6 ms·
One thing I used to love about websites is that I knew once I closed the tab the site was gone forever and it was not allowed to execute any more code. That was
by jahvo 8y ago
One thing I used to love about websites is that I knew once I closed the tab the site was gone forever and it was not allowed to execute any more code. That was heaven.
But now with web workers and service workers and god knows what else, I feel like I've lost that security, and that makes me uneasy. It's a security and a privacy issue.
I know I can disable all that stuff in about:config but how do I know they haven't invented some other new technology in the past months that I should be aware of?
- manojlds 8y agoAdd to that things like cryptocurrency mining by ads and other scripts on websites.
- osrec 8y agoI can eventually see the mechanisms for informing users changing. I would imagine that in the next few browser releases, granular control of JavaScript features will be more accessible, especially as they provide access to more native features.
- gkya 8y agoI find that tge only way to use web securely is to disable JS alltogether except for a few hand-picked web pages. I use qurebrowser for that, and chromium for some nasty web apps I have to use.
- _sdegutis 8y agoI'm not one to be super paranoid about security and privacy on websites, but the other day I was working on a PWA for the first time for a new client, and when I clicked "show service workers from other domains" in Chrome, I see community.aseprite.org, discourse.gohugo.io, vuejs.org, forums.dotnetfoundation.org, lodash.com, www.cnet.com, www.meetup.com, www.google.com/maps, www.pinterest.com, www.wired.com, and xhr.spec.whatwg.org. I get why half of these sites think they need it (the news websites and web 3.0 forums, so they can update themselves in the background maybe?) but service workers for the lodash, whatwg, vuejs sites? This seems just plain unnecessary.
- jahvo 8y agoExactly my same feeling. And what's worse, is that I don't really know what those entries (.js files) can do. Can they exec code whenever they want? Or every hour? Or every minute? Can they see what I do? Can they call home (and know my IP even if I'm not visiting those websites)? Why do I have to read a technical spec to learn about this?
- rched 8y agoTo my knowledge they can only execute code in response to a network event. Usually this means you need to take some action to trigger an outgoing network request, like returning to the site that installed the service worker. Code execution can also be triggered by incoming network events such as push notifications but these would require you to have allowed push notifications from that site.
- manigandham 8y agoThose other sites do it so that they're available offline. Service Workers give you control over network caching so you can return an cached/offline copy of the content.
- _sdegutis 8y agoI remember when this was actually a feature of web browsers. In the File menu you could just click "Offline mode" when you were offline, and it would return everything from cache. And then one day that menu option was just gone. Now the web has an opt-in way for sites to do this themselves. It feels pretty convoluted. Then again Web 3.0 feels pretty convoluted in general. It's as if the iPhone SDK came out and suddenly set the standard on how convoluted development ought to be, and every other platform followed suit.
- manigandham 8y agoFirefox has it. Menu > More > Work Offline.
- icc97 8y agoBut surely this is an implicit assumption in having something work offline. It has to store something locally. It does make sense to make it more obvious, like requesting access to store offline content or perhaps having an options tab similar to the addons in a browser or the add/remove programs in Windows that lists all the service workers that are installed.
- jahvo 8y agoI don't want websites to work offline. Also, it bothers me that websites can install themselves like that without my permission or knowledge.
- icc97 8y agoThe way I see it, offline isn't primarily designed for websites, it's to replace apps that you'd install on you phone. I agree on the installation confirmation - you have to agree before installing an app and the whole point of the blog post is that the line between a native app and a service worker site is getting smaller. So a similar level of permission should be requested before installing something locally.
- kilburn 8y agoIn firefox (about:config): dom.serviceWorkers.enabled = false