6 ms·

This is not Firefox becoming less and less viable. This is developers caring less and less about supporting older browsers, less capable hardware and, I guess,

This is not Firefox becoming less and less viable. This is developers caring less and less about supporting older browsers, less capable hardware and, I guess, long-term maintenance in general. Just had a similar case today: My Mom tried to order something online on her old Android tablet - and it didn't work. She blamed the tablet for it, saying "It's just too old, it doesn't work correctly anymore! I used to be able to order stuff on this website". I had to explain to her that her tablet is still working fine, it's just the website that is broken because it's not supporting her device (or browser) anymore. Shockingly, she listed quite a few websites, which she has used for years, which have stopped working for her in the past few months and years; all of these she mentioned as evidence that the problem must be her tablet - not the websites. When I opened two of the sites she mentioned, I wasn't too surprised to find very shiny, very modern single-page applications (with service workers registered and even WebAssembly used on one of them).. So when you are creating a modern web app, please don't just test in Chrome on your new MacBook Pro. Think about your Mom. Ask yourself: "Is this still gonna work on her crappy old device?"

SahAssar 7y ago
Well, it's also a problem of device manufacturers dropping support for devices too quickly. There are still android 4.1 devices sold on amazon, and you really can't expect web developers to support that. The manufacturer should be required to support it for the full lifetime of the device. Especially since your mom uses it to order stuff, which usually includes some pretty security sensitive information. I think you are putting the burden on the wrong party.
- mark_and_sweep 7y ago
  Well, I haven't analysed the exact technical reason for why submitting the order failed. But I'm pretty certain that submitting a HTML form is a solved problem in web development.. Or at least it should be. I haven't tried submitting a form with an async fetch from a web worker that communicates with a redux store implemented in WebAssembly yet (or whatever that web app is doing..).
  - SahAssar 7y ago
    If the order site is just submitting an HTML form in the old way with credentials stored in a cookie (also the old way) that would probably be open to trivial CSRF attacks. If it is somehow checking for support for SameSite, Secure, CSP or any of the other mechanisms that have been implemented in the last years then it might fail. Or they might be using mechanisms that work around the problem that those three are supposed to help since they are not available in older clients, but just don't have the resources to test the random android 4.12 version that you use. I think it should have a proper error message if that is the case. But I feel like you are pointing the finger in the wrong direction. I try to build my apps without extraneous fads, but keeping a webapp secure (in other words keeping up to date with the latest protections) does not mean "submitting a form", and it does not mean letting any old client lacking the required protections through. It also does not mean doing "WASM compiled redux reducers in ES6 module workers authenticating over JWT to send gRPC commands to a kafka broker talking with ingressrouting over anycast and a internal service mesh with mTLS3.9 auth using curve9999.9, token binding and Wireguard to secure internal communications over a VPC-less multi-cloud k8s cluster that uses Multi-Raft, Single-Paxos to have a single, distributed, disputably non-consistent CRDT-consensus algo over blockchain RS-232". So, yeah, I'm not for fads over usability in tech. But I'm also not for supporting insecure clients just because the manufacturer of those clients doesn't give a shit.
    - tedivm 7y ago
      CSRF doesn't require any javascript to defend against. Having a nonce inside of the HTML resolves that completely. SameSite and Secure cookies also don't require any javascript, just some extra HTTP headers. I don't think security justifies this.
- cnst 7y ago
  > Well, it's also a problem of device manufacturers dropping support for devices too quickly. There are still android 4.1 devices sold on amazon, and you really can't expect web developers to support that. Are you kidding me? If you're looking for shiny stuff to add to your resume, yeah, you can't possibly support those! If you're an HTML5 game developer, yeah, gotta use the latest and greatest. But if you're in the business of selling shoes, why do you need anything newer than Android 4.1 in order to process the transactions?!
  - SahAssar 7y ago
    The latest version of Android 4.1 was released in 2012. The latest version of chrome for that seems to be around 23. A lot of android 4.1 shipped without TLS 1.1 by default. So you are stuck with SSLv3 or TLSv1. Those are just examples, there's a lot in security that has changed since 2012. A lot of basic security was missing back then, asking anyone to enter any security-sensitive info on those devices now is like telling someone to use WinXP and IE8 for online banking. Besides that the great variety of devices that shipped on versions v4.1-v4.4 and with their different hacks/customizations it is simply not feasible to ask developers to support them years after many of them cannot be had to even test a website on, let alone debug it.
    - mark_and_sweep 7y ago
      A couple of things.. - The tablet is ~5 years old. Even if it was 8 years old, I think you should still be able to order a pizza online. - TLSv1 is far from plaintext. But in any case, the TLS version doesn't matter in this case. The site was loading properly. - Even if the TLS version was outdated, are we now banning people from using the internet for using an older device? - Submitting the form didn't work, the navigation was partially broken. It was probably a JS issue, but I don't know. - The moral of the story, to me, is that, as a web developer, you should also care about those $few% that don't have all the green boxes on caniuse.com. Depending on how many users your site has, this may just be a few people or it might be millions - among them, possibly, your Mom.

