4 ms·
> Is there any short explanation how this works under the hood? Yes, the spec is the most detailed description of what goes on under the hood and it's not too
by gdeglin 11y ago
> Is there any short explanation how this works under the hood?
Yes, the spec is the most detailed description of what goes on under the hood and it's not too long: https://www.w3.org/TR/push-api/ https://www.w3.org/TR/push-api/, but here's my attempt at answering each of your questions:
> Does the browser maintain an open connection (like a Websocket) for each subscription, or there are some brokers, or if it can use OS facilities (like GCM/APN on mobile) when available, etc etc.
Yes. Chrome maintains an open connection to Google's push servers, Firefox maintains an open connection to Mozilla's push servers.
> In particular, I'm curious of privacy implications. When I subscribe - what site knows of me (say, if that's a direct connections, I'm not sure I want to tell every site out there when I'm online), or if any third parties are involved - what they know and do (say, what's about sender and receiver authentication)?
The Push connection itself would not reveal whether you are online since it's made to Google/Mozilla and not other individual sites, however the presence of a Service Worker could be used to determine this. For example, a website could send a background notification and check your network connectivity from the Service Worker without necessarily showing you a visible notification. This is already true for push notifications most people already receive from mobile apps.
A common use for these kinds of background notifications would be to do background data loading (such as loading new email messages to view later offline).
- mtberatwork 11y agoSince this does use Service Workers, it's also important to point out that everything needs to be handled via HTTPS for Service Workers to work. [1] [1] https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers https://developer.mozilla.org/en-US/docs/Web/API/Service_Wor...
- windlep 11y agoFirefox implements a quota system that restricts how many notifications may be sent "without user interaction". This is to reduce the likelihood that one could use this effectively for background tracking and to ensure you won't be swarmed with a gazillion of them if an application server has some bugs on sending notifications. Bugzilla ticket: https://bugzilla.mozilla.org/show_bug.cgi?id=1153504 https://bugzilla.mozilla.org/show_bug.cgi?id=1153504