5 ms·

Me too. Then a breach happens and someone with a straight face tells you: "we take your privacy very seriously", asking apologies, because the breach used some

by scoutt 7y ago

Me too. Then a breach happens and someone with a straight face tells you: "we take your privacy very seriously", asking apologies, because the breach used some of your data to push some political campaign or to bother you with spam/extortions because that night you were watching some porn. Programmers should stop pushing buggy or incomplete software as is, and start releasing software that works. Otherwise upper levels have an excuse to do all this "experience" telemetry, and we all are smart enough to see the consequences of a data breach.

shadowgovt 7y ago
> Programmers should stop pushing buggy or incomplete software as is, and start releasing software that works If you demand a perfection-of-function guarantee from something as complicated as a web browser, you'll never get a web browser with more features than the ones released in the '90s (and I'm not even sure we'd be that far along by now). If I'm given a forced choice between "more privacy" and "the software ever having the features I want to use" I'm also going to lean towards "the software ever having the features I want to use." And we know this is true for users in general because of the number of users who had Flash installed back-in-the-day in spite of the fact that it allowed a total bypass of the browser security model, because it had features that the browser lacked otherwise.
- scoutt 7y ago
  Instead of giving my privacy away, I prefer software like anything that you have installed from a CD-ROM back in the 90's and didn't needed a weekly update. Games, 3D-Studio, Autocad (to name a few) were more complex than a web-browser (a today's web-browser) and didn't needed a weekly update or the hunger for user-requested features, let alone dialing home because. The world worked relatively fine without the up-to-date wankery we see today.
  - shadowgovt 7y ago
    I remember them. They were also buggy and could crash their resident OSs all the way to a stuck state, and if they did, the solution was "Try not to trigger that bug again." Software quality has significantly improved in the era of easy patch access and auto-patching.
  - scarejunba 7y ago
    Holy Jesus. Those things were chock full of security holes. If you used a web browser that arrived on a CD ROM you'd be advertising massive pwnability. In fact, you could easily simulate this by using last year's Firefox.
    - labawi 7y ago
      Firefox, chrome, linux ... all are full of unnecessary complexity. The point being - we need daily patches to keep it from falling apart. I have links (or lynx) on an old SuSE, maybe even a Mandriva CD. Would they be massively pwnable?
      - shadowgovt 7y ago
        Hard to say, but not necessarily a great example; exploits on software are a function both of attack surface / complexity and installed userbase (i.e. nobody bothers to see if lynx is pwnable because a zero-day against that browser will be worth, what, twenty bucks to gain access to the five people who use it?).
        labawi 7y ago
        Perhaps. Perhaps not. As a thought experiment: How long would it be safe to go without browser updates with a browser of complexity/capabilies of links, if 50% of people used it? With many people combing through it, would it become effectively unexploitable?
        shadowgovt 7y ago
        Probably not very long. Even with a small attack surface, if half the world uses it, the zero-days are valuable. Links is still vulnerable to * application-layer attacks (it is still an HTTP client and HTML parser, and the protocols themselves are complicated to implement soundly, even if the newest features aren't included) * protocol attacks (is links immune to buffer-overruns triggered by intentionally-malformed queries? Probably not, since it has no total-soundness verification. And the source code isn't open-source so ) * dependency attacks (it uses svgalib [https://www.cvedetails.com/vulnerability-list/vendor_id-84/product_id-141/version_id-530/Svgalib-Svgalib-1.2.10.html https://www.cvedetails.com/vulnerability-list/vendor_id-84/p...], and every third-party library is a potential attack vector) * good old-fashioned UI spoofing (is links' UI design immune to allowing web pages to show an image that tricks the user into thinking they're looking at the links UI itself?) In this thought experiment, any successful attack has massive value so we can expect bad actors to be hammering on the system and finding most such exploits available on the application.
- JohnFen 7y ago
  > you'll never get a web browser with more features than the ones released in the '90s I would actively prefer a web browser that lacks the features added since the '90s.
  - shadowgovt 7y ago
    That's understandable, but it isn't what most people want---developers or users alike. Browsers aren't just thin-clients to support HTTP protocol and HTML rendering. They've grown to adopt a new distributed computing paradigm, not unlike UNIX and its descendants grew to support a new multi-user-cum-multi-process paradigm. The things web development offers---location agnosticism, platform agnosticism, combined multimedia interaction, a workable security model for multi-source aggregate-component content---are eating software development, and the browser is becoming the OS of the modern era. We know users want this because users were willing to use Flash (even though Flash broke out of the security model of the old browser). There'll always be a place for small text-based pages much as modern computing will always have a place for command-line tools, but the genie is out of the bottle and it won't be put back in.
    - JohnFen 7y ago
      > it isn't what most people want---developers or users alike. I'm fully aware of this, and this, at heart, is why I'm certain that the day will come when I can no longer use the web at all.
  - flukus 7y ago
    The mozilla suite in 1998 included a browser, an email/newsgroup client, an IRC client, an address book and an html editor. Modern browsers for all their bloat actually have less features.
    - JohnFen 7y ago
      Such suites are not browsers. They include a browser.

