4 ms·

I could just as easily say you don't value your privacy and security as much as novelty since you are going to arbitrary websites. People find zero days in ima

by esrauch 10y ago

I could just as easily say you don't value your privacy and security as much as novelty since you are going to arbitrary websites. People find zero days in image renderers, how do you justify not disabling image rendering? Your user agent and your browsers supported TLS configs are leaking who you are, how do you justify sending that info to every random web server? Even just being on hackernews right now proves you are accepting a negative security impact for some novelty value.

zeveb 10y ago
> People find zero days in image renderers, how do you justify not disabling image rendering? Rather more rarely than they do in JavaScript. But that's why lynx, links, elinks, w3m, emacs-w3m, eww & friends are so important! But yes, if one wishes to render an image, then one must render an imagine. But why would one wish to execute JavaScript, when one only wishes to read text? I've no objection to executing JavaScript when it's required for an app (although I do object to apps which could be more cleanly delivered as pages). > Your user agent and your browsers supported TLS configs are leaking who you are, how do you justify sending that info to every random web server? Because it's a requirement to use TLS. JavaScript is not a requirement to read articles or listicles (which are the vast majority of the pages targeted by AMP); people who demand JavaScript in order to display text and images are breaking the Web, and endangering their users' security and privacy. I really am curious what the folks who are so eagerly downvoting me are thinking. Are they thinking (i.e., do they have persuasive counterarguments), or are they just feeling (i.e., are they reacting emotionally, without a rational basis)? I genuinely wonder what possible objection they can have to 'that JavaScript enables privacy and security exploits is neither a position nor an opinion but the truth'; AFAICT it's as objectionable as pointing out that the sky is often blue or that fire is hot.
- andybak 10y ago
  I think you're largely getting downvoted because of your tone.

by esrauch 10y ago

zeveb 10y ago

> People find zero days in image renderers, how do you justify not disabling image rendering? Rather more rarely than they do in JavaScript. But that's why lynx, links, elinks, w3m, emacs-w3m, eww & friends are so important! But yes, if one wishes to render an image, then one must render an imagine. But why would one wish to execute JavaScript, when one only wishes to read text? I've no objection to executing JavaScript when it's required for an app (although I do object to apps which could be more cleanly delivered as pages). > Your user agent and your browsers supported TLS configs are leaking who you are, how do you justify sending that info to every random web server? Because it's a requirement to use TLS. JavaScript is not a requirement to read articles or listicles (which are the vast majority of the pages targeted by AMP); people who demand JavaScript in order to display text and images are breaking the Web, and endangering their users' security and privacy. I really am curious what the folks who are so eagerly downvoting me are thinking. Are they thinking (i.e., do they have persuasive counterarguments), or are they just feeling (i.e., are they reacting emotionally, without a rational basis)? I genuinely wonder what possible objection they can have to 'that JavaScript enables privacy and security exploits is neither a position nor an opinion but the truth'; AFAICT it's as objectionable as pointing out that the sky is often blue or that fire is hot.

andybak 10y ago
I think you're largely getting downvoted because of your tone.