1<!doctype html> 2<html lang="en"> 3<head> 4 <meta charset="utf-8"> 5 <meta name="viewport" content="width=device-width, initial-scale=1.0"> 6 <meta name="description" content="DavidJB.com, Python, Technology, Web, Linux, and more, by David Beitey"> 7 8 <link rel="alternate" href="https://davidjb.com/feeds/all.atom.xml" type="application/atom+xml" title="DavidJB.com Full Atom Feed"/> 9 10 <title>Deliveroo watches you while you eat // DavidJB.com // Python, Technology, Web, Linux, and more, by David Beitey</title> 11 12 <link href="/favicon.ico" rel="icon"> 13 14 <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/pure/1.0.0/pure-min.css"> 15 <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"> 16 <link rel="stylesheet" href="https://davidjb.com/theme/css/pure.css"> 17 <link rel="stylesheet" href="https://davidjb.com/theme/css/pygments.css"> 18 19
19<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js"></script>
19 20
20<script src="//cdnjs.cloudflare.com/ajax/libs/fitvids/1.0.1/jquery.fitvids.min.js"></script>
20 21
21<script> 22 $(document).ready(function(){ 23 $(".content").fitVids(); 24 }); 25 </script>
25 26 27 <link rel="stylesheet" type="text/css" href="https://davidjb.com/theme/tipuesearch/tipuesearch.css"> 28 29</head> 30 31<body> 32 <div class="pure-g-r" id="layout"> 33 <div class="sidebar pure-u"> 34 <div class="cover-img" style="background-image: url('/images/cover.jpg')"> 35 <div class="cover-body"> 36 <header class="header"> 37 <hgroup> 38 <img class="avatar" src="/images/me-square.png"> 39 <h1 class="brand-main"><a href="https://davidjb.com">DavidJB.com</a></h1> 40 <p class="tagline">Python, Technology, Web, Linux, and more, by David Beitey</p> 41 <p class="social"> 42 <a href="http://git.io/djb"> 43 <i class="fa fa-github-square fa-3x"></i> 44 </a> 45 <a href="http://twitter.com/davidjb_"> 46 <i class="fa fa-twitter-square fa-3x"></i> 47 </a> 48 <a href="http://linkedin.com/in/davidbeitey"> 49 <i class="fa fa-linkedin-square fa-3x"></i> 50 </a> 51 </p> 52<nav class="nav"> 53 <ul class="nav-list"> 54 </ul> 55 </nav> 56 57 </hgroup> 58 </header> 59 </div> 60 </div> 61 </div> 62 <div id="search"> 63 <form id="search_form" action="https://davidjb.com"> 64 <div class="tipue_search_left" style="padding: 15px 5px">⚲</div> 65 <div class="tipue_search_right"><input type="text" name="q" id="tipue_search_input" pattern=".{3,}" title="At least 3 characters" list="search" required placeholder="Search"></div> 66 <div style="clear: both;"></div> 67 </form> 68 <div id="tipue_search_content"></div> 69 </div> 70 <div class="pure-u"> 71 <div class="content"> 72 <section class="post"> 73 <header class="post-header"> 74 <h1>Deliveroo watches you while you eat</h1> 75 <p class="post-meta"> 76 // under <a class='post-category' href='https://davidjb.com/tag/food'>Food</a> 77 <a class='post-category' href='https://davidjb.com/tag/technology'>Technology</a> 78 <a class='post-category' href='https://davidjb.com/tag/privacy'>Privacy</a> 79 <a class='post-category' href='https://davidjb.com/tag/surveillance'>Surveillance</a> 80 </p> 81 </header> 82 </section> 83 <p><strong>tl;dr</strong> Deliveroo sends your browser <a class="reference external" href="#movie-titles">movie titles with food puns</a> as it tracks your activity.</p> 84<hr class="docutils" /> 85<p>The online food ordering platform <a class="reference external" href="https://deliveroo.com.au">Deliveroo</a>, like many (most?) online 86platforms, monitors you as you interact with their website. It’s not really a 87secret that <a class="reference external" href="https://en.wikipedia.org/wiki/Behavioral_analytics">behavioural analytics</a> (or “big data analytics”) get gathered 88from our time online, but is rather what we’ve come to expect of online 89companies who seek to extract, leverage and monetise the data generated from 90our interactions with their services.</p> 91<p>It won’t surprise anyone to know that Amazon <a class="reference external" href="https://www.amazon.jobs/en/teams/customer-behavior-analytics">actively uses</a> customer 92behaviours in real-time to affect the results and recommendations you see on 93the site - browse for a cable, see 100 more cables recommended forever. If you 94look carefully at effectively any link Amazon shows you, you’ll see its <span class="caps">URL</span> is 95littered with tracking parameters. Similarly, if you scroll or browse, you’ll 96notice multitudes of <span class="caps">HTTP</span> requests being fired off in succession, indicating 97what you’re doing and helping Amazon (try to) understand what you are or 98aren’t looking at.</p> 99<p>Likewise, it would probably be of little surprise that Airbnb, a hip, modern 100sharing-economy company, is also highly active in this space. Airbnb’s 101business is based around data - and apparently connecting guests to hosts’ 102accommodation - through its online platforms. However, in order to achieve this, 103you’ll find Airbnb sending several behaviour tracking events per <em>second</em> when 104you’re on their site, occurring as you move your cursor, type, interact with the <span class="caps">UI</span> 105across listings or are just sitting idle. A short browsing session (or a 106background tab left open) can easily end up sending off thousands or tens of 107thousands of tracking events.