by scoutt 7y ago

shadowgovt 7y ago

> Programmers should stop pushing buggy or incomplete software as is, and start releasing software that works If you demand a perfection-of-function guarantee from something as complicated as a web browser, you'll never get a web browser with more features than the ones released in the '90s (and I'm not even sure we'd be that far along by now). If I'm given a forced choice between "more privacy" and "the software ever having the features I want to use" I'm also going to lean towards "the software ever having the features I want to use." And we know this is true for users in general because of the number of users who had Flash installed back-in-the-day in spite of the fact that it allowed a total bypass of the browser security model, because it had features that the browser lacked otherwise.

scoutt 7y ago
Instead of giving my privacy away, I prefer software like anything that you have installed from a CD-ROM back in the 90's and didn't needed a weekly update. Games, 3D-Studio, Autocad (to name a few) were more complex than a web-browser (a today's web-browser) and didn't needed a weekly update or the hunger for user-requested features, let alone dialing home because. The world worked relatively fine without the up-to-date wankery we see today.
- shadowgovt 7y ago
  I remember them. They were also buggy and could crash their resident OSs all the way to a stuck state, and if they did, the solution was "Try not to trigger that bug again." Software quality has significantly improved in the era of easy patch access and auto-patching.
- scarejunba 7y ago
  Holy Jesus. Those things were chock full of security holes. If you used a web browser that arrived on a CD ROM you'd be advertising massive pwnability. In fact, you could easily simulate this by using last year's Firefox.
  - labawi 7y ago
    Firefox, chrome, linux ... all are full of unnecessary complexity. The point being - we need daily patches to keep it from falling apart. I have links (or lynx) on an old SuSE, maybe even a Mandriva CD. Would they be massively pwnable?
    - shadowgovt 7y ago
      Hard to say, but not necessarily a great example; exploits on software are a function both of attack surface / complexity and installed userbase (i.e. nobody bothers to see if lynx is pwnable because a zero-day against that browser will be worth, what, twenty bucks to gain access to the five people who use it?).
      - labawi 7y ago
        Perhaps. Perhaps not. As a thought experiment: How long would it be safe to go without browser updates with a browser of complexity/capabilies of links, if 50% of people used it? With many people combing through it, would it become effectively unexploitable?
        shadowgovt 7y ago
        Probably not very long. Even with a small attack surface, if half the world uses it, the zero-days are valuable. Links is still vulnerable to * application-layer attacks (it is still an HTTP client and HTML parser, and the protocols themselves are complicated to implement soundly, even if the newest features aren't included) * protocol attacks (is links immune to buffer-overruns triggered by intentionally-malformed queries? Probably not, since it has no total-soundness verification. And the source code isn't open-source so ) * dependency attacks (it uses svgalib [https://www.cvedetails.com/vulnerability-list/vendor_id-84/product_id-141/version_id-530/Svgalib-Svgalib-1.2.10.html https://www.cvedetails.com/vulnerability-list/vendor_id-84/p...], and every third-party library is a potential attack vector) * good old-fashioned UI spoofing (is links' UI design immune to allowing web pages to show an image that tricks the user into thinking they're looking at the links UI itself?) In this thought experiment, any successful attack has massive value so we can expect bad actors to be hammering on the system and finding most such exploits available on the application.
JohnFen 7y ago
> you'll never get a web browser with more features than the ones released in the '90s I would actively prefer a web browser that lacks the features added since the '90s.
- shadowgovt 7y ago
  That's understandable, but it isn't what most people want---developers or users alike. Browsers aren't just thin-clients to support HTTP protocol and HTML rendering. They've grown to adopt a new distributed computing paradigm, not unlike UNIX and its descendants grew to support a new multi-user-cum-multi-process paradigm. The things web development offers---location agnosticism, platform agnosticism, combined multimedia interaction, a workable security model for multi-source aggregate-component content---are eating software development, and the browser is becoming the OS of the modern era. We know users want this because users were willing to use Flash (even though Flash broke out of the security model of the old browser). There'll always be a place for small text-based pages much as modern computing will always have a place for command-line tools, but the genie is out of the bottle and it won't be put back in.
  - JohnFen 7y ago
    > it isn't what most people want---developers or users alike. I'm fully aware of this, and this, at heart, is why I'm certain that the day will come when I can no longer use the web at all.
- flukus 7y ago
  The mozilla suite in 1998 included a browser, an email/newsgroup client, an IRC client, an address book and an html editor. Modern browsers for all their bloat actually have less features.
  - JohnFen 7y ago
    Such suites are not browsers. They include a browser.