13 ms·

Then you're out of step with what users want these days. Nothing wrong with that! But to take an example, when I hit a share button on a page I want to see the

• asjw 7y ago
  If they were OSes they would have a kernel and user land You would have ring0 and ring3 You could decide what to install or what remove In the browser everything is exposed to everyone by default More than an OS is a disaster waiting to happen
  • detaro 7y ago
    > In the browser everything is exposed to everyone by default Several critical or potential annoying functions have opt-in prompts by default, unlike your typical desktop OS.
    • asjw 7y ago
      It makes no difference whatsoever An OS doesn't protect you from outside, it protects the system from apps and users Imagine if your OS asked you if you would like to allocate a block of memory at address X everytime it does That's what to a regular user the prompt means They just click 'Yes Forever' and are done with it But that's still an application settings, it has nothing to do with being an OS, browsers are mostly a system for distributing malware in the easiest of ways At the cost of being as complex as a full OS, without any of the benefits Wanna bet that if vendors started distributing naked browsers and the extra functionality (of course approved by W3C as standards) were bundled in plugins, which is entirely possible, half of those would linger there with zero downloads?
  • eeZah7Ux 7y ago
    Despite the idiotic downvotes, you are absolutely right. Browsers are terrible. No other applications or OS components are so monolithic expose the same attack surface.
    • p1necone 7y ago
      What? Running a native desktop app exposes a much larger attack surface than opening a webpage.
      • vthriller 7y ago
        > native desktop app exposes a much larger attack surface If we're talking about code executed as a result of, say, buffer overflow attacks, then the impact is the same both for the native app and for the browser. The latter, however, has way much more places where that overflow could happen! And they still happen, security updates for the browsers get pushed all the time. (And we're not even talking about the world of XSS/CSRF attacks here! Those are pretty much exclusive to the browsers, and widen the attack surface tremendously.)
        • eeZah7Ux 7y ago
          Not to mention that native apps can be properly reviewed and vetted by Linux distributions. And have a tiny codebase compared to a browser. And even tinier compared to a browser + all the potentially hostile javascript, css, html, sng, png out there. And run in native sandboxes or external sandboxes like firejail.
      • chinesempire 7y ago
        what about the software that opens that web page?
  • TheCoelacanth 7y ago
    kernel = browser, user land = web apps I don't understand what you mean by "In the browser everything is exposed to everyone by default". Browsers have a much more robust security and privacy model than normal OSes.
    • jfkebwjsbx 7y ago
      False. For starters, browsers can only implement sandboxing thanks to the OS facilities, otherwise it would be impossible. And that is modern ones. 5 years ago some browsers were still a security nightmare with not even multiprocess separation.
      • snazz 7y ago
        Five years ago was 2015. Chrome has had multiprocess and sandboxing for a lot longer than that.
        • jfkebwjsbx 7y ago
          And if you had read carefully I said some browsers. In 2015 Firefox still did not have multiprocessing. IE did not either, and it was massively used back then.
      • TheCoelacanth 7y ago
        There's a difference between what features OSes have and which ones they are effectively using. If you ran untrusted native apps with the same level of consideration that people run untrusted web sites, your identity would be stolen every 30 seconds. That is solid empirical evidence of a better security model.
        • chinesempire 7y ago
          This is a classic false sense of security People identities are stolen constantly by web apps, they just don't know An app like Excel could steal my data, yes, but it is my willingness to give away all my connections to Facebook and let them spy my interactions that gave away my identity and also the identity of people that do not use Facebook, but are mentioned by me or my other contacts (for example my parents) That's the real danger
• gowld 7y ago
  What's wrong with native app? You can delete it when you are done with it, just like you can close a browser tab when you are done with the "entire" web app you downloaded.
  • jsjddbbwj 7y ago
    Native apps can siphon out much more info off your mobile than websites can.
  • hombre_fatal 7y ago
    No uBlock, no dev console, no network tab. Completely opaque. An install step just to order a pizza. Shareable URLs/deeplinks. It's a freak of luck that we have the web, an app environment with a built-in dev console and actual customization. Just think how much it contrasts with the black box of native apps and with what large companies actually want. I'm in no rush to throw it away.
