3 ms·

This amounts to a "best viewed in Chrome" philosophy. It's an argument against Open Standards draped in worry about security. It's no different than Google's p

This amounts to a "best viewed in Chrome" philosophy. It's an argument against Open Standards draped in worry about security. It's no different than Google's policies of restricting apps on Jailbroken phones, a practice that was ostensibly introduced for security, but quickly expanded to be used for DRM and to discourage users from taking control of their own devices. The whole point of Open standards, the only reason we built these things in the first place, was so companies like Google couldn't decide which browsers worked with the web. You might as well rephrase your first sentence to read, "you get a consistent experience with a current Chrome browser" -- and I have no doubt that there are people at Google who would be happy to have that policy if they thought they could get away with it. After all, why should Google's security team trust that Mozilla's browser is secure, given that they don't get to pre-vet new versions? Even if a current version is implementing the standard correctly, there's no guarantee that a future Firefox version won't have problems. And Mozilla is already refusing to deprecate old APIs with Manifest V3, when according to Google that deprecation is super necessary to make extensions secure.

shadowgovt 7y ago
You also get a consistent user experience with a current Firefox browser; it might be slightly different than the one you get with a consistent Chrome browser. There's a reason a lot of companies standardize on a single browser for their internal web applications. The purpose of avoiding browser monoculture was to avoid a world where a single company deploying a single closed-source browser owned the gateway to the World wide Web. The goal was never to make it easy for an arbitrary number of browsers to operate independently of each other; in fact, browsers are very complex software to get right and service providers have a responsibility to make it hard for users to get their accounts compromised even if they bring a browser with implementation errors into the loop. I'd be more concerned if Google was blocking, say, Firefox, or if the block was harder to overcome than changing the UA. This block is inconsequential. Change the UA and be done with it.
- danShumway 7y ago
  > The purpose of avoiding browser monoculture was to avoid a world where a single company deploying a single closed-source browser owned the gateway to the World wide Web. The goal was never to make it easy for an arbitrary number of browsers to operate independently of each othe Making it easier to build browsers is how we avoid a monoculture. If we were OK with there being 2 browser engines (Firefox and Chrome) we wouldn't need to make all of these standards. Mozilla and Google are perfectly capable of collaborating on their own in private, and it would be faster for them to do so -- its just everyone else that would be left out. Open standards are why we can have interesting browser experiments like Beaker. It's important that there be multiple software projects pushing the web forward. Of course browsers are hard to build, just like Operating Systems are hard to build. It doesn't follow that there should only be two of them. > Change the UA and be done with it. To be honest, you're right on this point. This is a kind of pointless debate -- because what will actually happen here is all of the insecure browsers you're worried about are just going to take Vivaldi's route and by-default mock a different user agent for Google login screens. End users don't know or care what user agent is being sent to the remote server. Let's be honest -- the Kmail devs are not going to throw their hands up in the air and say, "well I guess we just abandon the project now." They're going to push a change that invisibly mocks the user agent for all of their users. Because, again, you can't trust an insecure browser. If you can't trust a browser-maker to implement the standard correctly, you also can't trust them to voluntarily go along with a scheme that will make a nontrivial portion of the web unusable for the majority of their current user-base.
  - shadowgovt 7y ago
    While it doesn't follow that there should be only two browsers, it also doesn't make sense that Google should expose its end users to other people's lab projects if that increased the security risk of those end-users. Security is a balancing game and always in flux.

shadowgovt 7y ago

You also get a consistent user experience with a current Firefox browser; it might be slightly different than the one you get with a consistent Chrome browser. There's a reason a lot of companies standardize on a single browser for their internal web applications. The purpose of avoiding browser monoculture was to avoid a world where a single company deploying a single closed-source browser owned the gateway to the World wide Web. The goal was never to make it easy for an arbitrary number of browsers to operate independently of each other; in fact, browsers are very complex software to get right and service providers have a responsibility to make it hard for users to get their accounts compromised even if they bring a browser with implementation errors into the loop. I'd be more concerned if Google was blocking, say, Firefox, or if the block was harder to overcome than changing the UA. This block is inconsequential. Change the UA and be done with it.

danShumway 7y ago
> The purpose of avoiding browser monoculture was to avoid a world where a single company deploying a single closed-source browser owned the gateway to the World wide Web. The goal was never to make it easy for an arbitrary number of browsers to operate independently of each othe Making it easier to build browsers is how we avoid a monoculture. If we were OK with there being 2 browser engines (Firefox and Chrome) we wouldn't need to make all of these standards. Mozilla and Google are perfectly capable of collaborating on their own in private, and it would be faster for them to do so -- its just everyone else that would be left out. Open standards are why we can have interesting browser experiments like Beaker. It's important that there be multiple software projects pushing the web forward. Of course browsers are hard to build, just like Operating Systems are hard to build. It doesn't follow that there should only be two of them. > Change the UA and be done with it. To be honest, you're right on this point. This is a kind of pointless debate -- because what will actually happen here is all of the insecure browsers you're worried about are just going to take Vivaldi's route and by-default mock a different user agent for Google login screens. End users don't know or care what user agent is being sent to the remote server. Let's be honest -- the Kmail devs are not going to throw their hands up in the air and say, "well I guess we just abandon the project now." They're going to push a change that invisibly mocks the user agent for all of their users. Because, again, you can't trust an insecure browser. If you can't trust a browser-maker to implement the standard correctly, you also can't trust them to voluntarily go along with a scheme that will make a nontrivial portion of the web unusable for the majority of their current user-base.
- shadowgovt 7y ago
  While it doesn't follow that there should be only two browsers, it also doesn't make sense that Google should expose its end users to other people's lab projects if that increased the security risk of those end-users. Security is a balancing game and always in flux.