16 ms·

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetoo

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

swiley 7y ago
At least with the push notifications I can get notified about my stuff. On the iPhone they require paying apple $100 a year which almost ensures most will be ads.
- ehsankia 7y ago
  Could you use an existing solution such as pushover [0]? [0] https://pushover.net/ https://pushover.net/
- Nextgrid 7y ago
  Do you mean the proprietary Apple push notifications in Safari? In this case I've only seen it ever once (as opposed to seeing the "normal" notifications on pretty much every shitty blogspam website) so it seems like the 100$ acts like a good filter against BS notifications.
  - swiley 7y ago
    I mean whatever Firefox does. I’ve never once gotten spam because sites can’t send you notifications unless you opt into them (so it’s more like a battery friendly super fast RSS replacement.)
ipsum2 7y ago
Consider that different users have different needs, and almost all features listed are opt-in.
- rolltiide 7y ago
  except you have to opt out of them all before you can consume that 1 website's content hm I wonder if there is a chrome extension for that
  - dstaley 7y ago
    > except you have to opt out of them all before you can consume that 1 website's content This is an issue with that particular website's implementation, not something inherent to the browser or the API.
    - salawat 7y ago
      >This is an issue with that particular website's implementation, not something inherent to the browser or the API. When that statement applies to 90% of pages out there, that argument gets more stale than cracker left out for the better part of a year. That staleness, in fact, is why no one is encouraged to run blind unauthenticated proxies on the Internet anymore. Completely valid technology. Very problematic use case.
    - rolltiide 7y ago
      > This is an issue with that particular website's implementation because the product manager thought my user session was engaging with the site for 2 seconds longer so it must be good. I never said it was the browser or the API just acknowledging that it is a predictable gripe and not a feature, and yes enabled by the browser and APIs
- MaxBarraclough 7y ago
  Even if it's opt-in, we still pay a price. Complexity has its costs. It means my browser is more bigger and more complex. It broadens the attack surface exposed by my browser, perhaps even if I don't opt-in. It dilutes the efforts of the Firefox team. It introduces new ways for browsers to be subtly incompatible. It further raises the barrier to someone making a serious browser from scratch. Also, are we guaranteed that these features will be opt-in? There were serious security issues with WebGL (predictably), and I don't think WebGL was opt-in.
ryukafalz 7y ago
I have mixed feelings on this. On one hand, websites that should be just documents are turning into resource-intensive applications, which is frustrating. Generally I do not want most websites using these features. On the other hand, the web as a runtime is one of the most universal platforms we have. If I run Slack in a browser, I sure do want it to be able to notify me! (Though I wish doing so felt more like the Electron app - I’d rather use my browser than Electron if the UX were similar enough. I already have a browser, I don’t need another per application!) And as an occasional user of less popular mobile platforms (Ubuntu Touch, etc) a more featureful web runtime helps close the gap between those platforms and Android/iOS. I do think it’d be better if these two use cases were more explicitly distinct than they are now, though.
- Arcsech 7y ago
  It's almost like we shouldn't have tortured a document transfer system until it was able to run full-on applications.
  - ironmagma 7y ago
    It's just the amorphousness of life seeping in. People want more things in more contexts, which will always expand scope of the things they use.
  - modeless 7y ago
    If operating systems had ever provided security strong enough to run untrusted code, we wouldn't have needed to. It's really a failing of operating system security. Even today no operating system provides an application sandbox as strong and versatile as the browser. Platforms have fallen back on walled gardens (app stores) with centralized control of all code execution to compensate for the deficiencies of their security models. I don't want a future where the only apps I can run have to be signed and approved by Apple ahead of time. The web is the escape hatch.
    - ironmagma 7y ago
      But people still download and run apps every day. Some even prefer it. I doubt that the cause of this migration was due to security concerns -- since when are app developers particularly concerned about the quality of the security controls imposed on them? I suspect the shift was more due to ease of access, both by the user and for the developer, helped along by easier compatibility.
lbebber 7y ago
I like that push notifications on the browser exist (for e.g. Slack, WhatsApp), I just wish there were no popups for it--just an unintrusive button you could press to enable it.
- superasn 7y ago
  That's quite easy to do in chrome. Open global settings then set web notifications to block. Then whitelist sites by clicking the lock icon in address bar.
OkGoDoIt 7y ago
As long as they are opt in, which most of them currently are, then I’m fine with it. I generally set my browser to blanket ban most of this functionality but I do occasionally override that on a site-by-site basis when it’s useful. I think this is a pretty good state of affairs, versus not even having the option at all
duxup 7y ago