    • hobs 7y ago
      No need for ublock, the dev console is called your memory, your network tab is now something the entire os can understand, and you can even opportunistically block specific network calls. Obfuscated javascript running in the console is no better than random apps, and webasm is going to make that even more opaque. You are talking about features that are only needed for websites and why an app doesnt have those features, when they were directly bolted on to deal with the huge amount of complexity we've already handled in the OS.
      • ComputerGuru 7y ago
        I think the point is that these features are masked from the user (especially on mobile) when performed in a native app vs a website.
        • hobs 7y ago
          On mobile its somewhat more fair, but the dev tools, adblock, and other items on mobile are almost always super compromised and locked down by the device manufacturer.
• cosmotic 7y ago
  Share API isn't needed for sharing content, copy and paste worked better than share api and it was around decades ago. About what percent of push notification requests do you accept? I think my percentage is 0, and the number of requests is high tens if not hundreds. I don't trust browser notifications at all. Here's some stats: https://www.businessofapps.com/marketplace/push-notifications/research/push-notifications-statistics/ https://www.businessofapps.com/marketplace/push-notification... Opt-in rates are around 65%, open rate is between 1 and 10%, I suspect some percentage of those opt-in rates were unintentional or coerced and some percentage of those opens were click bate or accident. so <2.5% of notifications were desired. I think it's safe to assume a significant portion of the opt-ins and notifications were desired-not. Based on this information, I would consider notifications undesirable.
  • cj 7y ago
    You consider them undesirable, but they are a critical feature for many applications. Specifically, chat. More specifically... support agents providing live chat support. (And for that matter, end users interacting via chat appreciate push notifications on reply) Without browser push notifications, there really isn’t a good alternative. The fact that opt in rates are close to 50% is probably a good thing! It means that browsers aren’t using dark patterns to trick people in to opting into things they don’t want. I would 100% agree with you if opting out were difficult. But at least Chrome’s implementation makes it very easy to decide which sites I want push notifications from, I really can’t think of any downside given the easy opt out.
    • asjw 7y ago
      Chat is probably one of the only functionalities that are still better served by an ad-hoc app If you need notifications, just use a native app (or even a web one wrapped in a native app) Anyway, most of these "features" are used because they are already there, remove them from the base install of the browser, distribute them as a plugin and make the devs consider that the feature could not be present and they will stop nagging the users begging for their attention Any website I visit from mobile wants the permission to notify me, 99% of them don't if I visit from desktop Why is that? I guess we all know the answer
• deleted 7y ago
  [deleted]
• Igelau 7y ago
  So that's one good use case for Push Notifications. It would take about 10 minutes of browsing to find 10 bad ones.
  • untog 7y ago
    I would strongly advocate for browsers to strengthen the UI prompt for notifications so pages can’t do it on load. In fact, Google is doing exactly that with Chrome and I think Firefox already has. So, no, v1 wasn’t great. But we can improve on things.
  • ohbleek 7y ago
    I never liked the idea until I started using a browser based pomodoro timer and I enabled the desktop notifications, it's been a useful feature. Now, I'm wondering if there are other benefits I've been missing out on since I have always disabled desktop notifications by default.
    • squaresmile 7y ago
      I find the browser notifications useful for discourse forums. There are some stuffs that I would like to be notified but not by email.
    • raxxorrax 7y ago
      Implementing notifications for a timer clock should be included in the wikipedia article about feature creep. Not minding them too much since I disable them, but at some point it is just not worth it for all the anti-user practices notifications already allowed in my opinion. It just inflates functionality. In 20 years, if we have even more powerful devices, we will complain about browsers taking ages to load again.
  • BenjiWiebe 7y ago
    Is it not standard practice for browsers to prompt about push notifications? When I see the prompt I choose no, and don't ever see notifications.
