7 ms·

They don't say anything about "dumb users", and I wish the conversation around this didn't even use that phrase. Hardhats aren't just for clumsy people, seatbe

by ken 8y ago

They don't say anything about "dumb users", and I wish the conversation around this didn't even use that phrase. Hardhats aren't just for clumsy people, seatbelts aren't just for bad drivers, and memory protection isn't just for careless programmers. There's no shame in engineering a situation to maximize safety for the people who will use it. There's a whole lot of smart people who like static typing for the safety benefits it brings to their programming. Web browsers are the front lines: where one click on a stringly-typed reference can cause unknown third-party code to run on your computer. You are protected only by your human ability to spot the visual difference between two strings, one of which is constructed by someone trying their hardest to trick you. If you advocate for type safety within software, you should also advocate for a better system than URIs.

SllX 8y ago
Or advocate for disabling the ability for your web browser to run 3rd party code just by clicking a link. Google is not trustworthy because between Chrome and Search they have too much of a stake in the eventual outcome of anything that could replace URLs. Any system that eventually does replace URIs should be able to tell me at a glance: is it http, ftp or a local file? Is there a TLS cert? What is the domain of the server I am accessing? Approximately where in the site directory am I? I simply don’t trust browsers or sites which try to obscure what is actually useful information because some UX guru told them it was unnecessary. If anything, I want URLs with even more information. Which version of “http” is in use would be a nice start at this point.
- dagenix 8y ago
  Different resources can be loaded with different versions of http, so, I don't know how you can say which version of http is in use. But, even if you could, I struggle to see what useful decision that would enable anyone to make outside of niche cases.
- mrhappyunhappy 8y ago
  Feels like every point you mention can be designed in a user friendly way. I’m a UX designer and have some ideas for this.
  - TeMPOraL 8y ago
    Please write them down and publish somewhere; we need more proposals that empower users to be out there to see and discuss.
  - SllX 8y ago
    Good luck to you, and I mean that sincerely. I think making something “better” than the URL while maintaining its power and information is a difficult project. If you are willing to take on the challenge, more power to you.
- move-on-by 8y ago
  I agree with you, I want a User Agent to empower me as I browse the web and not hide things from me. Even if the majority of users don't understand URLs (which I dispute) - its certainly not hurting or impending them. In reference to running 3rd party code, knowing the URL is even more important as it decides what is considered 3rd party or not. When I'm on an AMP website - google is the 1st party and the content provider is now considered the 3rd party. I don't agree with allowing google to be considered the 1st party in that instance.
gear54rus 8y ago
you are actually protected by the browser's sandbox... this analogy does not address the fact that you add another party that tricks you with the removal of url and that is Google
jessriedel 8y ago
> They don't say anything about "dumb users", and I wish the conversation around this didn't even use that phrase. Hardhats aren't just for clumsy people, seatbelts aren't just for bad drivers, and memory protection isn't just for careless programmers There are frequently tradeoffs between safety and flexibility/performance/value, and the proper tradeoff to be made can depend on the sophistication of the user. So are you just upset that that a derisive word was used, or are you arguing that in this particular case the proper trade-off is independent of user sophistication?
- ken 8y ago
  Both! It's condescending because it's simultaneously suggesting that: - there's a class of users who are simply dumb - the speaker does not consider themselves to be in this class - one can avoid this hazard by being sufficiently smart none of which I agree with, and none of which I see evidence for here. Across every industry I've seen, when new safety devices are invented, old-timers brush it off as unnecessary. (Survival bias: I didn't die!) When they retire, the next generation grows up using the new safety devices, and sees no problem with it. If anything, using the safety device is a signal that you're doing something dangerous! Professional drivers wear more seatbelts, not none. The tradeoff you speak of is usually backwards from what you claim. This one is shaping up exactly the same. People who grew up with URLs are complaining that Google is trying to "hide" them, even though that's not what anyone on this project said. The generation being born today will wonder why anyone ever used a networked computer by clicking on links with zero assistance in determining whether it was at all legitimate.
