7 ms·

I'm betting this isn't a bug but isn't malicious either. Possible scenario: Product: So Sue, how's the restore-session-after-crash feature going? Dev: Great,

I'm betting this isn't a bug but isn't malicious either. Possible scenario: Product: So Sue, how's the restore-session-after-crash feature going? Dev: Great, just about done. Product: So it's working for all sessions now? Fantastic! Dev: Yep! Well, all sessions except private ones of course. Product: ... so you haven't finished private sessions yet? Dev: No, it's just that we don't store anything on disk for them, so there's nothing to restore. Product: ... Dev: ... Product: Users don't know what "stored on disk" even means. They're going to be very upset if we lose their work after a crash, just because the session happened to be private. Maybe even more so. Dev: But with nothing on disk, that would be impossible. Product: You devs have such a fixed mindset. If I had a penny for every time I'd heard one tell me something was "impossible." So store what you need on disk, and ... Dev: But history ... Product ... and flag it so it doesn't show up in history or as a visited link. Wouldn't that work? Dev: Well, kind of, but ... Product: Great! So we have a solution. How long to get that coded up? [Later] Product: "Impossible" laugh Hah!

user8341116 11y ago
This post gave me PTSD.
fweespeech 11y ago
I'm pretty sure you are right [or some similar scenario]. However, its disingenuous at best that they didn't mention it anywhere.
deleted 11y ago
[deleted]
rdudek 11y ago
I actually wouldn't be surprised that a similar scenario occurred during development. There are stupid decisions made constantly. Even the place I work, our Chief Security Officer in charge of security asked me to remove all authentication from all printers with email function so that it won't affect user's workflow... on top of that, I'm told to allow users to type in the "From" field as well. I'm about to scan my butt to the CEO and type in the CSO's email address in the From field just to prove my point....
- arjie 11y ago
  If you don't have some sort of card + short-pin access to the scanner (or something else that's minimally interrupting), auth is an incredibly annoying thing. I mean, what's the threat vector here? Scanned butts? I think people will survive. Everyone's supposed to have some fancy alphanumeric-with-special-characters password and sit there in front of the machine copying it in slowly from their LastPass. No, thank you.
  - rdudek 11y ago
    Considering we're in healthcare business... I can see problems. We are working towards implementing a badge-in option but wont begin testing until this summer.
    - akshatpradhan 11y ago
      >We are working towards implementing a badge-in option Where else in a healthcare business can you implement those?
      - rdudek 11y ago
        We already have the ability for staff to badge into any computer without typing their credentials.
KirinDave 11y ago
Exceeeeept, Edge doesn't restore those sessions or evidently do anything with this data, suggesting a regression on how the tab history is handled. I mean, good story. 6 years ago it might have even been realistic for ms. These days, the middle level product manager who did that would rapidly find themselves on a high speed track to a new employer. The Edge team isn't a bunch of faceless goons. Heck, a lot of them are really active in the browser development community and you can see they're trying really hard. As much fun as it is to carry on the Slashdot tradition and make fun of every bug at MS as indicative of a toxic and stupid culture, maybe that's not entirely appropriate anymore. I mean, it's not like Firefox and chrome haven't had bugs in this vein before. Hell, neither can fully protect repeatedly visited private urls on Android either.
- scholia 11y ago
  > As much fun as it is to carry on the Slashdot tradition and make fun of every bug at MS as indicative of a toxic and stupid culture, maybe that's not entirely appropriate anymore. But betanews wouldn't have very much to write about....
bargl 11y ago
This explanation made me giggle and cry a little. It also made me think of the quote from Scott Hanselman, "We're not nearly as organized as we'd need to be to be as evil as you might think we are." http://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx http://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx Microsoft is thought of as this hugely evil company, but I don't know, maybe they are just as disorganized as every other company I've worked with and the product owner doesn't understand their customers all the time. The key is some comapanies I've worked for pivot fast and fix things they see as a mistake. Others try to bury and hide it. Are they going to kill my pappy this time? I don't think so, but we'll see.
- xenophon 11y ago
  This heuristic, generalized, is sometimes called Hanlon's Razor: "never attribute to malice that which is adequately explained by stupidity."
  - jobu 11y ago
