5 ms·

I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better

by na85 10y ago

I note without surprise that most of this tracking leverages JavaScript. When do we say that enough is enough? When do we finally agree that the web was better without JavaScript tracking us everywhere we go, and when do we finally admit that not all ideas (JavaScript) were good ideas? My browser works against me these days. Sad times.

EGreg 10y ago
It is similar to macros in Word documents
- na85 10y ago
  Is it, though? To the best of my knowledge, macros don't execute by default, silently, and in so doing facilitate my being tracked by people wanting to sell me generic brand pharmaceuticals.
  - zeveb 10y ago
    Yes, JavaScript is worse than Word macros — and they are terrible!
    - EGreg 10y ago
      If it's so bad then turn it off :)
netsharc 10y ago
Throwing web-interactivity (via Javascript) away today is like throwing your computer away. Computers help you be more productive, but it also helps the people who want to profile you. What's the alternative? If it's not Javascript, any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way. Maybe we should disallow hardware access, how will YouTube play videos? Should we all install youtubeplayer.exe ?
- mikegerwitz 10y ago
  JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. Almost worse: is does so silently without the user's knowledge, and has the illusion of remote execution, misleading the user into thinking no software is actually running on their own computer.
  - Silhouette 10y ago
    JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device. A few tricks to detect some environment-based signals and invade privacy might be undesirable, but that intrusion is nothing compared to the kind of stunts native software has pulled over the years, and the major desktop and mobile operating systems are pathetically ineffective at sandboxing that software compared to what browsers do with JS, even taking into account the unwanted side effects of recently expanded capabilities that we're discussing here.
    - omginternets 10y ago
      >It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device. That's missing the point. With respect to tracking a user, most of those restrictions don't matter. Your browser does download/execute untrusted, unsigned, arbitrary, ephemeral code that can do any kind of tracking it wants.
      - Silhouette 10y ago
        And compared to the kinds of technologies used for copy protection and telemetry in native applications, what JS can do within a browser is still very limited. Yes, the browser executes JS code from untrusted sources, but only if you visit a page that loads scripts from those sources, and always (barring security bugs) within a sandbox that limits their capabilities. I fail to see how this can possibly be any worse than installing software in other ways such as running a native executable you downloaded from somewhere, or following a "curl | sh" installation process as advocated by plenty of popular OSS tools, or allowing native software that you already installed to install arbitrary automatic updates that it fetches from remote sources. The argument netsharc made was essentially that turning off JS would disable a lot of useful functionality for a lot of people, and that providing that functionality would still involve similar risks if it were done some other way. The reply from mikegerwitz argued that JS is different, but I still don't see how. The relevant comparison isn't against just turning JS off, it's against turning JS off and implementing the same functionality some other way, and compared to the sandboxed environment of JS, the most likely alternatives with today's technology would be even worse in terms of security and privacy.
mikegerwitz 10y ago
There's numerous issues with executing untrusted, ephemeral code on the client---with both security and freedom. I gave a talk addressing some of it at LibrePlanet 2016 last year: https://media.libreplanet.org/u/libreplanet/collection/restore-online-freedom/ https://media.libreplanet.org/u/libreplanet/collection/resto...
colept 10y ago
The problem is not Javascript - throwing out JavaScript is like throwing out your utensils because your meal is too sweet. The problem is browsers are made by advertising entities that also leverage these same abilities.
- thinkling 10y ago
  Are you implying that Firefox hasn't solved this problem only because Mozilla takes money from Google for search referrals?

by na85 10y ago

EGreg 10y ago

It is similar to macros in Word documents

na85 10y ago
Is it, though? To the best of my knowledge, macros don't execute by default, silently, and in so doing facilitate my being tracked by people wanting to sell me generic brand pharmaceuticals.
- zeveb 10y ago
  Yes, JavaScript is worse than Word macros — and they are terrible!
  - EGreg 10y ago
    If it's so bad then turn it off :)

netsharc 10y ago

Throwing web-interactivity (via Javascript) away today is like throwing your computer away. Computers help you be more productive, but it also helps the people who want to profile you. What's the alternative? If it's not Javascript, any functionality that offers access to the hardware (via however many layers) to "apps" from the "cloud" can be exploited this way. Maybe we should disallow hardware access, how will YouTube play videos? Should we all install youtubeplayer.exe ?

mikegerwitz 10y ago
JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. Almost worse: is does so silently without the user's knowledge, and has the illusion of remote execution, misleading the user into thinking no software is actually running on their own computer.
- Silhouette 10y ago
  JS is different---your browser automatically downloads and executes untrusted, unsigned, arbitrary, ephemeral code that can do whatever it feels like. It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device. A few tricks to detect some environment-based signals and invade privacy might be undesirable, but that intrusion is nothing compared to the kind of stunts native software has pulled over the years, and the major desktop and mobile operating systems are pathetically ineffective at sandboxing that software compared to what browsers do with JS, even taking into account the unwanted side effects of recently expanded capabilities that we're discussing here.
  - omginternets 10y ago
    >It really doesn't. There are severe limits on what JS downloaded from some random site can do via a browser on your local device. That's missing the point. With respect to tracking a user, most of those restrictions don't matter. Your browser does download/execute untrusted, unsigned, arbitrary, ephemeral code that can do any kind of tracking it wants.
    - Silhouette 10y ago
      And compared to the kinds of technologies used for copy protection and telemetry in native applications, what JS can do within a browser is still very limited. Yes, the browser executes JS code from untrusted sources, but only if you visit a page that loads scripts from those sources, and always (barring security bugs) within a sandbox that limits their capabilities. I fail to see how this can possibly be any worse than installing software in other ways such as running a native executable you downloaded from somewhere, or following a "curl | sh" installation process as advocated by plenty of popular OSS tools, or allowing native software that you already installed to install arbitrary automatic updates that it fetches from remote sources. The argument netsharc made was essentially that turning off JS would disable a lot of useful functionality for a lot of people, and that providing that functionality would still involve similar risks if it were done some other way. The reply from mikegerwitz argued that JS is different, but I still don't see how. The relevant comparison isn't against just turning JS off, it's against turning JS off and implementing the same functionality some other way, and compared to the sandboxed environment of JS, the most likely alternatives with today's technology would be even worse in terms of security and privacy.

mikegerwitz 10y ago

There's numerous issues with executing untrusted, ephemeral code on the client---with both security and freedom. I gave a talk addressing some of it at LibrePlanet 2016 last year: https://media.libreplanet.org/u/libreplanet/collection/restore-online-freedom/ https://media.libreplanet.org/u/libreplanet/collection/resto...

colept 10y ago

The problem is not Javascript - throwing out JavaScript is like throwing out your utensils because your meal is too sweet. The problem is browsers are made by advertising entities that also leverage these same abilities.

thinkling 10y ago
Are you implying that Firefox hasn't solved this problem only because Mozilla takes money from Google for search referrals?