For rando browsing on the web, yeah they aren't great. On the other hand for say a corporate web application where my only users really do want them ... they're AWESOME.
markovbot 7y ago
How about the upcoming "SMS Receiver API" and "Contacts API"? Those look absolutely terrifying, and as soon as Chrome implements it, every shitty ass newspaper that is currently refusing to display their articles in private browsing windows will refuse to display their articles unless you fork over your contact list.
- untog 7y ago
  Have you actually read anything about either of those APIs or are you just reacting to the names? The Contacts API does not allow unrestricted access to your Contacts. It presents a picker for you to choose a contact. The SMS Receiver API is not universal access to SMS messages, it is access to one specific message and only one that contains your domain name in the message text. Both have very obvious utility to users. They don't look even vaguely terrifying.
  - markovbot 7y ago
    > Have you actually read anything about either of those APIs or are you just reacting to the names? I admit, this is exactly what I did :( appreciate the info
    - untog 7y ago
      Kudos for owning up to it! We all do it from time to time.
z3t4 7y ago
It should be possible to turn off these features with a browser extension/plugin.
untog 7y ago
Then you're out of step with what users want these days. Nothing wrong with that! But to take an example, when I hit a share button on a page I want to see the native share box, not some hideous iframed monstrosity that only works with Facebook. So I want Web Share. And I don't want to download an entire native app just so that I can receive a push alert when my food order is on the way, a web site works much better for that. So I'm happy that Web Push exists. I get the nostalgia for the "simpler days", but web browers are essentially a universal OS these days. As both a user and a developer I'm quite happy with this.
- asjw 7y ago
  If they were OSes they would have a kernel and user land You would have ring0 and ring3 You could decide what to install or what remove In the browser everything is exposed to everyone by default More than an OS is a disaster waiting to happen
  - detaro 7y ago
    > In the browser everything is exposed to everyone by default Several critical or potential annoying functions have opt-in prompts by default, unlike your typical desktop OS.
    - asjw 7y ago
      It makes no difference whatsoever An OS doesn't protect you from outside, it protects the system from apps and users Imagine if your OS asked you if you would like to allocate a block of memory at address X everytime it does That's what to a regular user the prompt means They just click 'Yes Forever' and are done with it But that's still an application settings, it has nothing to do with being an OS, browsers are mostly a system for distributing malware in the easiest of ways At the cost of being as complex as a full OS, without any of the benefits Wanna bet that if vendors started distributing naked browsers and the extra functionality (of course approved by W3C as standards) were bundled in plugins, which is entirely possible, half of those would linger there with zero downloads?
  - 7y ago
TheRealPomax 7y ago
Then turn them off. All these things landed because users _do_ use them. I 100% want web share, page visibility, usb, and native file system, for instance, because the browser has become a convenient replacement for a bunch of playgroup/PoC/testbed applications that I might have used 10 years ago.
- ehsankia 7y ago
  To clarify, most of these work by asking for permission first, and you can set them to "always deny" in the browser settings: chrome://settings/content There are similar site content settings in any major browser.
- nitwit005 7y ago
  There are a ton of features that browsers have added, and then tossed because no one used them. As well as features the browser vendors wish they could get rid of, but can't because too many sites made use of them.
- asjw 7y ago
  There are people who want to be spied by social networks to have a pair of free shoes and post pictures of them online It doesn't mean it's the right thing to do for society Browsers have gone far beyond their purpose in an inorganic way It's like if my alarm suddenly started making coffee, toasts, working as remote and the new planned feature was the ability to warm itself up and iron my shirts And it would still be a fraction of what browsers do today
  - ficklepickle 7y ago
    There's a Coffee API for that. Uses the covfefe protocol.
- ken 7y ago
  First of all, that's backwards. These features had to land before anyone could use them. Users can't use them before they land, so they couldn't have landed because they were being used. Second, how can you know if these features are widely used or not? There's been lots of technologies that have been added to web browsers over the years that weren't widely used, and were later removed.
melbourne_mat 7y ago
I think having those capabilities is fine but I hate the endless notifications to use them from every damn web site! There should be a second and much more subtle notification system which does not obscure content or attract attention.
- rhizome 7y ago
  I imagine most sites would be fine with email notifications. In-browser notifications just motivate them to come up with more reasons to notify you. Dumb reasons.
masswerk 7y ago
While agree that most of these are highly invasive and certainly not a requirement, the Visibility API is actually a good thing. Apps which are running continuous scripts, like games, etc, may and should detect, when they are hidden (i.e. the tab they are in isn't the front most one) and pause. This is explicitely meant to preserve resources on the client machine and to benefit the user. On the other hand, there isn't much to gain from on the app's side, beyond receiving a notification to wake up and to possibly check for any updates that happened in the meantime to be applied.
