6 ms·

You have proposed a social solution to a technical problem. Why does JavaScript offer a way to enumerate things about the client cat the server has no need to k

You have proposed a social solution to a technical problem. Why does JavaScript offer a way to enumerate things about the client cat the server has no need to know?

jdnenej 7y ago
Because it is extraordinary difficult to have a useful programming language that can not be used for tracking. A social solution and technical solutions are needed. Firefox has put in a huge effort to prevent tracking but many useful features can also be used for tracking so a browser will not be able to determine useful and non useful code.
- matheusmoreira 7y ago
  We have to make it less useful then. They were given the audio/canvas/whatever APIs and instead of using it to make great web applications they abused it by turning it into personal information to track us and exploit us for profit. We gave them this power and now we have to take it away. The site shouldn't be able to do anything without user's permission.
  - baroffoos 7y ago
    I don't want a browser that comes up with 10000 popups asking if it has permission to render an image or permission to add 2 numbers together. I want a browser that can get the task done with the least friction possible and a legal system that prevents abuse. The website should be the one to inform me that they are actually using the audio api for tracking and not just playing audio. With a large penalty for lying. If we were talking about the issue of people being stabbed you don't suggest "Why should the stabber be penalized? The victim should have been wearing a Kevlar vest that doesn't allow them to be stabbed. If they weren't then they should simply expect that people will stab them."
    - Mirioron 7y ago
      >The website should be the one to inform me that they are actually using the audio api for tracking and not just playing audio. With a large penalty for lying. The website can't do anything without your browser cooperating. The website can request the audio API as much as it wants but if your browser had a same configuration then it would just ignore it. You're asking for legislation on a problem with a global scope. Countries that ignore your laws will still do all of this as long as your browser lets them. >If we were talking about the issue of people being stabbed you don't suggest "Why should the stabber be penalized? The victim should have been wearing a Kevlar vest that doesn't allow them to be stabbed. This is such a poor analogy. The server doesn't do anything without a client asking for something. In your case the victim went to the stabber and started the interaction. Then the victim's electric scooter (browser) malfunctioned or was poorly configured and drove into the stabber's knife. Of course the server isn't blameless, because they are most likely knowingly exploiting this. But to suggest that the user has no control over this is foolish. It implies that the user can't be blamed for anything their computer does.
    - matheusmoreira 7y ago
      > 10000 popups asking if it has permission to render an image We need an automated approach. We need the ability to not only disable browser APIs but also make them return fake data to fool the website. We need the ability to inspect the data websites are sending back and redact data we don't want them to have just like corporations perform deep packet inspection to prevent data exfiltration. > If we were talking about the issue of people being stabbed In this case we handed them the knife. We thought they'd use it to cut something for us and they stabbed us instead. They even made the ability to stab us part of their terms of service. This cannot go on.
      - baroffoos 7y ago
        >We need the ability to not only disable browser APIs but also make them return fake data to fool the website. Browsers have been trying this for a long time but its not simple. Chrome has had multiple attempts at making it impossible to detect incognito mode but people keep finding ways. The old way was checking if the API to store data was available so chrome made it so that there is an emulated data store for incognito mode and then websites just check how fast the local data store is to check if it is on disk or in memory. It would be an extraordinary effort to remove all of these issues since many of them are outside of the browser like what exact gpu and driver is in use could slightly change how the page is rendered or how long certain things take.
rat9988 7y ago
It is not a technical problem, it is a social problem first and foremost.
runarberg 7y ago
I think tracking is pretty much a social problem. The fact that it is technologically possible is a necessary but not sufficient to make the problem technical. As a comparison, think about speeding. It is technologically possible because there are cars that can pass most speed limits. I’m sure we can find a technological solution that eliminates speeding. But for the most part, regulations and enforcement is a sufficiently good measure.
- cestith 7y ago
  You can absolutely govern a car's speed electronically. You can also make JavaScript able to figure out how to play sound without letting it disclose what it knows about your sound system to a remote machine.
licebmi__at__ 7y ago
Kinda like the penal system being a social solution to the technical problem of finding a way to make people bulletproof.
tinus_hn 7y ago
The issue is that JavaScript and the DOM are not 100% specified. There is no technical solution for that. Removing obvious ways to enumerate differences can help but can never be a complete solution and many differences can not be removed at all.

