Fiesta: WP YouTube Lyte reaches 1.0.0

I just released the one dot ohhhh dot ohhhhhhhhhh version of WP YouTube Lyte!
From the changelog:

  • new: also works on (manual) excerpts; just add a httpv link to the “excerpt” field on the post/page admin (based on feedback from Ruben@tuttingegneri)
  • new: if youtube-url contains “start” or “showinfo” parameters, these are used when playing the actual video. This means that you can now jump to a specific time in the YouTube video or stop the title/ author from being displayed (based on feedback from a.o. Miguel and Josh D)
  • update: javascript now initiates either after full page load or after 1 second (whatever comes first), thus avoiding video not showing due to other requests taking too long
  • update: bonus feature stops lockerz.com tracking by addtoany (you’ll still want to hide the “earn pointz” tab though)
  • bugfix: prevent the playing video to be in front of e.g. a dropdown-menu or lightbox (thanks to Matt Whittingham)
  • bugfix: solve overlap between player and text when option was set not to show links (reported by Josh D)

And an appropriate vid to go with this new release:

AddToAny now includes Lockerz tracking

Update 02-2015: things change, blogposts get out of date and indeed A2A is not owned by Lockerz any more.
AddToAny, one of the most popular sharing-widgets around, has had 3rd party tracking by Media6degrees for quite some time already. I wasn’t too happy about that, but it did have the no_3p option to disable this “functionality”. Half a year ago however AddToAny was acquired by Lockerz.com and it now includes tracking by Lockerz.com which cannot be turned off and does not check for navigator.doNotTrack either.
I’ve contacted the developer (Pat’s a swell guy, really) and he answered he would look into honoring the DoNotTrack header, which he wrote he’d love to include in Q1 somewhere. In the mean time, if you have AddToAny on your site, you can already hide the Lockerz “Earn” tab. And if you’re on WordPress, you could install (or upgrade) WP DoNotTrack, which I’ve updated to stop the Lockerz tracking (make sure lockerz.com is your blacklist).
If there’s a Drupalista out there that uses AddToAny and would like to stop Lockerz tracking; I’d be happy to co-author a Drupal DoNotTrack module, do get in touch!

Some 2011 numbers and 2012 goals

  1. This blog:
  2. WP YouTube Lyte, my WordPress plugin to do “lazy load YouTube embedding”, really took off:
    • 8 minor and 3 major releases (from 0.6.5 to 0.9.4), introducing support for features such as audio-only YouTube, embedding playlists, changing player size on the fly and translations in 6 languages (thanks to those six great contributors).
    • 48260 downloads
    • Main goal for 2012: stabilize and reach the magic 1.0.0 (which will probably include an optimized initialization-mechanism)
  3. My WP DoNotTrack plugin is somewhat … younger:
    • 2 releases
    • 336 downloads
    • Goals for 2012:
      • stop more types of tracking (a.o. by including black- or whitelist filtering of the HTML using the output buffer)
      • improve filtering
      • integrate (and possibly automate) tracking-detection using the webpagetest.org API
      • promote the idea of “DoNotTrack” in general and for WordPress and WP plugins & themes in particular (the plugin is just a means, not an end in itself)

But enough with all the navel-gazing, thanks for b(e)aring with me & have a great 2012 guys & girls!

Iframe sandboxing support coming soonish

Did you know you can limit the damage an iframe can do by adding the “sandbox” attribute? And that you can add a value to that attribute to loosen your grip if you choose to do so?
I remember reading about this a couple of years ago or so, but forgot as  support for this html5 spec was limited to Chrome (Apple added support in Safari as well). But while investigating a problem a WP DoNotTrack-user was facing, I re-discovered iframe sandboxing (it effectively stopped the javascript-based tracking inside the iframe) and noticed that support for it is to be included in Internet Explorer 10 and that Mozilla is finally working on an implementation as well.
So yeah, the option to sandbox iframe’s pointing to blacklisted (or non-whitelisted) hostnames will probably be in a future version of WP DoNotTrack. Stay tuned!

Configure WP DoNotTrack to block what you want

I pushed out a major new version of WP DoNotTrack to the WordPress plugin repository and major in this case means:

  • you can now choose between a blacklist and whitelist-approach (previous version did blacklisting only)
  • define what exactly is in that black- or whitelist (previous version came with a hardcoded blacklist)
  • option to block javascript-initiated tracking code from being added for all your visitors, or just those that explicitly opted out of tracking in their browser (supported in MS IE9 and Firefox 9, not supported in Google Chrome)
  • and off course an option-page under wp-admin to change all these settings

Because of these new features (4 of them) and because I think the plugin is already at least 50% mature, I decided to bump the version from 0.1.0 to 0.5.0. Never been good at math anyway …
If you encounter any problems when installing or configuring this plugin, you might find valuable info in the FAQ. But here’s two tips anyway:

  1. In general caching and js-aggregating plugins can interfere, so you might want to disable those while working on your WP DoNotTrack configuration and re-enable (with cleared caches) once you’re satisfied with the result.
  2. If you’re running WP YouTube Lyte with the bonus “donottrack” feature activated, you’ll want to deactivate that before installing/ activating WP DoNotTrack. If you don’t do that, you’ll have to turn to the FAQ …

Don’t hesitate to contact me or leave a comment beneath this here little blogpost if you run into problems, if have a feature request or if you just want to chat a little. I just love receiving feedback!

