.org](http://discourse.org) tracking shows someone else had the same issue, but nothing else. This should be fixed. Let's Encrypt should not have a 3rd party company tracking people or using techniques which could track and EFF recommends blocking. I'm using debian firefox 46.0.1-1+b1. I don't know what version of privacy badger, but the addons page says last updated 4/21/2016, and no updates were found when I check. ---
**Author:** ![cool110](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/cool110/32/8583_2.png) [@cool110](https://community.letsencrypt.org/u/cool110)\ **Post date:** [July 16, 2016, 8:16pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/2 "2016-07-16T20:16:24Z")
[cdn-business.discourse.org](http://cdn-business.discourse.org) has the correct DNT policy that Privacy Badger looks for on domains that should never be blocked. In addition. In addition the entire forum is hosted by Discourse so they can see everything anyway. ---
**Author:** ![iankelling](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iankelling/32/8037_2.png) [@iankelling](https://community.letsencrypt.org/u/iankelling)\ **Post date:** [July 16, 2016, 8:26pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/3 "2016-07-16T20:26:15Z")
> should never be blocked But it is, and I doubt it's a bug in privacy badger. Googling [discourse.org](http://discourse.org) tracker shows at least 1 other person hit the same issue for another site with [cdn-business.discourse.org](http://cdn-business.discourse.org). > In addition the entire forum is hosted by Discourse so they can see everything anyway. Sounds like people who say "I'm not serving sensitive content, so why enable https?" This site deserves better than that. ---
**Author:** ![kelunik](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kelunik/32/359_2.png) [@kelunik](https://community.letsencrypt.org/u/kelunik)\ **Post date:** [July 16, 2016, 8:33pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/4 "2016-07-16T20:33:04Z")
> [@iankelling](#): > > Sounds like people who say "I'm not serving sensitive content, so why enable https?" This site deserves better than that. Not in any way. Discourse hosts this support forum. It's not hosted by Let's Encrypt. Let's Encrypt has setup a `CNAME` record to `discourse.org`: ```nohighlight $ dig @8.8.8.8 community.letsencrypt.org ; <<>> DiG 9.9.5-11ubuntu1.3-Ubuntu <<>> @8.8.8.8 community.letsencrypt.org ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57058 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;community.letsencrypt.org. IN A ;; ANSWER SECTION: community.letsencrypt.org. 6534 IN CNAME hosted-vh2.discourse.org. hosted-vh2.discourse.org. 119 IN A 64.71.168.201 ;; Query time: 36 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sat Jul 16 22:31:39 CEST 2016 ;; MSG SIZE rcvd: 105 ``` ---
**Author:** ![iankelling](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iankelling/32/8037_2.png) [@iankelling](https://community.letsencrypt.org/u/iankelling)\ **Post date:** [July 16, 2016, 8:38pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/5 "2016-07-16T20:38:31Z")
> Not in any way. Discourse hosts this support forum. It's not hosted by Let's Encrypt. My browser says: [community.letsencrypt.org](http://community.letsencrypt.org). It has the Let's Encrypt logo, people get here from [letsencrypt.org](http://letsencrypt.org). Let's Encrypt may have outsourced some technical responsibilities of the site, but they are still responsible for it. If [discourse.org](http://discourse.org) got hacked and the page was filled with malicous content, Let's Encrypt would fix it quickly, be it by changing the dns record or some other means. Just as I said before: this site deserves better, and these are lame excuses. ---
**Author:** ![kelunik](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kelunik/32/359_2.png) [@kelunik](https://community.letsencrypt.org/u/kelunik)\ **Post date:** [July 16, 2016, 8:44pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/6 "2016-07-16T20:44:27Z")
> [@iankelling](#): > > If [discourse.org](http://discourse.org) got hacked and the page was filled with malicous content, Let's Encrypt would fix it quickly, be it by changing the dns record or some other means. They can do that either way. Whether that content is moved onto a `letsencrypt.org` subdomain or not doesn't change anything. If Discourse gets hacked and DNS records would be changed, the forum would be unavailable either way. ---
**Author:** ![iankelling](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iankelling/32/8037_2.png) [@iankelling](https://community.letsencrypt.org/u/iankelling)\ **Post date:** [July 16, 2016, 8:48pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/7 "2016-07-16T20:48:57Z")
@kulenik, I don’t even know what your last message is getting at, but it definitely seems irrelevant. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [July 16, 2016, 9:15pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/8 "2016-07-16T21:15:07Z")