    The razor also has a corollary in Clark's law, which states that "any sufficiently advanced incompetence is indistinguishable from malice".
  - kibwen 11y ago
    I actually think that Hanlon's Razor goes too far. Allow me to present Kibwen's Corollary to Hanlon's Razor: "never attribute to stupidity that which is adequately explained by apathy".
- harryjo 11y ago
  Microsoft's evil was on display in open court. https://en.wikipedia.org/wiki/Halloween_documents https://en.wikipedia.org/wiki/Halloween_documents Hanselman's point was that they weren't as evil as you might think
typon 11y ago
This is too real. shudder
reader_1000 11y ago
When you try to open closed tab back (ctrl+shift+T), Chrome does not open it. I thougt this is a good way of handling history in private mode, you close the tab and everything is gone. However when I tried same thing on Firefox, I saw that Firefox happily opens the closed tab back, which surprised me. So I think while trying to find a balance between usability and privacy, browser vendors choose different paths.
- aembleton 11y ago
  In Firefox you create a private window, not a private tab. Inside the private window, you can have multiple tabs; closing them and restoring them. Once you close the private window everything is gone.
  - oneeyedpigeon 11y ago
    Chrome also uses a private window, not private tabs. You just can't restore closed private tabs, which is probably how it should be.
    - atrotors 11y ago
      The thing is that chrome sandboxes every tab, but firefox doesn't and it's easier for firefox to restore tabs than for chrome is to do.
    - Spellman 11y ago
      Chrome fires up a separate thread for each tab. So any information about that tab is lost once the tab, (and thus sandbox) closes. No information specific to the tabs is stored in the window unless explicitly done (like bookmarking). Thus, the session history is stored inside that sandbox, so it's gone once it's closed. Firefox is maintaining a window with tabs within it. So it can still keep your session info for each tab stored at the window level and restore it even after a tab is close.
  - reader_1000 11y ago
    I was talking about how tabs is handled in private window.
dabodmb 11y ago
This sounds like a very likely scenario... sad but true.
dman 11y ago
Microsoft makes a huge amount of money from enterprise sales. I would see how large companies would be worked up if employees could use private mode browsing to circumvent monitoring. I fear (without any evidence) that private browsing mode would be a tough feature to push in the enterprise space.
- lreeves 11y ago
  Monitoring in an enterprise environment (for browsing) works on a network level; even SSL sites are monitored by on-the-fly certificates that are trusted by the users machine. There's no need to persist history to disk for an IT team to capture that information.
  - TheRealDunkirk 11y ago
    My favorite days are the one where central IT screws up the system, and we get certificate errors everywhere we go. Uh, do you think they're tracking us and snooping all supposedly secure communication? Naaaaaah. Luckily, I avoid most of those days working from home and NOT using the VPN. I SHOULD make sure I never log into something I care about (like iCloud) while on their network. The problem is that I can't get reception on my cell phone inside the building.
    - Bromlife 11y ago
      If you don't want your employer to see it, do it on your phone. Everyone should realise that by now.
- slumberlust 11y ago
  I disagree with this, primarily because most enterprise solutions can track your traffic independently of the browser.
- jlgaddis 11y ago
  Sounds like something that would be much better controlled (i.e. "disabled") at the organizational level with a group policy setting.
minusSeven 11y ago
thats looking at it from the best possible way. The way windows 10 has gone so far I really doubt which is which. Maybe they knew and didn't want people to find out. They also don't seem to give a shit about what people actually want.
bengoodger 11y ago
I don't know if this is the case, but I definitely understand how it could happen. Chrome's Incognito mode has the exact behavior of not supporting things like session restore and closed tab reopening. It's kind of annoying for those of us who occasionally use Incognito windows like a convenient transient separate profile (specifically "give me a different cookie jar because some site's login is broken"), but I think the loss of functionality is worth it given what the mode is actually /for/. It makes me wonder though if it'd be worthwhile having a mode that gives you a separate cookie jar but keeps the browser settings otherwise identical (bookmarks, suggest, etc). I suspect the distinction is too subtle for most people however.
- dalore 11y ago
  I used to use it for that but now with chrome profiles I've setup a new person for that called Mr Debug. It's good in that I can enable different extensions, ones that I wouldn't have enabled normally and disable the ones that interfere with dom inspections (looking at you Evernote). You can run both at once.