  - romeisendcoming 8y ago
    You can avoid this issue through significant domain experience. Knowledge != smart. I find your assertions regarding assurance and networked computing disturbingly naive. If this 'fix' was simply altruism and a crying need it would be apparent to more of an audience than Google. This seems more like sheeps clothing and misdirection from Google - as usual.
  - jessriedel 8y ago
elihu 8y ago
> If you advocate for type safety within software, you should also advocate for a better system than URIs. Well, maybe. Before I advocate for a better system than URIs, I'd like to be convinced that this is a problem that can be solved in a satisfactory way and that the solution doesn't involve ceding control over Internet names to some unaccountable party.
NicoJuicy 8y ago
Hiding the URL has nothing to do with seatbelts on a car.
- ClassyJacket 8y ago
  That's how analogies usually go
  - huffmsa 8y ago
    It's not a good one. The seatbelt is analogous to say, double checking if you really want to download thriller.mp3.exe. Hiding the URL is like blocking out the windshield and telling the user to trust the GPS.
    - smadurange 8y ago
      I like that analogy :)
    - whoopdedo 8y ago
      Another way to look at it is if you are in an accident, a seatbelt will 99.99% of the time stop you from being ejected from the car. A hard hat will prevent your skull from fracturing when hit in the head. Goggles keep foreign matter out of your eye. The SafeBrowsing blacklist prevents Chrome from automatically loading malicious payloads on unwary users. So in what way does hiding the URL measurably stop the dangerous action? It doesn't. A less hyperbolic parallel would be how cars have changed from showing gauges for engine performance and have only a single "check engine" light for any problem detected by the ECM. That said I think this change is inevitable. My experience with non-technical users is that the URL is irrelevant Most do not know the difference between typing an address and typing a search phrase.
      - NicoJuicy 8y ago
        My brother still lives because he crashed sideways into a tree. Wearing a belt would have suffocated / decapitated him, because the car seat moved to the front.
ZoF 8y ago
This is as terrible analogy. People are not and should not be presumed to be dumb. What a cancerous mindset.
boomlinde 8y ago
> Hardhats aren't just for clumsy people, seatbelts aren't just for bad drivers, and memory protection isn't just for careless programmers. There's no shame in engineering a situation to maximize safety for the people who will use it. There's an inherent bias in the choice of analogy. There are many potential metaphors that aren't as favorable as hardhats or seat belts. How about a leash or blinders? > There's a whole lot of smart people who like static typing for the safety benefits it brings to their programming. Web browsers are the front lines: where one click on a stringly-typed reference can cause unknown third-party code to run on your computer. URIs have a rather well defined type and you can easily detect a malformed URI. The problem Google seems to intend to address, and the way they intend to address it, has nothing to do with the type of the URI but ultimately how its value should be conveyed and heuristic restrictions on what forms the values may take. This leads to situations where valid URIs are treated as invalid, based on arbitrary heuristics, not a tightening of the type of value a URI encodes. The more apparent problem, from your description, seems to be that websites can at all use your computer to execute arbitrary third-party code. Addressing this by vaguely limiting what URIs you may access is a weird way not to take the bull by the horns. To somehow hide information that is part of the URI to make it more clear what resource the URI represent is just ass-backwards.
- beaconstudios 8y ago
  > URIs have a rather well defined type and you can easily detect a malformed URI. The average internet user is unlikely to be able to detect a malicious URL. Do you think the average person can tell which of these URLs is legitimate, and owned by Example inc.? - example.com/profiles/al - example.com.profiles.al - examp1e.com/profiles/al - example.co/profiles/al etc etc. Safari already only shows the hostname to help with visual identification - this doesn't help with different-but-similar hosts, but it does help regular users to see what website they're on, if they are unfamiliar with the protocol/host/path structure of URLs. Which they shouldn't have to be.
  - module0000 8y ago
    I'm not trying to be BOFH here... but it's not unreasonable to expect web users to have the same basic knowledge of a URL that they have for a telephone number. Most(perhaps nearly all?) of telephone users in the US know that in 123-456-7890, the "123" is an area code, "456" is an exchange, and "7890" is the line number. URLs are not that different. A similar knowledge of URLs would serve users well.
deleted 8y ago
[deleted]