- megablast 7y ago
  I don't agree, I leave a video on, switch tabs to read something else, and now it stops. There is no way to get it to keep playing and switch tabs.
  - masswerk 7y ago
    Just open a new window and leave the tab with the video on top of that window. (It hasn't to be always tabs only.)
    - Nursie 7y ago
      Doesn't work on mobiles.
      - masswerk 7y ago
        Then you are doomed. ;-) (On mobile, it's your browser anyway that mutes any not currently on top and visible web sources, without any "help" by the particular website.)
        Nursie 7y ago
        I know this is an old topic now, but that's not true. I've installed a firefox plugin that disables the visibility API. Result - now youtube in a firefox tab keeps playing even with my screen locked. It is most definitely the page doing the muting.
austincheney 7y ago
The native file system access mentioned near the bottom sounds like a massive security hole
zzo38computer 7y ago
I agree, I don't want it to do any of these things either (with the exception of prefers-color-scheme and prefers-reduced-motion, which I like; however, web pages that use only one colour should not set or care about the colour at all). Some of these things though it may be useful to have, although should be set by the user, independently of the web page entirely; the web page should not be allowed to specify these things. Specifically, the following things could be user commands (that the web page need not know or care about whether or not it is implemented or used): Picture-in-Picture, Keyboard Lock, Pointer Lock, AirPlay, Screen Orientation (although see below for some comments), camera selection (the user would also be allowed to specify a file instead of the camera, or the user can specify to use the camera where a file is expected too), Theme Color, Badging, Chrome Sender. Screen Orientation and Presentation Mode: In presentation mode (selectable by the user), this is a "paged screen" media rather than a "continuous screen" media; in this case, the height of one page is known to CSS and JavaScripts (this should be reported as the visible height, even if it isn't entirely visible; in normal more, Infinity should always be reported rather than the correct height), and page breaks work. The width and height may be known too (although not of the entire screen, unless it is full screen mode), but the user would lock the screen orientation using the global screen orientation locking function, if that is what is wanted. If CSS is disabled, then of course this won't work, but that is OK, since if the CSS is disabled then presumably the user doesn't want it to work, so it is OK. For displaying on a separate screen, that may be a function of the operating system anyways, and not of the web browser. Payment Request is simply a specific case of autofill. Forms could specify autofill IDs, which are more general than this anyways, and fully controllable by the user. Credential Management could also work like this, although using HTTP authentication rather than forms/cookies would seem a better idea to me. For sharing, the user can just copy the URL by himself; the browser might (or might not) include sharing functions for URLs, or the user may use a separate program which implements this; it is irrelevant which way is done. Service Workers: For sending forms when internet is not available, what I wanted is the ability to save form data locally to disk and recall it later (on the same or a different webpage), entirely under the user's control; the web page should not need to know or care about this. Game Pad and Force Touch are probably fine, although, like the keyboard and mouse, should only be enabled when the user activates it. There are many other things too I think should be done differently.
wffurr 7y ago
I want useful programs that happen to run in a browser to do these things, after asking my permission. I don't want every random local news paper or internet chum site prompting me for every permission under the sun every visit.
inshadows 7y ago
Add service workers to the list. That's IMO the biggest atrocity allowed to go into the browser. There's currently a preference to disable this crap in Firefox.
jakub_g 7y ago
You actually got me an idea. It should be pretty easy to block many of those with a simple Tampermonkey script. Gotta check over the weekend. In JS you can't generally override host objects, but you can generally modify the functions they expose. @include * @run-at document-start navigator.something.someMethod = () => {} // noop https://www.tampermonkey.net/documentation.php https://www.tampermonkey.net/documentation.php
rapind 7y ago
Browsers need better and more usable permissions (and less leakage). Every API that's added is another attack vector.
- zzo38computer 7y ago
  Yes, and not only permissions, but overrides, too. (For example, to specify that the battery level should always be reported as a user-defined constant, rather than the actual level, or to use a file instead of a camera (or vice versa) if the user wants to.)
jherdman 7y ago
Allow me the chance to try and change you mind just a little bit. The web is one of the most open platforms that has ever existed — period. Since the dawn of the smart phone the web developer has heard the following request: "I need a native app because push messages!". Execs want them, users want them. They literally bang down your door asking for the damn things. Allowing the browser to handle push messages means you can keep your app on this amazing open platform instead of share cropping in some app store.
