3 ms·

Perhaps more accurate to say "Taking steps to manage traffic is the responsibility of a content host." People make HTTP requests for all kinds of reasons. If y

Perhaps more accurate to say "Taking steps to manage traffic is the responsibility of a content host." People make HTTP requests for all kinds of reasons. If you don't have someone managing your hosting, the responsibility defaults to you. That's one of the reasons there's an ecosystem of cloud providers now to shoulder the burden of this implementation detail that people don't want to know just to make content available online. But the core point stands: It's the Internet. You can't trust the clients to behave; assume the worst of user input. Calling out Daily Mail as terrible (which they are, and which people should do at every opportunity ;) ) doesn't solve the root problem that nothing about the protocols restricts using <iframe> to pull in cross-domain content.

Silhouette 11y ago
If you don't have someone managing your hosting, the responsibility defaults to you. That's one of the reasons there's an ecosystem of cloud providers now to shoulder the burden of this implementation detail that people don't want to know just to make content available online. I think it is extremely dangerous to argue that anyone who wants to publish safely on the Internet should be required to do so via some huge cloud provider. We shouldn't conflate what is technically possible because our old protocols give too much trust with what we consider ethical or legal. You can't trust the clients to behave; assume the worst of user input. By the same argument, spammers and those PPI cold callers are OK, because we agreed to have e-mail accounts and phones. In reality, bad actors like this screw up the system for everyone, and dealing with people who screw things up for other people is why we have laws. Treating negligence or particularly actively hostile action as the victim's fault is usually a very bad idea.

Silhouette 11y ago

If you don't have someone managing your hosting, the responsibility defaults to you. That's one of the reasons there's an ecosystem of cloud providers now to shoulder the burden of this implementation detail that people don't want to know just to make content available online. I think it is extremely dangerous to argue that anyone who wants to publish safely on the Internet should be required to do so via some huge cloud provider. We shouldn't conflate what is technically possible because our old protocols give too much trust with what we consider ethical or legal. You can't trust the clients to behave; assume the worst of user input. By the same argument, spammers and those PPI cold callers are OK, because we agreed to have e-mail accounts and phones. In reality, bad actors like this screw up the system for everyone, and dealing with people who screw things up for other people is why we have laws. Treating negligence or particularly actively hostile action as the victim's fault is usually a very bad idea.