PB blocks zenodo DOI badges

[Bisaloo]

What is your browser and browser version?

Firefox 67.0.2 (tested on a fresh profile with only PB installed)

What is broken and where?

Zenodo DOI badges are blocked on multiple pages

What is the "culprit" domain?

zenodo.org

What is your debug output for this domain?

**** ACTION_MAP for zenodo.org
zenodo.org {
  "userAction": "",
  "dnt": false,
  "heuristicAction": "block",
  "nextUpdateTime": 1561118203694
}
**** SNITCH_MAP for zenodo.org
zenodo.org [
  "r-project.org",
  "rstudio.org",
  "curtin.edu.au"
]

Steps to reproduce

Visit:

• https://cran.curtin.edu.au/web/packages/CoordinateCleaner/readme/README.html
• https://cran.rstudio.org/web/packages/CoordinateCleaner/readme/README.html
• https://cran.r-project.org/web/packages/CoordinateCleaner/readme/README.html

(three mirrors of the same page)

---

I don't know whether zenodo.org should be added to the yellow list or if it would be worth contacting them to see if they would agree to comply with the EFF DNT policy.

https://about.zenodo.org/privacy-policy/

[ghostwords]

Thanks for the report! No other reports at this time.

[Bisaloo]

@ghostwords, is there anything I can do on my end for this kind of issues? Like reaching out to the organisation owning the website or something?

[ghostwords]

Yeah, if you'd like, that would be really nice of you. You could point them to this issue so that we could continue the discussion here.

What's happening here (I think) is that Zenodo sets some sort of session cookie when serving the badge image. That's probably an oversight on their part, but maybe not. They could stop serving cookies for badge requests, which will resolve the issue going forward (for Badgers that haven't yet learned to block zenodo.org).

If the badges do not actually track users, Zenodo could also post the EFF Do Not Track policy on the domain that serves the badges. This will tell Privacy Badgers to always allow the badges to load. The tricky thing is that the policy applies to the domain it is posted on, not just any one particular use of the domain, so all of zenodo.org has to be compliant. As in, you can't post the policy if your badges do not track, but some other third-party thing you serve from zenodo.org does track.