Skip to content
The Cyber Security Place

Privacy

Current as of

This page describes what happens to information about you when you read this site. The short version is that almost nothing happens. The detail below exists so that you can check that claim rather than take it.

The Cyber Security Place sets no cookies, runs no analytics, carries no advertising and has no accounts to sign in to. Nothing you read here is recorded against you, and the search box does its work inside your own browser rather than sending what you type to a server. No part of a page is fetched from anywhere else: the typefaces, the stylesheet and the search index are all served from this domain, so reading here puts your address in front of no third party. One thing happens anyway and is worth stating rather than burying: the web host keeps standard server logs, which include your IP address. That is the whole of it, and everything below is the detail behind it.

What this site does not do

Five separate absences, listed separately because a single sentence claiming to respect your privacy is worth nothing and each of these is checkable.

  • No cookies. Not for analytics, not for preferences, not for advertising, not for anything. Your browser is asked to store nothing, so there is no consent banner here — not because one was skipped, but because there is nothing to consent to.
  • No analytics. No Google Analytics, no tag manager, and no privacy-friendly alternative either. Visits are not counted beyond whatever the server records in the ordinary course of answering a request.
  • No advertising. No ad networks, no tracking pixels, no audience segments. No profile of you is assembled here, and nothing is passed to anyone who assembles them.
  • No accounts. Nothing to register for, nothing to log in to, no password to be stolen from us and reused against you somewhere else.
  • No forms that send anything. There is no newsletter, no comment system and no contact form. The only form on the site is the search box, and what it does is described below.

You do not have to take any of that on trust. Open your browser's developer tools on any page here and look at the storage and network panels: what a page asks for is a short, finite list, and you can read the whole of it in under a minute.

What the search box does

The search covers 15,376 archive entries plus the pages written here, and it runs on your own device. The first time you type, your browser downloads two files — an index of the site and a list of related terms — and every keystroke after that is matched against them locally. The words you type are not transmitted anywhere, because there is no server here to transmit them to.

There is one exception and it should be named rather than left implied. If JavaScript is unavailable, or has not finished loading, the search box falls back to an ordinary web form that sends your query to /search/ as part of the web address. The same is true if you arrive at a results page from a link somebody sent you. In those cases the words you searched for are part of the URL, and a URL is one of the things a server log records.

Server logs

Every web server records the requests it answers, and this one is no exception. A log line typically holds the IP address that made the request, the time it arrived, the page asked for, the browser's user-agent string, and the page you came from if your browser volunteered one.

That record exists to operate and protect the site: to see whether pages are being served correctly, to find broken addresses, and to identify automated abuse. It is not combined with anything else about you, for the straightforward reason that there is nothing else here to combine it with.

The logs are held by the hosting provider that serves this site, under its own retention period, and are not used to build any profile or passed to anyone for that purpose.

Nothing here is loaded from anywhere else

An ordinary web page is assembled out of several domains. Typefaces come from one, analytics from another, an advertising network from a third, and often a tag manager, a video embed or a chat widget on top. Every one of them receives your IP address and your browser's user-agent string as a condition of delivering its part, before you have decided whether you want to stay on the page.

This site fetches nothing from anywhere else. The typefaces, the stylesheet, the search index and every image are served from this domain, which means no other company learns that you were here or what you looked at.

The typefaces are the part worth naming, because until recently they were the exception. They were requested from Google, and that section of this page said so. They are now served from this domain, so the request no longer leaves it. Open Sans and Roboto Slab are published under licences that permit exactly that.

This is checkable in the same minute as everything else above. Open the network panel in your browser's developer tools and reload any page here: every request in the list goes to this domain, and there is nothing else to see.

One consequence follows automatically and is worth spelling out. A third-party cookie requires a third party, and there is not one. No profile of your reading can be assembled across sites from anything this page does, because nothing this page does reaches another site.

Links to other sites

Much of this site's job is to point at the publication that originally reported something. When you follow one of those links you are on somebody else's site, under their privacy policy and not this one.

Those links are direct. There is no click-tracking redirect in the middle: a link to a newspaper goes to the newspaper, and nothing here records that you followed it.

Your rights, and the awkward fact about them

If you are in the United Kingdom or the European Union, data protection law gives you rights over personal data held about you: to know what is held, to have it corrected, to have it erased, to restrict or object to its use, to receive a copy, and to complain to your national supervisory authority.

A number of US states now grant their residents comparable rights: to know what is collected about them, to have it deleted, and to opt out of its sale or of targeted advertising. Two of those three have nothing to attach to here, because nothing is sold and no advertising exists to target. The first gets the same answer as everything else on this page.

The awkward fact is that there is almost nothing here to exercise them against. No account, no profile, no mailing list, no record of what you read. A request to see your data would return, at most, some server log lines that cannot reliably be tied to you as a person — and identifying you well enough to answer properly would mean collecting more about you than is held now.

That is an explanation, not a refusal. If you believe something about you is held here, ask, and you will get a direct answer rather than a form.

Children

This site is written for people who work in or around security. It is not directed at children, and it does not knowingly collect information about anybody, which necessarily includes children.

When this page changes

If the site begins doing something it does not do today — adding analytics, a mailing list, an account system, or anything else that collects information — this page changes before that happens and says what changed. The date at the top is the date of the version you are reading.

Asking about any of this

Write to [email protected]. Questions about what is held, corrections, and objections all go to the same address, and none of them require a particular form of words.

See also the terms of use, which cover what you may do with what you find here.