Any meaningful UX testing in 2023 needs to account for ad blockers and password managers.

If your site or app doesn’t work with popular ad blockers, or it refuses to allow logins pasted in from password managers, it’s broken.

Yes, some executive type will want to argue about this because they think ad blocking will go away or they misunderstood some now outdated infosec guidance. They’re wrong. Users use ad blockers and password managers and if your stuff doesn’t work with them, it’s broken.

@tommorris I'd go one further and argue that if your site/service relies on displaying ads to the user as a primary source of revenue, it's broken.

@azonenberg @tommorris It's more complicated than that. Adblockers often block tracking scripts as well, or even just telemetry scripts that are relatively harmless (but *can* be used for tracking). These aren't actually business-critical on a per-user basis, but it's possible for the site's main scripts to break by accident if the telemetry library isn't there.

(Naturally, I use an adblocker on my work computer, which means if the site breaks for me, I'll know about it and will be able to give a heads-up to whoever wrote the overly-entangled code.)

@varx @tommorris And imo if you rely on telemetry your site is also broken :)

@azonenberg Hmm, I may not have been clear enough.

Imagine a piece of JS that has business logic, maybe making a fetch request for more widgets to show on the screen. If it detects a certain condition, it calls NewRelic.recordEvent(...) and goes on about its business. This isn't business critical, and if you asked the developer "hey, how important is it that this works?" they would say "eh, no big deal if it doesn't send the info". But what they're not anticipating is that window.NewRelic might be *undefined*. They've forgotten to include an if(NewRelic){...} around it.

That's the kind of scenario I mean. It comes up now and then.

It's broken, but it's not an *intentional* reliance on telemetry.

@varx I was more implying that I don't like the idea of telemetry in prod at all (vs a staging/dev server).
@azonenberg @varx Agreed! And the common cookie-consent forms misidentify telemetry as "performance".
@grinningcat @azonenberg Mmm... I think that's a separate conversation. See my reply at https://infosec.exchange/@varx/110469064723927560 for how "telemetry" is an overly broad term, but also cookie consent is different enough from telemetry that I'm not really comfortable making statements that cover both. I will say that in both cases there's a weird middle ground that's very hazy, though.
varx/tech (@[email protected])

@[email protected] Hmm..."telemetry" covers a *huge* range of things. That's part of the problem here. So you have: - A/B testing and "user journey" analysis (more on the marketing and sales side) - Feature usage statistics (important for knowing what you need to keep supporting) - Error reporting (critical for knowing if you've broken the site) ...and all of that sometimes gets lumped under "telemetry". I work on the backend, and I rely very heavily on telemetry to know what's working, what's being used vs. what can be deprecated, whether a dark-launch is successful, etc. I don't know for sure what people do on the frontend, but I imagine it's very similar. And as long as it's not tracking individual users, I don't see the problem.

Infosec Exchange

@azonenberg Hmm..."telemetry" covers a *huge* range of things. That's part of the problem here. So you have:

- A/B testing and "user journey" analysis (more on the marketing and sales side)
- Feature usage statistics (important for knowing what you need to keep supporting)
- Error reporting (critical for knowing if you've broken the site)

...and all of that sometimes gets lumped under "telemetry".

I work on the backend, and I rely very heavily on telemetry to know what's working, what's being used vs. what can be deprecated, whether a dark-launch is successful, etc. I don't know for sure what people do on the frontend, but I imagine it's very similar. And as long as it's not tracking individual users, I don't see the problem.