radarsat1 7y ago
I don't mind the idea of notifications when I have a web page open in a tab. Like, sure if I receive a message while I'm looking at another tab, let me know! But I was a bit shocked to discover that I was getting notifications from sites that I did not have open, then I realized that when I register for notifications the browser will continuously poll that site in the background, no matter whether I've browsed to that site in this session or not. That was when I decided I didn't want any notifications. It's not even the interruption, but more the knowledge that my computer is casually making HTTP requests in the background, continuously, on a site I haven't even browsed to, that I don't feel comfortable with..
- 7786655 7y ago
  That's not actually how it works. What happens when you subscribe to notifications is that your browser gives the website instructions for it to send notifications to the browser vendor's notification service. Your browser only polls Mozilla's servers or Google's servers or Apple's servers and all notifications are relayed through that.
  - jsilence 7y ago
    To me this sounds even worse.
tylerl 7y ago
The point is that just because you don't want most sites to use these features doesn't mean that no use exists. I just want to make sure I don't get nag notifications begging me to turn it on every time I visit a news site. Notifications? I need those from my calendar app and chat app. Badges? Messaging systems I use rarely but which are important. Visibility? I want resource intensive apps to "sleep" when not in use. USB? I want an Arduino web ide to be able to communicate with hardware. Screen lock? I don't want the machine to go into sleep mode when I'm presenting a slide deck. Key lock? I don't want the browser intercepting keystrokes in my word processor or SSH session.
eru 7y ago
> I don't want my browser doing those things. Your browser should let you decide whether you give websites access to this functionality?
mrwww 7y ago
So many sites ask you for notification permission on first visit in a very spammy way. Or, put their "share this" in a spammy/ad-like location. and i think that's the problem, web site owners being dumb and pushy. If there is a site you really like, that you want to share, and would want to recieve pertinent updates from, if you so choose without being hounded to do so, aren't you happy the feature is there? When I implement this that's how I think anyway.
3xblah 7y ago
Surely it was browser users who demanded such "features", right? The browser I use the most does not do any of these things, but it does a nice job of dumping HTML tables to formatted text, which is something the modern graphical browsers cannot do..
franga2000 7y ago
Push notifications are good for messaging apps (including chat support, etc.). They're 100% opt-in and harmless. Web Share is barely a thing. It's literally just a call to an already existing browser function and deprecates all the vendor-specific embeds in most sites (each FB, Twitter, etc. share button you see either uses this single-function API, or loads their huge blob of JavaScript on every page that has it - which do you prefer?). As a user of Web messaging apps, I also like the Visibility API, because it allows the apps I use to stop rendering while in background and just queue up messages to render when I look at them. This allows the process running those tabs to basically go to sleep (even swapping sometimes) which increases battery life and performance. The rest of the ones you listed, I agree, really shouldn't be in Web browsers.
jooize 7y ago
Web Share makes share buttons within web pages more useful and coherent. Just wish more apps would place themselves in that OS-wide menu. Idea: app that can add custom Share menu entries, process with scripts. I share the concerns regarding features with extra high risk of leaking sensitive data. The operating system should control access for those who wish to disable such features; it doesn’t necessarily have to ask for each capability just because the option exists. Those would of course still need to trust the app’s own isolation for web pages if they for app features require access to e.g. file system or Bluetooth.
101404 7y ago
I think it's great that they exist. The problem is when they get used unnecessarily. Push notifications are good when my Webmail tells me there's a new message or Gitlab tells me my tests passed. Not so good when some crappy newspaper I visit for the first time asks me if I want be notified about all their clickbait articles all the time. But with Brave it's pretty easy to disable JavaScript on a per-site basis, with "disabled" being the default. So all these things don't bother me anymore.
- beagle3 7y ago
  uMatrix does that and also takes that to the next level, at least on Firefox.
worldsayshi 7y ago
I'm pretty sure you can set your browser to reject all push notifications.
smnthermes 7y ago
I'd add to this list Payment Request API, it's akin to DRM.
arendtio 7y ago
For some things, it is not that simple. Let's take for example the Push API. While there are very few web sites where you want them to send you notifications straight to your desktop, that API is also used to wake up your Service Workers, to let them receive information when they are not the currently active website and are therefore quite important to build things like chats or apps that sync over multiple devices. AFAIK that Push API for Service Workers is not available on iOS yet, which is a major show stopper for Progressive Web Apps as there are many use cases where you would need something like that.

