5 ms·

The security model of the internet is whack. Javascript should be opt-in, especially from 3rd party sources. "This website wants/requires javascript for an enha

by simias 9y ago

The security model of the internet is whack. Javascript should be opt-in, especially from 3rd party sources. "This website wants/requires javascript for an enhanced viewing experience [allow/deny]". Instead not only will any stock browser gladly run anything thrown at it, it will also accept any cookies and now run WebGL code, trigger DRM engines and various other things. All that because the engineers who wrote the standards had enough hubris to think that a turing complete language with access to such a large API surface (from the DOM to the GPU to threads to a lot of the browser state) could be successfully sandboxed. The web is a lost cause as far I'm concerned, it was under-engineered at the start and as a result people kept pilling mounds of crap on top to make up for it. What started as a way to display basic markup and images has been arm wrestled into handling complex web applications and videogames. The thing is so complex that it would probably take me less time to write a basic operating system and run Firefox on it than implementing my own browser from scratch on Linux. And despite all of this you end up having to use a billion of 3rd party javascript libraries to do anything remotely complex in the browser, things that have been standard in Qt or GTK since forever with a fraction of the code base and memory footprint. And now people seem to enjoy reimplementing all the internet protocols on top of HTTP. The world has gone mad. I'm going to get a "gopher should've won" tatoo and live in as an hermit on some nearby mountain. I'm glad that there appears to be a lot of discussion surrounding internet privacy lately, including in the mainstream. However I think that focusing all the discussion of Facebook is becoming counter-productive. Facebook exploited the weaknesses of the web very successfully but it only exploited tools that existed long before it was created. I have absolutely no illusion that Google & friends are doing pretty much the same thing, and if you have an Android phone the amount of info Google can harvest is nothing short of terrifying when you think about it from an Orwellian perspective. Don't miss the forest for the Facetree. Assuming that internet giants will adhere to some "code of conduct" is naive at best. "Do no evil", yeah right. We let them have to tools to do these things, we need to pry some of them away from their hands through technology and regulation (probably in that order).

eeZah7Ux 9y ago
Spot on. And most of website should not even need javascript but some simple extension to xhtml to allow interactive websites in a declarative fashion rather than having a Turing-complete language.
- janvidar 9y ago
  CSS is Turing-complete. https://news.ycombinator.com/item?id=2300836 https://news.ycombinator.com/item?id=2300836 (2011) https://news.ycombinator.com/item?id=10734966 https://news.ycombinator.com/item?id=10734966 (2015)
  - ChrisSD 9y ago
    Those comment threads dispute that claim.
  - eeZah7Ux 9y ago
    So?
    - professor_plum 9y ago
      So using CSS, one can fingerprint a browser and communicate that information back to home base by programmatic inclusion of font A or font B. This inclusion triggers the download from the respective URL, thus giving that URL information about the user.
  - gkya 9y ago
    Yeah so is Power Point too.
cornholio 9y ago
> a turing complete language with access to such a large API surface (from the DOM to the GPU to threads to a lot of the browser state) could be successfully sandboxed. I wonder why you say that. I concede that web has evolved from no-security in the 90s, when random applets and ActiveX controls were 1-click away from rooting your machine, through faulty security in 2000s, where stack smashing IE was a hobby of mine, and up to the current era of sandboxes. Which do work, sandbox evasion zero days have become very rare and remote execution has largely ceased to be an infection vector against the masses. The problem with 3rd party tracking is not technological, the web was deliberately engineered to work in this manner. The browsers work exactly as specified, and that specification is the problem. It's compounded then as a political problem, where major browser investment are controlled by advertising companies that have a massive conflict of interest regarding the users privacy, and are likely to promote bandaids like "Do not track" instead of the fundamental privacy re-engineering the web urgently requires. > The world has gone mad. I'm going to get a "gopher should've won" tatoo and live in as an hermit on some nearby mountain. When I'm thinking like this is usually a sign of age. Hang in there buddy, we'll be fine. There is a promised land just around the corner with rich, secure web applications and strong privacy. If only everybody agreed we want it.
- simias 9y ago
  >Which do work, sandbox evasion zero days have become very rare and remote execution has largely ceased to be an infection vector against the masses. I consider that the widespread fingerprinting and user tracking is a form of sandbox evasion but I agree that it goes way beyond JS. The only identifying info that ought to be sent to some website by default is your IP address since it's necessary to actually send you back the data. Having the size of my view port, the version of my browser and OS, the type of video codecs I support and other shenanigans shouldn't leave my browser without my consent. The problem is that I can easily spoof most of my browser's info but JS makes it almost impossible to sanitize everything. >The problem with 3rd party tracking is not technological, the web was deliberately engineered to work in this manner. The browsers work exactly as specified, and that specification is the problem How is that not a complete contradiction? I'm not saying it's a bug, I know very well it's just a huge dump of features that keeps pouring in year after year. I'm just saying that web standards are the embodiment of "we were so preoccupied with whether or not we could that we didn't stop to think if we should". IMO there are broadly two different use cases for the web currently: Web applications like Google Docs on one hand and glorified PDF reader for mostly static content like HN, internet forums, news websites, Wikipedia etc... on the other. Web Apps are the part that require this ridiculous complexity to expose rich content. That's the stuff you'd use Java applets, XUL, Flash or ActiveX for in the past. Those apps could be whitelisted on a site-by-site basis in the same way that you install an app on your smartphone for instance. You know that you expose yourself to bugs and privacy leakages but you know what you're in for. 99% of the websites I browse everyday don't expose any functionality that ought to require any form of interactive scripting or advanced features beyond displaying text and images (and maybe video). Yet my browser will gladly let them access all these advanced APIs by default, load custom fonts, let them run code on my GPU, make 3rd party requests, mine cryptocurrencies... That's just ridiculous. The safest code is code that doesn't run. >When I'm thinking like this is usually a sign of age Come on, we're not old, we're wise! At least I hope so...
maxerickson 9y ago
Javacript running automatically is a decision made at the user agent level, it isn't really part of the "internet" security model. If browsers didn't run scripts automatically I think that would be the #1 support question, "How do I turn off those prompts!?".
- jhasse 9y ago
  Prompts could include a checkbox "Allow scripts for all sites". Also: Some user would ask the site's support about the prompts, not the browser's, which would be an incentive to get rid of JavaScript for the site.
arpa 9y ago
Hear hear! Is a mountain next to you occupied yet?

