6 ms·

Downgrading the prompt to a non-popup icon in the address bar unless it follows a user action sounds like the perfect balance. This won’t entirely stop sites w

by zaroth 8y ago

Downgrading the prompt to a non-popup icon in the address bar unless it follows a user action sounds like the perfect balance. This won’t entirely stop sites which are properly trying to request the permission in the worst case, and the navbar icon is unobtrusive enough that if it gets spammed it’s no big deal. Actually I think it makes sense to persistently show the notification icon in the navbar once the permission has been granted (same with mic, audio, and anything else) providing a quick glance at any privs that have been granted and an obvious way to revoke them. The icons would then need granted and non-granted states, and perhaps even three states; - Black : requested but not authorized - Black with green check : granted - Grey with red x: requested and denied

barryvan 8y ago
> Downgrading the prompt to a non-popup icon in the address bar unless it follows a user action sounds like the perfect balance. Agreed. If it's in direct response to a user action (a sync response to a click or a tap on an element smaller than 300x300px, for example), I think it's perhaps more legitimate to have a more visible indication, like a strip across the top. (I'd want the element size constrained to avoid issues with sites adding `onClick` handlers to the `<body>` element or similar.) > Actually I think it makes sense to persistently show the notification icon in the navbar once the permission has been granted (same with mic, audio, and anything else) providing a quick glance at any privs that have been granted and an obvious way to revoke them. I believe Firefox already does this. It also shows you privileges which you've explicitly denied -- for example, if you disallow location access, you'll see a slashed compass next to the (i) button in the Awesomebar.
- a_t48 8y ago
  A nice tiling of invisible squares across the page can get around your element size restriction.
  - lugg 8y ago
    Do we even need the restriction. We're talking about spammyness of a UI element because access requests are misaligned with user desire. All you're saying is the site will pop up a request for access whenever I do anything, ok, how is that different to what we have no? It's not going to be the norm, it's just going to be a few bad actors. Doesn't mean we put up with spam everywhere else.
IshKebab 8y ago
Aren't there already sites that show a fake permission request dialog? This won't stop them (and I don't see how you could without entirely removing the feature).
- castis 8y ago
  Yeah there's nothing you can really do about those as they're created using arbitrary DOM elements. This cuts back on the permission prompt spam that takes place directly with the Firefox UI.
- solarkraft 8y ago
  This type of cancer is what we need in-page popup blockers for. Mozilla has been promising to work on it and started a data collection program that I contributed to, but there are no news to share and the data doesn't seem to be publicly accessible. What a disappointment.
  - grincho 8y ago
    Nudge and you shall receive! https://github.com/mozilla/popup-urls https://github.com/mozilla/popup-urls Thank you for contributing!
    - solarkraft 8y ago
      Thanks! Do you have information about the progress of the project? How about a new extension that makes you click to remove the pop-up? The data collected that way could almost directly go into a neural network. Do you happen to know whether there are extensions to automatically answer GDPR pop-ups (indeed while blocking in page pop-ups these should probably receive special treatment)?
phkahler 8y ago
>> Downgrading the prompt to a non-popup icon in the address bar unless it follows a user action sounds like the perfect balance. I disagree. There should be no UI for these. A site should essentially say "click here to enable XXX" as part of the page. Anything else is essentially a pop-up. I don't want buttons or controls in my browser to be controlled by a web site. BTW that includes the back button - why browsers ever allowed sites to take control from the user is beyond me.
- Wowfunhappy 8y ago
  > A site should essentially say "click here to enable XXX" as part of the page. Then the site will just make their own annoying popup asking to enable notifications. By giving UI control to the browser, the browser vendor can decide how forceful it should be.
- kadendogthing 8y ago
  >why browsers ever allowed sites to take control from the user is beyond me. Because users wanted sites to be able to control that?
- inetknght 8y ago
  > A site should essentially say "click here to enable XXX" as part of the page. > why browsers ever allowed sites to take control from the user is beyond me. These two statements don't fit together in my mind. Can you try to reconcile them so I can understand better what you're trying to say?
MrGilbert 8y ago
I'm afraid this will backfire. We might see another wave of "click this icon in your browser to receive the latest notifications!" pop-ups showing up. Which would then require an adblocker to block these kind of popups. So we use an ad-blocker to block a popup, which only appears because a browser vendor decided to hide a popup. This is absurd.
- beat 8y ago
  I'm not so sure. Right now, everyone uses the popup because there isn't an alternative. If there's an alternative, popup use will go down some - but how much?
- nerdponx 8y ago
  No, that's fine. Because the "click this button in your browser" popup is part of the normal webpage DOM and can be blocked using existing tools. As opposed to this notification, which was (ab)using the browser itself to spam the user.
  - vsl 8y ago
    It’s not fine. Safari lets me disable the requests globally, which I did, because every stupid website asks for notifications permissions. Since then, there’s a lot of in-page popups asking the same, exactly as described above. No adblocker seems to be effective against them, and writing custom rules for sites I visit once isn’t sensible use of time...
apostacy 8y ago
> Downgrading the prompt to a non-popup icon in the address bar unless it follows a user action sounds like the perfect balance. But where should we put these non-popups? Perhaps we could have a dedicated bar for notifications, rss, and other services that a website offers, as well as any other relevant information. That way, we won't be clogging up the address bar. I'd happily sacrifice vertical 30px for that. A "status bar", if you will.
bscphil 8y ago
This is exactly the correct behavior. I've been trying to figure out if it could be enabled through an extension. I'm a little worried that sites will all start using javascript to trigger stuff following any user action, much like a bunch of terrible sites do now with popup ads. I think the best behavior would be to only show the icon, and let sites that need it use the DOM to tell the user to click the icon. If sites want to trash their own DOM so try to get users to enable notifications, so be it, but at least this could be blocked by ad blockers. On the other hand, I don't see Mozilla doing this because they're far too concerned with discoverability by novice users.