swiley 7y ago

At least with the push notifications I can get notified about my stuff. On the iPhone they require paying apple $100 a year which almost ensures most will be ads.

ehsankia 7y ago
Could you use an existing solution such as pushover [0]? [0] https://pushover.net/ https://pushover.net/
Nextgrid 7y ago
Do you mean the proprietary Apple push notifications in Safari? In this case I've only seen it ever once (as opposed to seeing the "normal" notifications on pretty much every shitty blogspam website) so it seems like the 100$ acts like a good filter against BS notifications.
- swiley 7y ago
  I mean whatever Firefox does. I’ve never once gotten spam because sites can’t send you notifications unless you opt into them (so it’s more like a battery friendly super fast RSS replacement.)

ipsum2 7y ago

Consider that different users have different needs, and almost all features listed are opt-in.

rolltiide 7y ago
except you have to opt out of them all before you can consume that 1 website's content hm I wonder if there is a chrome extension for that
- dstaley 7y ago
  > except you have to opt out of them all before you can consume that 1 website's content This is an issue with that particular website's implementation, not something inherent to the browser or the API.
  - salawat 7y ago
    >This is an issue with that particular website's implementation, not something inherent to the browser or the API. When that statement applies to 90% of pages out there, that argument gets more stale than cracker left out for the better part of a year. That staleness, in fact, is why no one is encouraged to run blind unauthenticated proxies on the Internet anymore. Completely valid technology. Very problematic use case.
  - rolltiide 7y ago
    > This is an issue with that particular website's implementation because the product manager thought my user session was engaging with the site for 2 seconds longer so it must be good. I never said it was the browser or the API just acknowledging that it is a predictable gripe and not a feature, and yes enabled by the browser and APIs
MaxBarraclough 7y ago
Even if it's opt-in, we still pay a price. Complexity has its costs. It means my browser is more bigger and more complex. It broadens the attack surface exposed by my browser, perhaps even if I don't opt-in. It dilutes the efforts of the Firefox team. It introduces new ways for browsers to be subtly incompatible. It further raises the barrier to someone making a serious browser from scratch. Also, are we guaranteed that these features will be opt-in? There were serious security issues with WebGL (predictably), and I don't think WebGL was opt-in.

ryukafalz 7y ago

I have mixed feelings on this. On one hand, websites that should be just documents are turning into resource-intensive applications, which is frustrating. Generally I do not want most websites using these features. On the other hand, the web as a runtime is one of the most universal platforms we have. If I run Slack in a browser, I sure do want it to be able to notify me! (Though I wish doing so felt more like the Electron app - I’d rather use my browser than Electron if the UX were similar enough. I already have a browser, I don’t need another per application!) And as an occasional user of less popular mobile platforms (Ubuntu Touch, etc) a more featureful web runtime helps close the gap between those platforms and Android/iOS. I do think it’d be better if these two use cases were more explicitly distinct than they are now, though.

Arcsech 7y ago
It's almost like we shouldn't have tortured a document transfer system until it was able to run full-on applications.
- ironmagma 7y ago
  It's just the amorphousness of life seeping in. People want more things in more contexts, which will always expand scope of the things they use.
- modeless 7y ago
  If operating systems had ever provided security strong enough to run untrusted code, we wouldn't have needed to. It's really a failing of operating system security. Even today no operating system provides an application sandbox as strong and versatile as the browser. Platforms have fallen back on walled gardens (app stores) with centralized control of all code execution to compensate for the deficiencies of their security models. I don't want a future where the only apps I can run have to be signed and approved by Apple ahead of time. The web is the escape hatch.
  - ironmagma 7y ago
    But people still download and run apps every day. Some even prefer it. I doubt that the cause of this migration was due to security concerns -- since when are app developers particularly concerned about the quality of the security controls imposed on them? I suspect the shift was more due to ease of access, both by the user and for the developer, helped along by easier compatibility.

lbebber 7y ago

I like that push notifications on the browser exist (for e.g. Slack, WhatsApp), I just wish there were no popups for it--just an unintrusive button you could press to enable it.

superasn 7y ago
That's quite easy to do in chrome. Open global settings then set web notifications to block. Then whitelist sites by clicking the lock icon in address bar.