It’s official: you can not track your visitors

After almost a year of tinkering with my Donottrack-plugin for WordPress, I’ve requested it to be hosted in the WordPress repositories and uploaded version 0.1.0. So if you’re using Donottrack on your blog, or if you activated this “bonus feature” of WP YouTube Lyte, I propose you give WP DoNotTrack a try and let me know what gives here in the comments or via the contact form?
From the readme:

WP DoNotTrack stops plugins and themes from adding 3rd party tracking code to your blog to protect your visitor’s privacy. WP DoNotTrack uses (a slightly modified) version of jQuery AOP to catch and inspect elements that are about to be added to the DOM and renders these harmless if the black- or whitelist says so.
The current version is blacklist-based and stops tracking by media6degrees and quantserve. This can easily be changed in the javascript though. Future versions will include a WordPress admin-page to change these settings.

Applying Javascript AOP-magic to stop 3rd party tracking in WordPress

It was always my intention to elaborate on my small donottrack plugin for WordPress, but it was only when Automattic upgraded to the new asynchronous Quantcast code that I was forced to look actually dig in.
The new Quantcast-code doesn’t use the old-fashioned document.write, but inserts the javascript asynchronously with an insertBefore on the parent of the first script-node (as popularized by the asynchronous Google Analytics-code). Variations on this method would include e.g. using appendChild or adding it to head (although that might not exist).
A couple of months ago I experimented with the DomNodeInserted event, but that isn’t supported by all browsers. And even when it works, I found no consistent way to stop the tracking script (which was already added to the DOM, as the event is triggered after) from being loaded or executed. But last week while searching for a better solution I found a reference to javascript AOP on StackOverflow and after following some links I discovered the JQuery AOP-plugin.
JQuery AOP allows one to (amongst other things) add an advice around a method. When the method is called, the advice kicks in before the execution. The advice is a function which can investigate and change the parameters used by the method. And that’s exactly what the current version of DoNotTrack does; it has AOP.around (I’ve removed the JQuery dependency) catch insertBefore and appendChild, investigates the src-attribute and replaces that value if it points to quantserve.com before allowing the method execution to proceed.

scriptParent=document.getElementsByTagName('script')[0].parentNode;
aop.around( {target: scriptParent, method: /[insertBefore|appendChild]/},
        function(invocation) {
                if ((typeof(invocation.arguments[0].src)==='string')&&((invocation.arguments[0].tagName.toLowerCase()==='script')||(invocation.arguments[0].tagName.toLowerCase()==='img'))) {
                        if (sanitizer(invocation.arguments[0].src)===true){
                             invocation.arguments[0].src='javascript:return false;';
                        }
                }
                return invocation.proceed();
        }
);

I’m working on a more generic version of an AOP-based WordPress Privacy plugin now. In a first stage it will probably be based on a blacklist, that is editable in the WP Privacy options-screen but at a later date a whitelist-based approach will be added (based on an integration with webpagetest.org). Let’s add that to my New Years resolution for 2012, shall we?

WP YouTube Lyte 0.9.0: size matters

I uploaded a new version of WP YouTube Lyte to the WordPress SVN repository earlier today. The markdown parser seems to be in a bad mood today and the changes in the readme.txt (the changelog, first and foremost) aren’t visible, so here’s what’s new in this release:

  • you can now change player size from the default one (as proposed by Edward Owen); httpv://www.youtube.com/watch?v=_SQkWbRublY#stepSize=-2 or httpv://youtu.be/_SQkWbRublY#stepSize=+1 will change player size to one of the other available sizes in your choosen format (4:3 or 16:9)
  • added a smaller 16:9 size and re-arranged player sizes on the options-screen
  • Bugfix: changed lyte-div ID to force it to be xhtml-compliant (ID’s can’t start with a digit, hat tip: Ruben of ytuquelees.net
  • Bugfix: added version in js-call to avoid caching issues (lyte-min.js?ver=0.8.1) as experienced by some users and reported by Ryan of givemeshred.com
  • Upgrade to the “bonus feature” to fix things (consider this beta though)
  • Languages: added Hebrew (by Sagive SEO) and Catalan (by Ruben of ytuquelees.net) translations and added completed Spanish version (thanks to Paulino Brener from Social Media Travelers)
  • tested succesfully on WordPress 3.3 (beta 2)

The (slightly smaller) lyte-embedded YouTube video to go with this release: “She wants” by Metronomy (very Japan-esque by the way):

Metronomy - She Wants (Official Video)

As always, your feedback is welcome in the comments or via the contact form!

WP Privacy: Quantcast sneaks back in

After almost a year of peace and quiet, Quantcast tracking code has returned to this blog. As reported by Brian Yang, the stupid hack that stopped the code from being included doesn’t work any more. Automattic recently switched to the new Quantcast-code, which instead of using the old-fashioned document.write now gets inserted asynchronously by a DOM-method (insertBefore). I’m looking at ways to stop this from happening or at least limit it one way or the other, but for the time being there’s no fix. Bear with me and do speak up (in the comments below of via the contact form) if you think you can help!

WP YouTube Lyte 0.8.0 released

Just a quick note confirming the release of WP YouTube Lyte 0.8.0. As previously described, the main new feature is support for embedding YouTube playlists in a high-performance and accessible kind of way that is typical of this plugin.
While testing the new feature on different platforms I noticed the playlist-player only comes in Flash, so it does not work on iPads or iPhones. Or “does not work on them yet”, as YouTube’s Jeff Posnick confirmed that support for HTML5 video in the embedded playlist player is on their todo-list.
The plugin is multi-lingual, with the following languages supported:

  • English
  • Dutch
  • German
  • Slovenian
  • French (only the strings visible for visitors, not those in wp-admin)
  • Spanish (only those strings visible for visitors for now)

Corrections, extra translations, bug reports and feature requests are all welcome feedback, either in the comments here or via the contact page.
I hope you enjoy the new version!