by ken 8y ago

SllX 8y ago

Or advocate for disabling the ability for your web browser to run 3rd party code just by clicking a link. Google is not trustworthy because between Chrome and Search they have too much of a stake in the eventual outcome of anything that could replace URLs. Any system that eventually does replace URIs should be able to tell me at a glance: is it http, ftp or a local file? Is there a TLS cert? What is the domain of the server I am accessing? Approximately where in the site directory am I? I simply don’t trust browsers or sites which try to obscure what is actually useful information because some UX guru told them it was unnecessary. If anything, I want URLs with even more information. Which version of “http” is in use would be a nice start at this point.

dagenix 8y ago
Different resources can be loaded with different versions of http, so, I don't know how you can say which version of http is in use. But, even if you could, I struggle to see what useful decision that would enable anyone to make outside of niche cases.
mrhappyunhappy 8y ago
Feels like every point you mention can be designed in a user friendly way. I’m a UX designer and have some ideas for this.
- TeMPOraL 8y ago
  Please write them down and publish somewhere; we need more proposals that empower users to be out there to see and discuss.
- SllX 8y ago
  Good luck to you, and I mean that sincerely. I think making something “better” than the URL while maintaining its power and information is a difficult project. If you are willing to take on the challenge, more power to you.
move-on-by 8y ago
I agree with you, I want a User Agent to empower me as I browse the web and not hide things from me. Even if the majority of users don't understand URLs (which I dispute) - its certainly not hurting or impending them. In reference to running 3rd party code, knowing the URL is even more important as it decides what is considered 3rd party or not. When I'm on an AMP website - google is the 1st party and the content provider is now considered the 3rd party. I don't agree with allowing google to be considered the 1st party in that instance.

gear54rus 8y ago

you are actually protected by the browser's sandbox... this analogy does not address the fact that you add another party that tricks you with the removal of url and that is Google

jessriedel 8y ago

> They don't say anything about "dumb users", and I wish the conversation around this didn't even use that phrase. Hardhats aren't just for clumsy people, seatbelts aren't just for bad drivers, and memory protection isn't just for careless programmers There are frequently tradeoffs between safety and flexibility/performance/value, and the proper tradeoff to be made can depend on the sophistication of the user. So are you just upset that that a derisive word was used, or are you arguing that in this particular case the proper trade-off is independent of user sophistication?

ken 8y ago
Both! It's condescending because it's simultaneously suggesting that: - there's a class of users who are simply dumb - the speaker does not consider themselves to be in this class - one can avoid this hazard by being sufficiently smart none of which I agree with, and none of which I see evidence for here. Across every industry I've seen, when new safety devices are invented, old-timers brush it off as unnecessary. (Survival bias: I didn't die!) When they retire, the next generation grows up using the new safety devices, and sees no problem with it. If anything, using the safety device is a signal that you're doing something dangerous! Professional drivers wear more seatbelts, not none. The tradeoff you speak of is usually backwards from what you claim. This one is shaping up exactly the same. People who grew up with URLs are complaining that Google is trying to "hide" them, even though that's not what anyone on this project said. The generation being born today will wonder why anyone ever used a networked computer by clicking on links with zero assistance in determining whether it was at all legitimate.
- romeisendcoming 8y ago
  You can avoid this issue through significant domain experience. Knowledge != smart. I find your assertions regarding assurance and networked computing disturbingly naive. If this 'fix' was simply altruism and a crying need it would be apparent to more of an audience than Google. This seems more like sheeps clothing and misdirection from Google - as usual.
- jessriedel 8y ago

elihu 8y ago

> If you advocate for type safety within software, you should also advocate for a better system than URIs. Well, maybe. Before I advocate for a better system than URIs, I'd like to be convinced that this is a problem that can be solved in a satisfactory way and that the solution doesn't involve ceding control over Internet names to some unaccountable party.