OkGoDoIt 7y ago

As long as they are opt in, which most of them currently are, then I’m fine with it. I generally set my browser to blanket ban most of this functionality but I do occasionally override that on a site-by-site basis when it’s useful. I think this is a pretty good state of affairs, versus not even having the option at all

duxup 7y ago

For rando browsing on the web, yeah they aren't great. On the other hand for say a corporate web application where my only users really do want them ... they're AWESOME.

markovbot 7y ago

How about the upcoming "SMS Receiver API" and "Contacts API"? Those look absolutely terrifying, and as soon as Chrome implements it, every shitty ass newspaper that is currently refusing to display their articles in private browsing windows will refuse to display their articles unless you fork over your contact list.

untog 7y ago
Have you actually read anything about either of those APIs or are you just reacting to the names? The Contacts API does not allow unrestricted access to your Contacts. It presents a picker for you to choose a contact. The SMS Receiver API is not universal access to SMS messages, it is access to one specific message and only one that contains your domain name in the message text. Both have very obvious utility to users. They don't look even vaguely terrifying.
- markovbot 7y ago
  > Have you actually read anything about either of those APIs or are you just reacting to the names? I admit, this is exactly what I did :( appreciate the info
  - untog 7y ago
    Kudos for owning up to it! We all do it from time to time.

z3t4 7y ago

It should be possible to turn off these features with a browser extension/plugin.

untog 7y ago

Then you're out of step with what users want these days. Nothing wrong with that! But to take an example, when I hit a share button on a page I want to see the native share box, not some hideous iframed monstrosity that only works with Facebook. So I want Web Share. And I don't want to download an entire native app just so that I can receive a push alert when my food order is on the way, a web site works much better for that. So I'm happy that Web Push exists. I get the nostalgia for the "simpler days", but web browers are essentially a universal OS these days. As both a user and a developer I'm quite happy with this.

asjw 7y ago
If they were OSes they would have a kernel and user land You would have ring0 and ring3 You could decide what to install or what remove In the browser everything is exposed to everyone by default More than an OS is a disaster waiting to happen
- detaro 7y ago
  > In the browser everything is exposed to everyone by default Several critical or potential annoying functions have opt-in prompts by default, unlike your typical desktop OS.
  - asjw 7y ago
    It makes no difference whatsoever An OS doesn't protect you from outside, it protects the system from apps and users Imagine if your OS asked you if you would like to allocate a block of memory at address X everytime it does That's what to a regular user the prompt means They just click 'Yes Forever' and are done with it But that's still an application settings, it has nothing to do with being an OS, browsers are mostly a system for distributing malware in the easiest of ways At the cost of being as complex as a full OS, without any of the benefits Wanna bet that if vendors started distributing naked browsers and the extra functionality (of course approved by W3C as standards) were bundled in plugins, which is entirely possible, half of those would linger there with zero downloads?
- 7y ago

TheRealPomax 7y ago

Then turn them off. All these things landed because users _do_ use them. I 100% want web share, page visibility, usb, and native file system, for instance, because the browser has become a convenient replacement for a bunch of playgroup/PoC/testbed applications that I might have used 10 years ago.

ehsankia 7y ago
To clarify, most of these work by asking for permission first, and you can set them to "always deny" in the browser settings: chrome://settings/content There are similar site content settings in any major browser.
nitwit005 7y ago
There are a ton of features that browsers have added, and then tossed because no one used them. As well as features the browser vendors wish they could get rid of, but can't because too many sites made use of them.
asjw 7y ago
There are people who want to be spied by social networks to have a pair of free shoes and post pictures of them online It doesn't mean it's the right thing to do for society Browsers have gone far beyond their purpose in an inorganic way It's like if my alarm suddenly started making coffee, toasts, working as remote and the new planned feature was the ability to warm itself up and iron my shirts And it would still be a fraction of what browsers do today
- ficklepickle 7y ago
  There's a Coffee API for that. Uses the covfefe protocol.
ken 7y ago
First of all, that's backwards. These features had to land before anyone could use them. Users can't use them before they land, so they couldn't have landed because they were being used. Second, how can you know if these features are widely used or not? There's been lots of technologies that have been added to web browsers over the years that weren't widely used, and were later removed.

melbourne_mat 7y ago

I think having those capabilities is fine but I hate the endless notifications to use them from every damn web site! There should be a second and much more subtle notification system which does not obscure content or attract attention.

rhizome 7y ago
I imagine most sites would be fine with email notifications. In-browser notifications just motivate them to come up with more reasons to notify you. Dumb reasons.