</p> 108<p>Being of the same ilk, Deliveroo also tracks you as you use their system. As 109you browse pages, click elements on a page or scroll up or down, Deliveroo 110fires off dozens requests with an event payload describing what you just did. 111For example, the following is sent every time your viewport scrolls to or 112past a category on a restaurant’s menu:</p> 113<div class="highlight"><pre><span></span>POST https://api.au.deliveroo.com/orderapp/v1/events 114User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0 (deliveroo/consumer-web-app; browser) 115X-Roo-Client: consumer-web-app 116X-Roo-Country: au 117X-Roo-Guid: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX 118X-Roo-Session-Guid: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX 119X-Roo-Sticky-Guid: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX 120</pre></div> 121<div class="highlight"><pre><span></span><span class="p">{</span> 122 <span class="nt">"events"</span><span class="p">:</span> <span class="p">[</span> 123 <span class="p">{</span>
124 <span class="nt">"name"</span><span class="p">:</span> <span class="s2">"Menu Scroll to Category"</span><span class="p">,</span> 125 <span class="nt">"properties"</span><span class="p">:</span> <span class="p">{</span> 126 <span class="nt">"category_id"</span><span class="p">:</span> <span class="s2">"12345678"</span><span class="p">,</span> 127 <span class="nt">"restaurant_id"</span><span class="p">:</span> <span class="s2">"999999"</span><span class="p">,</span> 128 <span class="nt">"served_menu_request_uuid"</span><span class="p">:</span> <span class="s2">"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"</span><span class="p">,</span> 129 <span class="nt">"user_agent"</span><span class="p">:</span> <span class="p">{</span> 130 <span class="nt">"family"</span><span class="p">:</span> <span class="s2">"Firefox"</span><span class="p">,</span> 131 <span class="nt">"major"</span><span class="p">:</span> <span class="s2">"98"</span><span class="p">,</span> 132 <span class="nt">"minor"</span><span class="p">:</span> <span class="s2">"0"</span><span class="p">,</span> 133 <span class="nt">"patch"</span><span class="p">:</span> <span class="kc">null</span> 134 <span class="p">},</span> 135 <span class="nt">"white_label_brand"</span><span class="p">:</span> <span class="s2">"core"</span> 136 <span class="p">},</span> 137 <span class="nt">"time"</span><span class="p">:</span> <span class="mi">1650524885</span> 138 <span class="p">}</span> 139 <span class="p">]</span> 140<span class="p">}</span> 141</pre></div> 142<p id="movie-titles">The specifics of the event data are hardly surprising, but what’s really fun 143is a header that gets returned from the response to the <span class="caps">API</span> call â the 144developers at Deliveroo clearly have a sense of humour, all while they 145play <a class="reference external" href="https://en.wikipedia.org/wiki/Big_Brother_(Nineteen_Eighty-Four)">Big Brother</a>, spending your bandwidth and Internet quota in the 146process. This header comes back in the <span class="caps">HTTP</span> response:</p> 147<pre class="literal-block"> 148x-watch-while-you-eat: Guardians of the Garlic: Vol. 2 149</pre> 150<p>It appears this gets sent for any <span class="caps">API</span> calls made in the <tt class="docutils literal">/orderapp</tt> 151namespace, even those that error. Try it yourself with a <tt class="docutils literal"><span class="caps">GET</span></tt> request to 152<a class="reference external" href="https://api.au.deliveroo.com/orderapp/v1">https://api.au.deliveroo.com/orderapp/v1</a>.</p> 153<p>To save you the effort, here’s the listing of all the movie titles you’ll get 154served, subjectively ordered by level of humour or cringeworthiness:</p> 155<pre class="literal-block"> 156V for Vienetta 157The Prawn Identity 15812 Hangry Men 159The Silence of the Lamb Chops 160The Lamb Shank Redemption 161Scone in Sixty Seconds 162Hack-slaw Fridge 163Guardians of the Garlic: Vol. 2 164Kung Pow Panda 165Soy Story 166Beauty and the Feast 167The Inedibles 168Despicable Meat 169A Clockwork Orange Juice 170Reservoir Hotdogs 171Power Radishs 172Much Ado About Muffin 173Full Metal Jacket Potato 174Mango Unchained 175The Big Shortcrust 176The Great Escalope 177Dial M for Murgh 178Mad Max: Fury Roast 179Planet of the Canapes 180Return to the Planet of the 'Shakes 181War for the Planet of the Grapes 182Top Bun 183Fill Bill 184Life of Pies 185Spoonlight 186Manchester by the Pea 187No Curry for Old Men 188Justice Peach 189I, Daniel Cake 190Plump Fiction 191Pi Za Za Land 192Hell or High Tea 193</pre> 194<p>Someone is clearly a fan of the Planet of the Apes series (ahem, <em>Canapés</em>).</p> 195<p>One might be inclined to wonder exactly how much money this Easter Egg itself 196is costing the company to send those extra bits over the wire; I appreciate a 197joke as much as the next person but this adds up, especially when <em>I’m</em> paying 198for the cellular data connection. For the whole tracking experience overall 199on Deliveroo, much like Amazon or Airbnb, a lot of data can be consumed
