4 ms·

> I've been making web things for a long time. I've been making internet things since before the "web" existed. > Forums didn't really exist on the web back t

by pdkl95 8y ago

> I've been making web things for a long time. I've been making internet things since before the "web" existed. > Forums didn't really exist on the web back then Gopher didn't really have the necessary interactivity, but nobody cared at the time because if you wanted to talk about something in a global forum, you used NNTP (or email lists). The web (HTML+HTTP) had comment/forums/etc from the very beginning, because it was designed with IBM 3270 style form submission features (<form>/<input> tags and HTTP POST). I used these (and other interactive features) regularly in text browsers over my 2400 baud modem. Even if I had better bandwidth, there was no way I could run NCSA Mosaic in the 4MB of RAM installed on my 386DX. Yes, it was slow, but submitting comments only required special support by the server, which then returned a new hypertext document to the client. The feature that arrived later was Javascript, allowing some features to be done directly on the client. However, this was not a necessary required for writing forums software; that always worked as server side software. Shoving everything into the client didn't create many new opportunities; a lot of that existed already in separate software. What did happen is we attached everything to the same single point of failure and created a lot of security problems because risk is transitive.

cromwellian 8y ago
No, what we did was trade off one set of security problems to having dozens of clients for every TCP protocol (IRC, NNTP, SMTP, IMAP, FTP, WAIS, Gopher, fingerd, etc) with their own set of security flaws, but which had less oversight, and that gets you things like the Morris worm. And because every one of these had their own rigorous protocol, and their own binary clients, if there was a flaw in the protocol itself, it could take ages to get a fix to the protocol from the IETF and all clients deployed with the fixes. So for example, the obvious and horrible security of usenet led to the first massive spam bots, which then led to a bunch of even more horrible mitigations like Cancelbots, which led to a bunch of counter-mitigations like Resurrector-bots. These days, with ephemeral, mobile code, a security hole in the client/server protocol of a particular app can be fixed in an instant and rolled out to everyone. And the Web is better at this than the native mobile or desktop platforms, now behind curated App Stores, with a lower update frequency, and whose very closed-source curation process means they don't get as much rigorous testing as the Web in running untrusted code. The Web has been running untrusted global scale mobile code for decades now, and most of the exploits on the Web have occurred as a result of bad server programming, not holes in Javascript. So Web 1.0 request/response apps won't save you, all it will do is punish everyone with bad latency and higher server loads.

by pdkl95 8y ago

cromwellian 8y ago

No, what we did was trade off one set of security problems to having dozens of clients for every TCP protocol (IRC, NNTP, SMTP, IMAP, FTP, WAIS, Gopher, fingerd, etc) with their own set of security flaws, but which had less oversight, and that gets you things like the Morris worm. And because every one of these had their own rigorous protocol, and their own binary clients, if there was a flaw in the protocol itself, it could take ages to get a fix to the protocol from the IETF and all clients deployed with the fixes. So for example, the obvious and horrible security of usenet led to the first massive spam bots, which then led to a bunch of even more horrible mitigations like Cancelbots, which led to a bunch of counter-mitigations like Resurrector-bots. These days, with ephemeral, mobile code, a security hole in the client/server protocol of a particular app can be fixed in an instant and rolled out to everyone. And the Web is better at this than the native mobile or desktop platforms, now behind curated App Stores, with a lower update frequency, and whose very closed-source curation process means they don't get as much rigorous testing as the Web in running untrusted code. The Web has been running untrusted global scale mobile code for decades now, and most of the exploits on the Web have occurred as a result of bad server programming, not holes in Javascript. So Web 1.0 request/response apps won't save you, all it will do is punish everyone with bad latency and higher server loads.