NicoJuicy 8y ago

Hiding the URL has nothing to do with seatbelts on a car.

ClassyJacket 8y ago
That's how analogies usually go
- huffmsa 8y ago
  It's not a good one. The seatbelt is analogous to say, double checking if you really want to download thriller.mp3.exe. Hiding the URL is like blocking out the windshield and telling the user to trust the GPS.
  - smadurange 8y ago
    I like that analogy :)
  - whoopdedo 8y ago
    Another way to look at it is if you are in an accident, a seatbelt will 99.99% of the time stop you from being ejected from the car. A hard hat will prevent your skull from fracturing when hit in the head. Goggles keep foreign matter out of your eye. The SafeBrowsing blacklist prevents Chrome from automatically loading malicious payloads on unwary users. So in what way does hiding the URL measurably stop the dangerous action? It doesn't. A less hyperbolic parallel would be how cars have changed from showing gauges for engine performance and have only a single "check engine" light for any problem detected by the ECM. That said I think this change is inevitable. My experience with non-technical users is that the URL is irrelevant Most do not know the difference between typing an address and typing a search phrase.
    - NicoJuicy 8y ago
      My brother still lives because he crashed sideways into a tree. Wearing a belt would have suffocated / decapitated him, because the car seat moved to the front.

ZoF 8y ago

This is as terrible analogy. People are not and should not be presumed to be dumb. What a cancerous mindset.

boomlinde 8y ago

> Hardhats aren't just for clumsy people, seatbelts aren't just for bad drivers, and memory protection isn't just for careless programmers. There's no shame in engineering a situation to maximize safety for the people who will use it. There's an inherent bias in the choice of analogy. There are many potential metaphors that aren't as favorable as hardhats or seat belts. How about a leash or blinders? > There's a whole lot of smart people who like static typing for the safety benefits it brings to their programming. Web browsers are the front lines: where one click on a stringly-typed reference can cause unknown third-party code to run on your computer. URIs have a rather well defined type and you can easily detect a malformed URI. The problem Google seems to intend to address, and the way they intend to address it, has nothing to do with the type of the URI but ultimately how its value should be conveyed and heuristic restrictions on what forms the values may take. This leads to situations where valid URIs are treated as invalid, based on arbitrary heuristics, not a tightening of the type of value a URI encodes. The more apparent problem, from your description, seems to be that websites can at all use your computer to execute arbitrary third-party code. Addressing this by vaguely limiting what URIs you may access is a weird way not to take the bull by the horns. To somehow hide information that is part of the URI to make it more clear what resource the URI represent is just ass-backwards.

beaconstudios 8y ago
> URIs have a rather well defined type and you can easily detect a malformed URI. The average internet user is unlikely to be able to detect a malicious URL. Do you think the average person can tell which of these URLs is legitimate, and owned by Example inc.? - example.com/profiles/al - example.com.profiles.al - examp1e.com/profiles/al - example.co/profiles/al etc etc. Safari already only shows the hostname to help with visual identification - this doesn't help with different-but-similar hosts, but it does help regular users to see what website they're on, if they are unfamiliar with the protocol/host/path structure of URLs. Which they shouldn't have to be.
- module0000 8y ago
  I'm not trying to be BOFH here... but it's not unreasonable to expect web users to have the same basic knowledge of a URL that they have for a telephone number. Most(perhaps nearly all?) of telephone users in the US know that in 123-456-7890, the "123" is an area code, "456" is an exchange, and "7890" is the line number. URLs are not that different. A similar knowledge of URLs would serve users well.

deleted 8y ago

[deleted]