masswerk 7y ago

While agree that most of these are highly invasive and certainly not a requirement, the Visibility API is actually a good thing. Apps which are running continuous scripts, like games, etc, may and should detect, when they are hidden (i.e. the tab they are in isn't the front most one) and pause. This is explicitely meant to preserve resources on the client machine and to benefit the user. On the other hand, there isn't much to gain from on the app's side, beyond receiving a notification to wake up and to possibly check for any updates that happened in the meantime to be applied.

megablast 7y ago
I don't agree, I leave a video on, switch tabs to read something else, and now it stops. There is no way to get it to keep playing and switch tabs.
- masswerk 7y ago
  Just open a new window and leave the tab with the video on top of that window. (It hasn't to be always tabs only.)
  - Nursie 7y ago
    Doesn't work on mobiles.
    - masswerk 7y ago
      Then you are doomed. ;-) (On mobile, it's your browser anyway that mutes any not currently on top and visible web sources, without any "help" by the particular website.)
      - Nursie 7y ago
        I know this is an old topic now, but that's not true. I've installed a firefox plugin that disables the visibility API. Result - now youtube in a firefox tab keeps playing even with my screen locked. It is most definitely the page doing the muting.

austincheney 7y ago

The native file system access mentioned near the bottom sounds like a massive security hole

zzo38computer 7y ago

I agree, I don't want it to do any of these things either (with the exception of prefers-color-scheme and prefers-reduced-motion, which I like; however, web pages that use only one colour should not set or care about the colour at all). Some of these things though it may be useful to have, although should be set by the user, independently of the web page entirely; the web page should not be allowed to specify these things. Specifically, the following things could be user commands (that the web page need not know or care about whether or not it is implemented or used): Picture-in-Picture, Keyboard Lock, Pointer Lock, AirPlay, Screen Orientation (although see below for some comments), camera selection (the user would also be allowed to specify a file instead of the camera, or the user can specify to use the camera where a file is expected too), Theme Color, Badging, Chrome Sender. Screen Orientation and Presentation Mode: In presentation mode (selectable by the user), this is a "paged screen" media rather than a "continuous screen" media; in this case, the height of one page is known to CSS and JavaScripts (this should be reported as the visible height, even if it isn't entirely visible; in normal more, Infinity should always be reported rather than the correct height), and page breaks work. The width and height may be known too (although not of the entire screen, unless it is full screen mode), but the user would lock the screen orientation using the global screen orientation locking function, if that is what is wanted. If CSS is disabled, then of course this won't work, but that is OK, since if the CSS is disabled then presumably the user doesn't want it to work, so it is OK. For displaying on a separate screen, that may be a function of the operating system anyways, and not of the web browser. Payment Request is simply a specific case of autofill. Forms could specify autofill IDs, which are more general than this anyways, and fully controllable by the user. Credential Management could also work like this, although using HTTP authentication rather than forms/cookies would seem a better idea to me. For sharing, the user can just copy the URL by himself; the browser might (or might not) include sharing functions for URLs, or the user may use a separate program which implements this; it is irrelevant which way is done. Service Workers: For sending forms when internet is not available, what I wanted is the ability to save form data locally to disk and recall it later (on the same or a different webpage), entirely under the user's control; the web page should not need to know or care about this. Game Pad and Force Touch are probably fine, although, like the keyboard and mouse, should only be enabled when the user activates it. There are many other things too I think should be done differently.

wffurr 7y ago

I want useful programs that happen to run in a browser to do these things, after asking my permission. I don't want every random local news paper or internet chum site prompting me for every permission under the sun every visit.

inshadows 7y ago

Add service workers to the list. That's IMO the biggest atrocity allowed to go into the browser. There's currently a preference to disable this crap in Firefox.

jakub_g 7y ago

You actually got me an idea. It should be pretty easy to block many of those with a simple Tampermonkey script. Gotta check over the weekend. In JS you can't generally override host objects, but you can generally modify the functions they expose. @include * @run-at document-start navigator.something.someMethod = () => {} // noop https://www.tampermonkey.net/documentation.php https://www.tampermonkey.net/documentation.php

rapind 7y ago

Browsers need better and more usable permissions (and less leakage). Every API that's added is another attack vector.

zzo38computer 7y ago
Yes, and not only permissions, but overrides, too. (For example, to specify that the battery level should always be reported as a user-defined constant, rather than the actual level, or to use a file instead of a camera (or vice versa) if the user wants to.)

jherdman 7y ago

Allow me the chance to try and change you mind just a little bit. The web is one of the most open platforms that has ever existed — period. Since the dawn of the smart phone the web developer has heard the following request: "I need a native app because push messages!". Execs want them, users want them. They literally bang down your door asking for the damn things. Allowing the browser to handle push messages means you can keep your app on this amazing open platform instead of share cropping in some app store.

radarsat1 7y ago

I don't mind the idea of notifications when I have a web page open in a tab. Like, sure if I receive a message while I'm looking at another tab, let me know! But I was a bit shocked to discover that I was getting notifications from sites that I did not have open, then I realized that when I register for notifications the browser will continuously poll that site in the background, no matter whether I've browsed to that site in this session or not. That was when I decided I didn't want any notifications. It's not even the interruption, but more the knowledge that my computer is casually making HTTP requests in the background, continuously, on a site I haven't even browsed to, that I don't feel comfortable with..

