How many different sites does an application support forum need to pull in Javascript from?

I’m using uMatrix to block javascript until I approve it, I’m seeing almost the same thing.

The dark green entries are the ones I had to allow, just to make the site (and the login process) usable.

Hey ​@adfhogan 👋

Thanks for raising this, and for the detail you put into it. You did some good detective work on each service! It's a fair question to ask, especially of a security company.

The community runs on a third-party platform rather than something we built in-house, so a number of those domains come as part of that platform. The rest are things we've deliberately added. Everything in that list went through our internal security and privacy review before it was switched on.

I’d actually welcome your opinion on the CNAME configuration. Routing these through our own subdomains would make it obvious the requests are intentional, which is useful. But it would also mean the hostname no longer tells you who's actually providing the code, and we'd be making it less obvious that these are third-party services.

Our instinct has been that visible is better than tidy, even when visible invites threads like this one. But you're clearly thinking about this carefully, so: which would you rather have as a user? Fewer unfamiliar domains and a clear signal that everything is deliberate, or the current setup where you can see exactly who each request is going to and judge for yourself? Would welcome your thoughts on this too, ​@KG4ZOW.

And regardless of where that lands: please keep using whatever tools suit you to optimize your browsing experience.