> [@iankelling](#): > > and these are lame excuses I'm sure you've got the best intentions, but your attitute might not be very constructive for a good discussion.. ---
**Author:** ![pridetechdesign](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pridetechdesign/32/17206_2.png) [@pridetechdesign](https://community.letsencrypt.org/u/pridetechdesign)\ **Post date:** [July 16, 2016, 10:24pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/9 "2016-07-16T22:24:09Z")
Discourse is a forum software that keeps a user logged in from one website to another, which is not really ‘tracking’, but will show up as tracking to some paranoid apps. I’m not familiar with privacy badger, but if it outright blocks a webpage from loading for something like the above, then that is not an app I’d ever use. There are ways to protect your privacy without nanny-bot software interfering with your legitimate activities. ---
**Author:** ![saper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/saper/32/7980_2.png) [@saper](https://community.letsencrypt.org/u/saper)\ **Post date:** [July 16, 2016, 11:02pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/10 "2016-07-16T23:02:28Z")
This issue is has already been brought up on the [Discourse Meta forum](https://meta.discourse.org/t/discourse-cdns-are-blocked-by-privacy-badger/17127). The problems seems to be that CloudFlare is sending out tracking cookies on its CDN which are, “necessary for security”. ---
**Author:** ![TCM](https://avatars.discourse-cdn.com/v4/letter/t/a587f6/32.png) [@TCM](https://community.letsencrypt.org/u/TCM)\ **Post date:** [July 16, 2016, 11:32pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/11 "2016-07-16T23:32:28Z")
> [@SimbaLion](#): > > Discourse is a forum software that keeps a user logged in from one website to another How would that work if I only have cookies for "[community.letsencrypt.org](http://community.letsencrypt.org)" which don't get sent to other domains? ---
**Author:** ![pridetechdesign](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pridetechdesign/32/17206_2.png) [@pridetechdesign](https://community.letsencrypt.org/u/pridetechdesign)\ **Post date:** [July 17, 2016, 12:05am UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/12 "2016-07-17T00:05:16Z")
I’m not an expert on cookie tracking, but my point was you might get better mileage from something like ‘Disconnect’ which is a tracker-blocking addon that doesn’t interfere with your ability to load pages. ---
**Author:** ![mpalmer](https://avatars.discourse-cdn.com/v4/letter/m/a8b319/32.png) [@mpalmer](https://community.letsencrypt.org/u/mpalmer)\ **Post date:** [July 17, 2016, 11:41pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/13 "2016-07-17T23:41:36Z")
> [@iankelling](#): > > Privacy Badger detected 1 potential trackers on this page. > > [cdn-business.discourse.org](http://cdn-business.discourse.org) That's rather interesting, because I use Privacy Badger myself (on Debian Chromium), with no special settings for `discourse.org`-related domains, and it's not throwing up any warnings for me. After the last time PB called shenanigans on `avatars.discourse.org` (legitimately), [we (Discourse) fixed it](https://meta.discourse.org/t/discourse-cdns-are-blocked-by-privacy-badger/17127/38?u=mpalmer), and switched CDNs because of it (for shame, Cloudflare... for shaaaaaame). It would help to diagnose what's going on if you could give me the names (just the names, don't need contents) of all cookies that are being sent by `cdn-business.discourse.org` and `avatars.discourse.org`. That'll help me to know where the cookies are coming from. If you can include one or more URLs you're requesting that are giving the cookies, I can more accurately reproduce the problem. For reference, neither the URL for my letter avatar `https://avatars.discourse.org/v2/letter/m/a8b319/64.png` nor the first CDN URL on this page `https://cdn.discourse.org/letsencrypt/uploads/default/original/1X/8529b324ee54a8f85c38260975250e39582cfefe.png` give back any cookies. ---
**Author:** ![My1](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/my1/32/1013_2.png) [@My1](https://community.letsencrypt.org/u/My1)\ **Post date:** [July 18, 2016, 8:59am UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/14 "2016-07-18T08:59:33Z")
> [@iankelling](#): > > Just as I said before: this site deserves better, and these are lame excuses. well most people are on some kind of hosting service and obviously the hoster does have theoretical access to the data who knows whether the LE HQ has an internet connection nice enough to run a large forum. ---