user8341116 11y ago

This post gave me PTSD.

fweespeech 11y ago

I'm pretty sure you are right [or some similar scenario]. However, its disingenuous at best that they didn't mention it anywhere.

deleted 11y ago

[deleted]

rdudek 11y ago

I actually wouldn't be surprised that a similar scenario occurred during development. There are stupid decisions made constantly. Even the place I work, our Chief Security Officer in charge of security asked me to remove all authentication from all printers with email function so that it won't affect user's workflow... on top of that, I'm told to allow users to type in the "From" field as well. I'm about to scan my butt to the CEO and type in the CSO's email address in the From field just to prove my point....

arjie 11y ago
If you don't have some sort of card + short-pin access to the scanner (or something else that's minimally interrupting), auth is an incredibly annoying thing. I mean, what's the threat vector here? Scanned butts? I think people will survive. Everyone's supposed to have some fancy alphanumeric-with-special-characters password and sit there in front of the machine copying it in slowly from their LastPass. No, thank you.
- rdudek 11y ago
  Considering we're in healthcare business... I can see problems. We are working towards implementing a badge-in option but wont begin testing until this summer.
  - akshatpradhan 11y ago
    >We are working towards implementing a badge-in option Where else in a healthcare business can you implement those?
    - rdudek 11y ago
      We already have the ability for staff to badge into any computer without typing their credentials.

KirinDave 11y ago

Exceeeeept, Edge doesn't restore those sessions or evidently do anything with this data, suggesting a regression on how the tab history is handled. I mean, good story. 6 years ago it might have even been realistic for ms. These days, the middle level product manager who did that would rapidly find themselves on a high speed track to a new employer. The Edge team isn't a bunch of faceless goons. Heck, a lot of them are really active in the browser development community and you can see they're trying really hard. As much fun as it is to carry on the Slashdot tradition and make fun of every bug at MS as indicative of a toxic and stupid culture, maybe that's not entirely appropriate anymore. I mean, it's not like Firefox and chrome haven't had bugs in this vein before. Hell, neither can fully protect repeatedly visited private urls on Android either.

scholia 11y ago
> As much fun as it is to carry on the Slashdot tradition and make fun of every bug at MS as indicative of a toxic and stupid culture, maybe that's not entirely appropriate anymore. But betanews wouldn't have very much to write about....

bargl 11y ago

This explanation made me giggle and cry a little. It also made me think of the quote from Scott Hanselman, "We're not nearly as organized as we'd need to be to be as evil as you might think we are." http://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx http://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx Microsoft is thought of as this hugely evil company, but I don't know, maybe they are just as disorganized as every other company I've worked with and the product owner doesn't understand their customers all the time. The key is some comapanies I've worked for pivot fast and fix things they see as a mistake. Others try to bury and hide it. Are they going to kill my pappy this time? I don't think so, but we'll see.

