WebBundles harmful to content blocking, security tools, and the open web
Disclaimer: I wrote the article.<p>I'm not sure where the claimed confusion is above.<p>The argument is: I want to include something like fingerprint2.js in my page. I know filter lists block it, bc users don't like it.<p>W/o web bundles, you have to either inline it (bad for perf), copy it to a new URL (which could later also be added to a list), or add some URL generation logic to the page, and have some server side logic somewhere to know how to understand the programmatically generated URLs.<p>With WebBundles. I call it <a href="https://example.org/1.js" rel="nofollow">https://example.org/1.js</a> (which is a diff than what <a href="https://example.org/1.js" rel="nofollow">https://example.org/1.js</a> points to in a different bundle) or even just call it <a href="https://example.org/looks-to-be-benign-to-the-web.js" rel="nofollow">https://example.org/looks-to-be-benign-to-the-web.js</a>.<p>The claim is not that bundles are coming from random URLs, its that the bundles create private namespaces for URLs, and that breaks any privacy tools that rely on URLs.