199in a 200session â just scrolling down to the bottom of one example page costs ~<span class="caps">150KB</span> 201to send and receive all these events, however funny the hidden headers happen 202to be. This quickly adds up to megabytes.</p> 203<p>In fairness, some of these titles did make me chuckle for the briefest of 204seconds, but your average user isn’t going to find this. Maybe it’s some light 205relief for the the security professionals doing pentesting. At any rate, my 206laugh was before realising what the <span class="caps">API</span> was doing and that it wasn’t already 207being blocked in my browser. In response, I wrote browser rules for <a class="reference external" href="https://github.com/gorhill/uBlock">uBlock 208Origin</a> (or Adblock Plus, etc) to block these requests:</p> 209<pre class="literal-block"> 210||deliveroo.com^*/events 211||events-tracker.deliveroo.net^ 212</pre> 213<p>This works for any Deliveroo site worldwide (and probably its white-labelled 214solution, Deliveroo Signature, as well). These <a class="reference external" href="https://github.com/easylist/easylist/issues/11758">have been submitted and merged</a> for inclusion in 215<a class="reference external" href="https://easylist.to">EasyPrivacy</a>, which is something worth using in this case too because when 216an error occurs sending a tracking event, Deliveroo will attempt to send a 217crash report off to Sentry; EasyPrivacy has a rule for handling this already.</p> 218<p>Whilst on the topic of privacy, it’s worth noting that Deliveroo does a 219<a class="reference external" href="https://deliveroo.com.au/privacy">Privacy Policy</a> which supposedly protects 220your data. However, I’m really curious to know what they mean by:</p> 221<blockquote> 222Unless you have elected to remain anonymous through your device and/or 223platform settings, this information may be collected and use [sic] by us 224automatically […]</blockquote> 225<p>and what settings they consider for someone to choosing to remain anonymous.</p> 226<p>Maybe they’re good netizens and apply the settings supplied in Do Not Track 227(<span class="caps">DNT</span>) or Global Privacy Control (<span class="caps">GPC</span>) headers on the server-side <em>after</em> 228you’ve sent your data to them. Or maybe it’s just another perfunctory attempt 229to appease anyone who might challenge it. ð¤·ââï¸</p> 230<p>It’s dinner time â I’m off to get some takeaway and watch a movieâ¦</p> 231 232 <a href="#" class="go-top">Go Top</a> 233 <div class="comments"> 234 <div id="disqus_thread"></div> 235
235<script type="text/javascript"> 236 /* * * CONFIGURATION VARIABLES: EDIT BEFORE PASTING INTO YOUR WEBPAGE * * */ 237 var disqus_shortname = "davidjb"; // required: replace example with your forum shortname 238 239 /* * * DON'T EDIT BELOW THIS LINE * * */ 240 (function() { 241 var dsq = document.createElement('script'); dsq.type = 'text/javascript'; dsq.async = true; 242 dsq.src = '//' + disqus_shortname + '.disqus.com/embed.js'; 243 (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq); 244 })(); 245 </script>
245 246 <noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript> 247 <a href="https://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a> 248 </div> 249<footer class="footer"> 250 <p>© davidjb (David Beitey) – 251 Built with <a href="https://github.com/davidjb/pure-single">Pure Theme</a> (customised) 252 for <a href="http://blog.getpelican.com/">Pelican</a> 253 </p> 254</footer> </div> 255 </div> 256 </div> 257
257<script> 258 var $top = $('.go-top'); 259 260 // Show or hide the sticky footer button 261 $(window).scroll(function() { 262 if ($(this).scrollTop() > 200) { 263 $top.fadeIn(200); 264 } else { 265 $top.fadeOut(200); 266 } 267 }); 268 269 // Animate the scroll to top 270 $top.click(function(event) { 271 event.preventDefault(); 272 $('html, body').animate({scrollTop: 0}, 300); 273 }) 274 275 // Makes sure that the href="#" attached to the <a> elements 276 // don't scroll you back up the page. 277 $('body').on('click', 'a[href="#"]', function(event) { 278 event.preventDefault(); 279 }); 280 </script>
280 281 282 283
283<script type="text/javascript" src="https://davidjb.com/theme/tipuesearch/tipuesearch_set.js"></script>
283 284
284<script type="text/javascript" src="https://davidjb.com/theme/tipuesearch/tipuesearch.min.js"></script>
284 285
285<script> 286 $.getJSON('https://davidjb.com/tipuesearch_content.json', function(data) { 287 window.tipuesearch = data 288 $('#tipue_search_input').tipuesearch() 289 $('#search_form').on('submit', function(event) { 290 event.preventDefault() 291 }) 292 }) 293 </script>
293 294 295</body> 296</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.