by simias 9y ago

eeZah7Ux 9y ago

Spot on. And most of website should not even need javascript but some simple extension to xhtml to allow interactive websites in a declarative fashion rather than having a Turing-complete language.

janvidar 9y ago
CSS is Turing-complete. https://news.ycombinator.com/item?id=2300836 https://news.ycombinator.com/item?id=2300836 (2011) https://news.ycombinator.com/item?id=10734966 https://news.ycombinator.com/item?id=10734966 (2015)
- ChrisSD 9y ago
  Those comment threads dispute that claim.
- eeZah7Ux 9y ago
  So?
  - professor_plum 9y ago
    So using CSS, one can fingerprint a browser and communicate that information back to home base by programmatic inclusion of font A or font B. This inclusion triggers the download from the respective URL, thus giving that URL information about the user.
- gkya 9y ago
  Yeah so is Power Point too.

cornholio 9y ago

> a turing complete language with access to such a large API surface (from the DOM to the GPU to threads to a lot of the browser state) could be successfully sandboxed. I wonder why you say that. I concede that web has evolved from no-security in the 90s, when random applets and ActiveX controls were 1-click away from rooting your machine, through faulty security in 2000s, where stack smashing IE was a hobby of mine, and up to the current era of sandboxes. Which do work, sandbox evasion zero days have become very rare and remote execution has largely ceased to be an infection vector against the masses. The problem with 3rd party tracking is not technological, the web was deliberately engineered to work in this manner. The browsers work exactly as specified, and that specification is the problem. It's compounded then as a political problem, where major browser investment are controlled by advertising companies that have a massive conflict of interest regarding the users privacy, and are likely to promote bandaids like "Do not track" instead of the fundamental privacy re-engineering the web urgently requires. > The world has gone mad. I'm going to get a "gopher should've won" tatoo and live in as an hermit on some nearby mountain. When I'm thinking like this is usually a sign of age. Hang in there buddy, we'll be fine. There is a promised land just around the corner with rich, secure web applications and strong privacy. If only everybody agreed we want it.

simias 9y ago
>Which do work, sandbox evasion zero days have become very rare and remote execution has largely ceased to be an infection vector against the masses. I consider that the widespread fingerprinting and user tracking is a form of sandbox evasion but I agree that it goes way beyond JS. The only identifying info that ought to be sent to some website by default is your IP address since it's necessary to actually send you back the data. Having the size of my view port, the version of my browser and OS, the type of video codecs I support and other shenanigans shouldn't leave my browser without my consent. The problem is that I can easily spoof most of my browser's info but JS makes it almost impossible to sanitize everything. >The problem with 3rd party tracking is not technological, the web was deliberately engineered to work in this manner. The browsers work exactly as specified, and that specification is the problem How is that not a complete contradiction? I'm not saying it's a bug, I know very well it's just a huge dump of features that keeps pouring in year after year. I'm just saying that web standards are the embodiment of "we were so preoccupied with whether or not we could that we didn't stop to think if we should". IMO there are broadly two different use cases for the web currently: Web applications like Google Docs on one hand and glorified PDF reader for mostly static content like HN, internet forums, news websites, Wikipedia etc... on the other. Web Apps are the part that require this ridiculous complexity to expose rich content. That's the stuff you'd use Java applets, XUL, Flash or ActiveX for in the past. Those apps could be whitelisted on a site-by-site basis in the same way that you install an app on your smartphone for instance. You know that you expose yourself to bugs and privacy leakages but you know what you're in for. 99% of the websites I browse everyday don't expose any functionality that ought to require any form of interactive scripting or advanced features beyond displaying text and images (and maybe video). Yet my browser will gladly let them access all these advanced APIs by default, load custom fonts, let them run code on my GPU, make 3rd party requests, mine cryptocurrencies... That's just ridiculous. The safest code is code that doesn't run. >When I'm thinking like this is usually a sign of age Come on, we're not old, we're wise! At least I hope so...

maxerickson 9y ago

Javacript running automatically is a decision made at the user agent level, it isn't really part of the "internet" security model. If browsers didn't run scripts automatically I think that would be the #1 support question, "How do I turn off those prompts!?".

jhasse 9y ago
Prompts could include a checkbox "Allow scripts for all sites". Also: Some user would ask the site's support about the prompts, not the browser's, which would be an incentive to get rid of JavaScript for the site.

arpa 9y ago

Hear hear! Is a mountain next to you occupied yet?