SahAssar 7y ago

Well, it's also a problem of device manufacturers dropping support for devices too quickly. There are still android 4.1 devices sold on amazon, and you really can't expect web developers to support that. The manufacturer should be required to support it for the full lifetime of the device. Especially since your mom uses it to order stuff, which usually includes some pretty security sensitive information. I think you are putting the burden on the wrong party.

mark_and_sweep 7y ago
Well, I haven't analysed the exact technical reason for why submitting the order failed. But I'm pretty certain that submitting a HTML form is a solved problem in web development.. Or at least it should be. I haven't tried submitting a form with an async fetch from a web worker that communicates with a redux store implemented in WebAssembly yet (or whatever that web app is doing..).
- SahAssar 7y ago
  If the order site is just submitting an HTML form in the old way with credentials stored in a cookie (also the old way) that would probably be open to trivial CSRF attacks. If it is somehow checking for support for SameSite, Secure, CSP or any of the other mechanisms that have been implemented in the last years then it might fail. Or they might be using mechanisms that work around the problem that those three are supposed to help since they are not available in older clients, but just don't have the resources to test the random android 4.12 version that you use. I think it should have a proper error message if that is the case. But I feel like you are pointing the finger in the wrong direction. I try to build my apps without extraneous fads, but keeping a webapp secure (in other words keeping up to date with the latest protections) does not mean "submitting a form", and it does not mean letting any old client lacking the required protections through. It also does not mean doing "WASM compiled redux reducers in ES6 module workers authenticating over JWT to send gRPC commands to a kafka broker talking with ingressrouting over anycast and a internal service mesh with mTLS3.9 auth using curve9999.9, token binding and Wireguard to secure internal communications over a VPC-less multi-cloud k8s cluster that uses Multi-Raft, Single-Paxos to have a single, distributed, disputably non-consistent CRDT-consensus algo over blockchain RS-232". So, yeah, I'm not for fads over usability in tech. But I'm also not for supporting insecure clients just because the manufacturer of those clients doesn't give a shit.
  - tedivm 7y ago
    CSRF doesn't require any javascript to defend against. Having a nonce inside of the HTML resolves that completely. SameSite and Secure cookies also don't require any javascript, just some extra HTTP headers. I don't think security justifies this.
cnst 7y ago
> Well, it's also a problem of device manufacturers dropping support for devices too quickly. There are still android 4.1 devices sold on amazon, and you really can't expect web developers to support that. Are you kidding me? If you're looking for shiny stuff to add to your resume, yeah, you can't possibly support those! If you're an HTML5 game developer, yeah, gotta use the latest and greatest. But if you're in the business of selling shoes, why do you need anything newer than Android 4.1 in order to process the transactions?!
- SahAssar 7y ago
  The latest version of Android 4.1 was released in 2012. The latest version of chrome for that seems to be around 23. A lot of android 4.1 shipped without TLS 1.1 by default. So you are stuck with SSLv3 or TLSv1. Those are just examples, there's a lot in security that has changed since 2012. A lot of basic security was missing back then, asking anyone to enter any security-sensitive info on those devices now is like telling someone to use WinXP and IE8 for online banking. Besides that the great variety of devices that shipped on versions v4.1-v4.4 and with their different hacks/customizations it is simply not feasible to ask developers to support them years after many of them cannot be had to even test a website on, let alone debug it.
  - mark_and_sweep 7y ago
    A couple of things.. - The tablet is ~5 years old. Even if it was 8 years old, I think you should still be able to order a pizza online. - TLSv1 is far from plaintext. But in any case, the TLS version doesn't matter in this case. The site was loading properly. - Even if the TLS version was outdated, are we now banning people from using the internet for using an older device? - Submitting the form didn't work, the navigation was partially broken. It was probably a JS issue, but I don't know. - The moral of the story, to me, is that, as a web developer, you should also care about those $few% that don't have all the green boxes on caniuse.com. Depending on how many users your site has, this may just be a few people or it might be millions - among them, possibly, your Mom.