4 ms·

You need to understand difference between something installed on my computer (run by ME, i pay my HW, electricity bills and connectivity) and a website (run by

by hexo 7y ago

You need to understand difference between something installed on my computer (run by ME, i pay my HW, electricity bills and connectivity) and a website (run by someone ELSE, doesnt pay my HW or electric energy AND forces me to watch ADS for which I PAY for bandwidth).

lifthrasiir 7y ago
I have already edited, but to elaborate: > In addition, think hard about the update strategy of applications that need to support that moving web. If you want the web and accept that the web is moving and you can't do anything about that, then it should be recognized that the web browser is hard time catching up. I actually hate most auto update things, but it had been too hard to use any web browser without such facilities. I use Firefox because at least I can see---and have a non-zero probably to alter---what happens to this moving platform.
geofft 7y ago
I take it you don't run any JavaScript or CSS that you haven't audited, either, and you have a download cap on each web request?
- hexo 7y ago
  Heard of no-script? Heard of application sandboxing? Do you actually understand WHY we run web via HTML, JS and CSS and not as actual compiled applications randomly downloaded from internet? Seems like you do not. Do not ask manipulative c* until you make sure you REALLY know what you are talking about.
  - geofft 7y ago
    > Heard of no-script? Yes. I have friends that use it. They rarely run it on the entire web; they use it by default on unknown sites but they allow sites they use regularly to run unaudited JS so they can get things done. (The whole point of using NoScript instead of the config option to disable JavaScript is so that you can run some scripts.) This seems equivalent to not running random applications but letting trusted vendors ship you automatic updates. > Heard of application sandboxing? Yes. I even briefly worked on it in grad school before I left to join a company that was selling sandboxing for corporate desktops. But you were worried about "HW, electricity bills and connectivity," none of which application sandboxing helps: sandboxing helps which APIs you call but not how much resources you use, and application-level controls don't affect what an individual website uses. Regular ulimit-style limits work for limiting CPU usage. That was why I asked whether you have resource limits on requests from individual websites. > Do you actually understand WHY we run web via HTML, JS and CSS and not as actual compiled applications randomly downloaded from internet? I do—but again, that's about the API surface available to applications, not about the CPU or bandwidth resources available to applications, which is what you said you care about. I am 100% sure of what I'm talking about. That's why I'm asking whether you are. I'm not being manipulative, just trying to figure out if you have a coherent threat model or not.
    - zzzcpan 7y ago
      > This seems equivalent to not running random applications but letting trusted vendors ship you automatic updates. That would be equivalent only if you were running applications from trusted vendors each in a sandboxed VM that can't access anything on your system and only provide narrow functionality, not platform-like stuff.
    - hexo 7y ago
      I'd love mozilla to implement resource limits, yes that would be excellent. I tried to implement something similar to ulimit, i even did complete disabling of tabs (using SIGSTOP, that didn't work nicely as you might have guessed). "HW and electricity bills" are just examples, to tell you they're messing with someone elses stuff. Is it OK for someone from SAMSUNG to come to your kitchen and mess with TV settings? Or from IKEA to take your sheets and maybe give you something completely else? Also clerk would have keys, because using security cams they took picture of your keys while you were shopping and made "backups for you". You wondering what happened they would calmly tell you that it was OPT-OUT and you agreed to it by entering the shop. For me this is equivalently illegal.

by hexo 7y ago

lifthrasiir 7y ago

I have already edited, but to elaborate: > In addition, think hard about the update strategy of applications that need to support that moving web. If you want the web and accept that the web is moving and you can't do anything about that, then it should be recognized that the web browser is hard time catching up. I actually hate most auto update things, but it had been too hard to use any web browser without such facilities. I use Firefox because at least I can see---and have a non-zero probably to alter---what happens to this moving platform.

geofft 7y ago

I take it you don't run any JavaScript or CSS that you haven't audited, either, and you have a download cap on each web request?

hexo 7y ago
Heard of no-script? Heard of application sandboxing? Do you actually understand WHY we run web via HTML, JS and CSS and not as actual compiled applications randomly downloaded from internet? Seems like you do not. Do not ask manipulative c* until you make sure you REALLY know what you are talking about.
- geofft 7y ago
  > Heard of no-script? Yes. I have friends that use it. They rarely run it on the entire web; they use it by default on unknown sites but they allow sites they use regularly to run unaudited JS so they can get things done. (The whole point of using NoScript instead of the config option to disable JavaScript is so that you can run some scripts.) This seems equivalent to not running random applications but letting trusted vendors ship you automatic updates. > Heard of application sandboxing? Yes. I even briefly worked on it in grad school before I left to join a company that was selling sandboxing for corporate desktops. But you were worried about "HW, electricity bills and connectivity," none of which application sandboxing helps: sandboxing helps which APIs you call but not how much resources you use, and application-level controls don't affect what an individual website uses. Regular ulimit-style limits work for limiting CPU usage. That was why I asked whether you have resource limits on requests from individual websites. > Do you actually understand WHY we run web via HTML, JS and CSS and not as actual compiled applications randomly downloaded from internet? I do—but again, that's about the API surface available to applications, not about the CPU or bandwidth resources available to applications, which is what you said you care about. I am 100% sure of what I'm talking about. That's why I'm asking whether you are. I'm not being manipulative, just trying to figure out if you have a coherent threat model or not.
  - zzzcpan 7y ago
    > This seems equivalent to not running random applications but letting trusted vendors ship you automatic updates. That would be equivalent only if you were running applications from trusted vendors each in a sandboxed VM that can't access anything on your system and only provide narrow functionality, not platform-like stuff.
  - hexo 7y ago
    I'd love mozilla to implement resource limits, yes that would be excellent. I tried to implement something similar to ulimit, i even did complete disabling of tabs (using SIGSTOP, that didn't work nicely as you might have guessed). "HW and electricity bills" are just examples, to tell you they're messing with someone elses stuff. Is it OK for someone from SAMSUNG to come to your kitchen and mess with TV settings? Or from IKEA to take your sheets and maybe give you something completely else? Also clerk would have keys, because using security cams they took picture of your keys while you were shopping and made "backups for you". You wondering what happened they would calmly tell you that it was OPT-OUT and you agreed to it by entering the shop. For me this is equivalently illegal.