7786655 7y ago
That's not actually how it works. What happens when you subscribe to notifications is that your browser gives the website instructions for it to send notifications to the browser vendor's notification service. Your browser only polls Mozilla's servers or Google's servers or Apple's servers and all notifications are relayed through that.
- jsilence 7y ago
  To me this sounds even worse.

tylerl 7y ago

The point is that just because you don't want most sites to use these features doesn't mean that no use exists. I just want to make sure I don't get nag notifications begging me to turn it on every time I visit a news site. Notifications? I need those from my calendar app and chat app. Badges? Messaging systems I use rarely but which are important. Visibility? I want resource intensive apps to "sleep" when not in use. USB? I want an Arduino web ide to be able to communicate with hardware. Screen lock? I don't want the machine to go into sleep mode when I'm presenting a slide deck. Key lock? I don't want the browser intercepting keystrokes in my word processor or SSH session.

eru 7y ago

> I don't want my browser doing those things. Your browser should let you decide whether you give websites access to this functionality?

mrwww 7y ago

So many sites ask you for notification permission on first visit in a very spammy way. Or, put their "share this" in a spammy/ad-like location. and i think that's the problem, web site owners being dumb and pushy. If there is a site you really like, that you want to share, and would want to recieve pertinent updates from, if you so choose without being hounded to do so, aren't you happy the feature is there? When I implement this that's how I think anyway.

3xblah 7y ago

Surely it was browser users who demanded such "features", right? The browser I use the most does not do any of these things, but it does a nice job of dumping HTML tables to formatted text, which is something the modern graphical browsers cannot do..

franga2000 7y ago

Push notifications are good for messaging apps (including chat support, etc.). They're 100% opt-in and harmless. Web Share is barely a thing. It's literally just a call to an already existing browser function and deprecates all the vendor-specific embeds in most sites (each FB, Twitter, etc. share button you see either uses this single-function API, or loads their huge blob of JavaScript on every page that has it - which do you prefer?). As a user of Web messaging apps, I also like the Visibility API, because it allows the apps I use to stop rendering while in background and just queue up messages to render when I look at them. This allows the process running those tabs to basically go to sleep (even swapping sometimes) which increases battery life and performance. The rest of the ones you listed, I agree, really shouldn't be in Web browsers.

jooize 7y ago

Web Share makes share buttons within web pages more useful and coherent. Just wish more apps would place themselves in that OS-wide menu. Idea: app that can add custom Share menu entries, process with scripts. I share the concerns regarding features with extra high risk of leaking sensitive data. The operating system should control access for those who wish to disable such features; it doesn’t necessarily have to ask for each capability just because the option exists. Those would of course still need to trust the app’s own isolation for web pages if they for app features require access to e.g. file system or Bluetooth.

101404 7y ago

I think it's great that they exist. The problem is when they get used unnecessarily. Push notifications are good when my Webmail tells me there's a new message or Gitlab tells me my tests passed. Not so good when some crappy newspaper I visit for the first time asks me if I want be notified about all their clickbait articles all the time. But with Brave it's pretty easy to disable JavaScript on a per-site basis, with "disabled" being the default. So all these things don't bother me anymore.

beagle3 7y ago
uMatrix does that and also takes that to the next level, at least on Firefox.

worldsayshi 7y ago

I'm pretty sure you can set your browser to reject all push notifications.

smnthermes 7y ago

I'd add to this list Payment Request API, it's akin to DRM.

arendtio 7y ago

For some things, it is not that simple. Let's take for example the Push API. While there are very few web sites where you want them to send you notifications straight to your desktop, that API is also used to wake up your Service Workers, to let them receive information when they are not the currently active website and are therefore quite important to build things like chats or apps that sync over multiple devices. AFAIK that Push API for Service Workers is not available on iOS yet, which is a major show stopper for Progressive Web Apps as there are many use cases where you would need something like that.