xenophon 11y ago
This heuristic, generalized, is sometimes called Hanlon's Razor: "never attribute to malice that which is adequately explained by stupidity."
- jobu 11y ago
  The razor also has a corollary in Clark's law, which states that "any sufficiently advanced incompetence is indistinguishable from malice".
- kibwen 11y ago
  I actually think that Hanlon's Razor goes too far. Allow me to present Kibwen's Corollary to Hanlon's Razor: "never attribute to stupidity that which is adequately explained by apathy".
harryjo 11y ago
Microsoft's evil was on display in open court. https://en.wikipedia.org/wiki/Halloween_documents https://en.wikipedia.org/wiki/Halloween_documents Hanselman's point was that they weren't as evil as you might think

typon 11y ago

This is too real. shudder

reader_1000 11y ago

When you try to open closed tab back (ctrl+shift+T), Chrome does not open it. I thougt this is a good way of handling history in private mode, you close the tab and everything is gone. However when I tried same thing on Firefox, I saw that Firefox happily opens the closed tab back, which surprised me. So I think while trying to find a balance between usability and privacy, browser vendors choose different paths.

aembleton 11y ago
In Firefox you create a private window, not a private tab. Inside the private window, you can have multiple tabs; closing them and restoring them. Once you close the private window everything is gone.
- oneeyedpigeon 11y ago
  Chrome also uses a private window, not private tabs. You just can't restore closed private tabs, which is probably how it should be.
  - atrotors 11y ago
    The thing is that chrome sandboxes every tab, but firefox doesn't and it's easier for firefox to restore tabs than for chrome is to do.
  - Spellman 11y ago
    Chrome fires up a separate thread for each tab. So any information about that tab is lost once the tab, (and thus sandbox) closes. No information specific to the tabs is stored in the window unless explicitly done (like bookmarking). Thus, the session history is stored inside that sandbox, so it's gone once it's closed. Firefox is maintaining a window with tabs within it. So it can still keep your session info for each tab stored at the window level and restore it even after a tab is close.
- reader_1000 11y ago
  I was talking about how tabs is handled in private window.

dabodmb 11y ago

This sounds like a very likely scenario... sad but true.

dman 11y ago

Microsoft makes a huge amount of money from enterprise sales. I would see how large companies would be worked up if employees could use private mode browsing to circumvent monitoring. I fear (without any evidence) that private browsing mode would be a tough feature to push in the enterprise space.

lreeves 11y ago
Monitoring in an enterprise environment (for browsing) works on a network level; even SSL sites are monitored by on-the-fly certificates that are trusted by the users machine. There's no need to persist history to disk for an IT team to capture that information.
- TheRealDunkirk 11y ago
  My favorite days are the one where central IT screws up the system, and we get certificate errors everywhere we go. Uh, do you think they're tracking us and snooping all supposedly secure communication? Naaaaaah. Luckily, I avoid most of those days working from home and NOT using the VPN. I SHOULD make sure I never log into something I care about (like iCloud) while on their network. The problem is that I can't get reception on my cell phone inside the building.
  - Bromlife 11y ago
    If you don't want your employer to see it, do it on your phone. Everyone should realise that by now.
slumberlust 11y ago
I disagree with this, primarily because most enterprise solutions can track your traffic independently of the browser.
jlgaddis 11y ago
Sounds like something that would be much better controlled (i.e. "disabled") at the organizational level with a group policy setting.

minusSeven 11y ago

thats looking at it from the best possible way. The way windows 10 has gone so far I really doubt which is which. Maybe they knew and didn't want people to find out. They also don't seem to give a shit about what people actually want.

bengoodger 11y ago

I don't know if this is the case, but I definitely understand how it could happen. Chrome's Incognito mode has the exact behavior of not supporting things like session restore and closed tab reopening. It's kind of annoying for those of us who occasionally use Incognito windows like a convenient transient separate profile (specifically "give me a different cookie jar because some site's login is broken"), but I think the loss of functionality is worth it given what the mode is actually /for/. It makes me wonder though if it'd be worthwhile having a mode that gives you a separate cookie jar but keeps the browser settings otherwise identical (bookmarks, suggest, etc). I suspect the distinction is too subtle for most people however.

dalore 11y ago
I used to use it for that but now with chrome profiles I've setup a new person for that called Mr Debug. It's good in that I can enable different extensions, ones that I wouldn't have enabled normally and disable the ones that interfere with dom inspections (looking at you Evernote). You can run both at once.