You have proposed a social solution to a technical problem. Why does JavaScript offer a way to enumerate things about the client cat the server has no need to know?

jdnenej 7y ago

Because it is extraordinary difficult to have a useful programming language that can not be used for tracking. A social solution and technical solutions are needed. Firefox has put in a huge effort to prevent tracking but many useful features can also be used for tracking so a browser will not be able to determine useful and non useful code.

matheusmoreira 7y ago
We have to make it less useful then. They were given the audio/canvas/whatever APIs and instead of using it to make great web applications they abused it by turning it into personal information to track us and exploit us for profit. We gave them this power and now we have to take it away. The site shouldn't be able to do anything without user's permission.
- baroffoos 7y ago
  I don't want a browser that comes up with 10000 popups asking if it has permission to render an image or permission to add 2 numbers together. I want a browser that can get the task done with the least friction possible and a legal system that prevents abuse. The website should be the one to inform me that they are actually using the audio api for tracking and not just playing audio. With a large penalty for lying. If we were talking about the issue of people being stabbed you don't suggest "Why should the stabber be penalized? The victim should have been wearing a Kevlar vest that doesn't allow them to be stabbed. If they weren't then they should simply expect that people will stab them."
  - Mirioron 7y ago
    >The website should be the one to inform me that they are actually using the audio api for tracking and not just playing audio. With a large penalty for lying. The website can't do anything without your browser cooperating. The website can request the audio API as much as it wants but if your browser had a same configuration then it would just ignore it. You're asking for legislation on a problem with a global scope. Countries that ignore your laws will still do all of this as long as your browser lets them. >If we were talking about the issue of people being stabbed you don't suggest "Why should the stabber be penalized? The victim should have been wearing a Kevlar vest that doesn't allow them to be stabbed. This is such a poor analogy. The server doesn't do anything without a client asking for something. In your case the victim went to the stabber and started the interaction. Then the victim's electric scooter (browser) malfunctioned or was poorly configured and drove into the stabber's knife. Of course the server isn't blameless, because they are most likely knowingly exploiting this. But to suggest that the user has no control over this is foolish. It implies that the user can't be blamed for anything their computer does.
  - matheusmoreira 7y ago
    > 10000 popups asking if it has permission to render an image We need an automated approach. We need the ability to not only disable browser APIs but also make them return fake data to fool the website. We need the ability to inspect the data websites are sending back and redact data we don't want them to have just like corporations perform deep packet inspection to prevent data exfiltration. > If we were talking about the issue of people being stabbed In this case we handed them the knife. We thought they'd use it to cut something for us and they stabbed us instead. They even made the ability to stab us part of their terms of service. This cannot go on.
    - baroffoos 7y ago
      >We need the ability to not only disable browser APIs but also make them return fake data to fool the website. Browsers have been trying this for a long time but its not simple. Chrome has had multiple attempts at making it impossible to detect incognito mode but people keep finding ways. The old way was checking if the API to store data was available so chrome made it so that there is an emulated data store for incognito mode and then websites just check how fast the local data store is to check if it is on disk or in memory. It would be an extraordinary effort to remove all of these issues since many of them are outside of the browser like what exact gpu and driver is in use could slightly change how the page is rendered or how long certain things take.

rat9988 7y ago

It is not a technical problem, it is a social problem first and foremost.

runarberg 7y ago

I think tracking is pretty much a social problem. The fact that it is technologically possible is a necessary but not sufficient to make the problem technical. As a comparison, think about speeding. It is technologically possible because there are cars that can pass most speed limits. I’m sure we can find a technological solution that eliminates speeding. But for the most part, regulations and enforcement is a sufficiently good measure.

cestith 7y ago
You can absolutely govern a car's speed electronically. You can also make JavaScript able to figure out how to play sound without letting it disclose what it knows about your sound system to a remote machine.

licebmi__at__ 7y ago

Kinda like the penal system being a social solution to the technical problem of finding a way to make people bulletproof.

tinus_hn 7y ago

The issue is that JavaScript and the DOM are not 100% specified. There is no technical solution for that. Removing obvious ways to enumerate differences can help but can never be a complete solution and many differences can not be removed at all.