**Author:** ![SFITCS](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sfitcs/32/1697_2.png) [@SFITCS](https://community.letsencrypt.org/u/SFITCS)\ **Post date:** [July 18, 2016, 11:23pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/15 "2016-07-18T23:23:45Z")
> [@iankelling](#): > > Privacy Badger detected 1 potential trackers on this page. Privacy Badger is not perfect (it generates lots of [false positives](https://www.slightfuture.com/security/privacy-badgering)). You already have the ability to delete Firefox cookies - with all due respect, use it. It's nigh impossible to provide even a self-hosted forum( **1** ) that actually works without using cookies. The traffic this forum attracts requires the use of a CDN, and CloudFlare needs to use cookies. What you should be concerned about are, carrying cookies from one site to another, "super-cookies", canvas fingerprinting, and other techniques to uniquely identify a browser (like detecting extensions) - this forum uses none of those. tl;dr. Lodge a [bug report](https://github.com/EFForg/privacybadgerfirefox/issues) with Privacy Badger; set Firefox to announce "do not track", clear all cookies ( **2** ) after visiting a site - you can only be tracked by cookies if you retain them. Apropos of little (and off the subject) - I can conceive of no rational reason why anyone would be concerned about anyone knowing they visited this forum (note my previous comment about keeping necessary cookies for the session only). Especially when your ISP knows exactly where you visit (as does any monitoring equipment they have no control over/knowledge of) **and** given that the two cookies served expire at the end of the session. ( **1** ) _I'm guessing you're not prepared to donate the money for self-hosting this forum._ 🙂 ( **2** ) **Tools -\> Preferences -\> Privacy -\> Remove cookies.. -\> Remove selected OR Remove all** ---
**Author:** ![SFITCS](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sfitcs/32/1697_2.png) [@SFITCS](https://community.letsencrypt.org/u/SFITCS)\ **Post date:** [July 18, 2016, 11:29pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/16 "2016-07-18T23:29:08Z")
> [@iankelling](#): > > Sounds like people who say "I'm not serving sensitive content, so why enable https?" The two things are mutually exclusive. HTTPS encrypts content - it doesn't have anything to do with site navigation or allowing secure CDN to work. Neither a **single-page** or cgi driven website, cookie-free, or https extends the reasonable expectation of privacy beyond the domicile (billing difficulties not withstanding). ---
**Author:** ![iankelling](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iankelling/32/8037_2.png) [@iankelling](https://community.letsencrypt.org/u/iankelling)\ **Post date:** [July 20, 2016, 7:33am UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/17 "2016-07-20T07:33:24Z")
Thanks you SFITCS, that was very informative. ---
**Author:** ![SFITCS](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sfitcs/32/1697_2.png) [@SFITCS](https://community.letsencrypt.org/u/SFITCS)\ **Post date:** [July 20, 2016, 8:00am UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/18 "2016-07-20T08:00:37Z")
Thank you - for expressing your original concern, your consideration of my response/s, and for your reply. After some thought about your concerns - the only way it’s truly possible to visit and view web(-like) content in privacy is through [freenet](https://freenetproject.org/about.html) (for reasons too lengthy and tangential to the purpose of this forum Tor is **not** an option). Kind regards ---
**Author:** ![saper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/saper/32/7980_2.png) [@saper](https://community.letsencrypt.org/u/saper)\ **Post date:** [July 20, 2016, 8:28pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/19 "2016-07-20T20:28:20Z")
@mpalmer not using Privacy Badget but I don’t see any cookies sent from the CDN. It looks similar to [https://github.com/EFForg/privacybadgerfirefox/issues/490](https://github.com/EFForg/privacybadgerfirefox/issues/490) @iankelling can you check if you get any cookies from the CDN requests? ---
**Author:** ![mpalmer](https://avatars.discourse-cdn.com/v4/letter/m/a8b319/32.png) [@mpalmer](https://community.letsencrypt.org/u/mpalmer)\ **Post date:** [July 20, 2016, 11:37pm UTC](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976/20 "2016-07-20T23:37:02Z")
Nice catch, @saper, finding that bug. I agree it sounds _very_ similar, and I’ve added a detailed comment on that issue, so we’ll see if there is a bug that can be found. [Next page](https://community.letsencrypt.org/t/privacy-badger-blocks-this-site/17976.md?page=2)