by zaroth 8y ago

barryvan 8y ago

> Downgrading the prompt to a non-popup icon in the address bar unless it follows a user action sounds like the perfect balance. Agreed. If it's in direct response to a user action (a sync response to a click or a tap on an element smaller than 300x300px, for example), I think it's perhaps more legitimate to have a more visible indication, like a strip across the top. (I'd want the element size constrained to avoid issues with sites adding `onClick` handlers to the `<body>` element or similar.) > Actually I think it makes sense to persistently show the notification icon in the navbar once the permission has been granted (same with mic, audio, and anything else) providing a quick glance at any privs that have been granted and an obvious way to revoke them. I believe Firefox already does this. It also shows you privileges which you've explicitly denied -- for example, if you disallow location access, you'll see a slashed compass next to the (i) button in the Awesomebar.

a_t48 8y ago
A nice tiling of invisible squares across the page can get around your element size restriction.
- lugg 8y ago
  Do we even need the restriction. We're talking about spammyness of a UI element because access requests are misaligned with user desire. All you're saying is the site will pop up a request for access whenever I do anything, ok, how is that different to what we have no? It's not going to be the norm, it's just going to be a few bad actors. Doesn't mean we put up with spam everywhere else.

IshKebab 8y ago

Aren't there already sites that show a fake permission request dialog? This won't stop them (and I don't see how you could without entirely removing the feature).

castis 8y ago
Yeah there's nothing you can really do about those as they're created using arbitrary DOM elements. This cuts back on the permission prompt spam that takes place directly with the Firefox UI.
solarkraft 8y ago
This type of cancer is what we need in-page popup blockers for. Mozilla has been promising to work on it and started a data collection program that I contributed to, but there are no news to share and the data doesn't seem to be publicly accessible. What a disappointment.
- grincho 8y ago
  Nudge and you shall receive! https://github.com/mozilla/popup-urls https://github.com/mozilla/popup-urls Thank you for contributing!
  - solarkraft 8y ago
    Thanks! Do you have information about the progress of the project? How about a new extension that makes you click to remove the pop-up? The data collected that way could almost directly go into a neural network. Do you happen to know whether there are extensions to automatically answer GDPR pop-ups (indeed while blocking in page pop-ups these should probably receive special treatment)?

phkahler 8y ago

>> Downgrading the prompt to a non-popup icon in the address bar unless it follows a user action sounds like the perfect balance. I disagree. There should be no UI for these. A site should essentially say "click here to enable XXX" as part of the page. Anything else is essentially a pop-up. I don't want buttons or controls in my browser to be controlled by a web site. BTW that includes the back button - why browsers ever allowed sites to take control from the user is beyond me.

Wowfunhappy 8y ago
> A site should essentially say "click here to enable XXX" as part of the page. Then the site will just make their own annoying popup asking to enable notifications. By giving UI control to the browser, the browser vendor can decide how forceful it should be.
kadendogthing 8y ago
>why browsers ever allowed sites to take control from the user is beyond me. Because users wanted sites to be able to control that?
inetknght 8y ago
> A site should essentially say "click here to enable XXX" as part of the page. > why browsers ever allowed sites to take control from the user is beyond me. These two statements don't fit together in my mind. Can you try to reconcile them so I can understand better what you're trying to say?

MrGilbert 8y ago

I'm afraid this will backfire. We might see another wave of "click this icon in your browser to receive the latest notifications!" pop-ups showing up. Which would then require an adblocker to block these kind of popups. So we use an ad-blocker to block a popup, which only appears because a browser vendor decided to hide a popup. This is absurd.

beat 8y ago
I'm not so sure. Right now, everyone uses the popup because there isn't an alternative. If there's an alternative, popup use will go down some - but how much?
nerdponx 8y ago
No, that's fine. Because the "click this button in your browser" popup is part of the normal webpage DOM and can be blocked using existing tools. As opposed to this notification, which was (ab)using the browser itself to spam the user.
- vsl 8y ago
  It’s not fine. Safari lets me disable the requests globally, which I did, because every stupid website asks for notifications permissions. Since then, there’s a lot of in-page popups asking the same, exactly as described above. No adblocker seems to be effective against them, and writing custom rules for sites I visit once isn’t sensible use of time...

apostacy 8y ago

> Downgrading the prompt to a non-popup icon in the address bar unless it follows a user action sounds like the perfect balance. But where should we put these non-popups? Perhaps we could have a dedicated bar for notifications, rss, and other services that a website offers, as well as any other relevant information. That way, we won't be clogging up the address bar. I'd happily sacrifice vertical 30px for that. A "status bar", if you will.

bscphil 8y ago

This is exactly the correct behavior. I've been trying to figure out if it could be enabled through an extension. I'm a little worried that sites will all start using javascript to trigger stuff following any user action, much like a bunch of terrible sites do now with popup ads. I think the best behavior would be to only show the icon, and let sites that need it use the DOM to tell the user to click the icon. If sites want to trash their own DOM so try to get users to enable notifications, so be it, but at least this could be blocked by ad blockers. On the other hand, I don't see Mozilla doing this because they're far too concerned with discoverability by novice users.