2 ms·
More or less than if browsers had blocked Flash say 3 years ago? Because I think that's the standard. If they can do it for Flash, then they can do it for anyt
by mtgx 10y ago
More or less than if browsers had blocked Flash say 3 years ago?
Because I think that's the standard. If they can do it for Flash, then they can do it for anything else, too. They just need to set a deadline with a reasonable amount of time before it's reached so that all developers can adhere to the new specs.
I really hate the attitude of "well, too many websites/apps would be broken so I guess we'll never do it, or we'll just wait for the web to collapse first so that everyone agrees we should do it" from "platform" (in this case browser) vendors.
If it's that bad, then just set a 2 year, 3 year, or even 5 year deadline for the change (perhaps with some intermediary progressive blocking, like it's happening for Flash).
It pisses me off because it seems the same is happening with ASLR on Linux [1]. We've had it for 15 years, but nobody is willing to force developers to use it "because it would break things". Screw that. Set a deadline and do it already. If their apps can't make such a change in 3 years, then I could care less that their apps will stop working. Critical vulnerabilities that allow dangerous exploits to happen also "break a lot of things", and not just themselves either, but the firefighting patches that come after them, too.
[1] https://lwn.net/SubscriberLink/708196/845f9287f1936dcf/ https://lwn.net/SubscriberLink/708196/845f9287f1936dcf/
- shakna 10y agoI have no problems breaking the existing web for a more secure web tomorrow. None whatsoever. I've been highly irritated by people freaking out that Flash is started to get blocked - despite it being deprecated in those browsers for years. It wasn't exactly a surprise. But I guess that's the crap that hits us. No one will make a damned change till they're forced to do it right now. I'm somewhat sick of advertising networks serving malware. JavaScript is Turing Complete, and leaky as hell. There is no safe way to use it for ads, so don't let you clients use it! The modern web relying on huge megabytes worth of data has led to us needing CDNs and other 3rd party providers. Anytime a websites uses a 3rd party provider, it opens a hole in itself, and with the insane complexity of a modern browser... That's just asking for trouble. But asking Google to give up the practices they use to forward their own agendas, like advertising, and their walled garden of AMP, won't happen. Chrome has the usage that it can exhibit considerable force on the other browsers, and the reverse isn't true. EDIT: In other words, I completely agree with you, but cry when I see that state of things. Just want that to be clear.