  • p1necone 7y ago
• smohare 7y ago
  That’s bullshit. It’s out of step with what the companies whose livelihoods depend on advertising want to establish as the desires of users. Try to realistically justify any of those use cases listed and you’ll realize what a shill you sound like.
  • untog 7y ago
    > Try to realistically justify any of those use cases listed and you’ll realize what a shill you sound like. Wat? What part of the examples I gave are not realistic? I guess I live a fantasy life! Good to know. Are you arguing that there is zero use for push notifications beyond things advertising companies want? Because that’s out of step with pretty much every phone user I know.
• taeric 7y ago
  I prefer copying the link to the page I'm on to share. No popups, native or otherwise. Similarly, I like not having an app running so that you could just send me a text. Sms is bad for security, but great see sending short notifications. Almost better, as it is so limited.
  • untog 7y ago
    > Almost better, as it is so limited. Except that with web push the block button is two taps away. Once I’ve given away my phone number that’s it, it can be sent to anyone, I can receive messages from anywhere.
    • taeric 7y ago
      Is this a thing that happens often? Used to, your phone number was in a publicly available book. Pretty sure we use legislation to block abuse of that kind. Similarly, used to, my browser was not a bloated application capable of sending me messages. Such that there have been times just launching chrome I get notifications I didn't know my family were going to accidentally enable...
      • untog 7y ago
        > Is this a thing that happens often? Used to, your phone number was in a publicly available book. When you could only call that number. Messaging is pretty different. And sure it happens! Phone numbers are (nearly) immutable. It's a valuable piece of personal information. Your web push ID is... not.
        • taeric 7y ago
          I still get more robo calls on landlines than on my cell. Conveniently, my cell is in a different area code from where I live, so even easy to spot the bad ones. And I have never gotten an unsolicited text. That wasn't a wrong number.
          • 7y ago
• scubbo 7y ago
  This is such an important realization. I, too, personally wish most of those features didn't exist. But I acknowledge that I am in the minority.
  • myself248 7y ago
    Wishing isn't the point for me. A lot of us were taught a particular security model, and then that changed silently, and now we might make bad decisions because of it. I wish I could at least control these things. I'd like to turn them all off and see what happens to the modern web, and at least understand what I'm allowing when I turn them back on.
    • hoten 7y ago
      Look up Chrome Feature Policies.
  • Awelton 7y ago
    All these things are why I have a custom user.js. I know most people here are web devs that get a kick out of this stuff, but I personally don't want most of the things described here. Most of them just seem like anti-features and/or security holes.
• GuiA 7y ago
  "As a user, I don't want this" seems like a reasonable claim. "Then you don't know what other people want" doesn't seem like a reasonable response. People want a lot of things - but only use what they can access. Additionally, people will deliberately choose to use broken/painful systems if they have to, in order to accomplish a broader goal. Finally, the vast majority of systems used by users are built because they are profitable to build/operate. In many (most?) cases, they are not profitable to the user in the same way that they are to their builder/operator. From those simple observations, it seems like quite stretch to claim that anything that has many users is something that people want, and that they enjoy using.
  • onion2k 7y ago
    "As a user I don't want this" is reasonable. "As a user I don't want this therefore no one else should have it either." is a bit less reasonable, and implies that you don't know what other users want or care about what they need.
• monkin 7y ago
  > Then you're out of step with what users want these days. "Developers" or average Joe's? Most people I know don't know what push notifications are. RSS? "Some kind of gov agency?". Sharing? "Facebook button!". And, no, they aren't idiots, they just don't care and see any of that. ;)
  • JadeNB 7y ago
    > "Developers" or average Joe's? Most people I know don't know what push notifications are. RSS? "Some kind of gov agency?". Sharing? "Facebook button!". And, no, they aren't idiots, they just don't care and see any of that. ;) I think this leaves out a middle ground. The people who design web pages love this stuff, either business decision-makers (because they think it improves metrics) or programmers (because it's a cool way to implement the area of their technological expertise)—but you can be a techie, know exactly what all these things are, and not want them. (RSS is a funny one to see on the list. It's practically ancient, and most browsers seem to have given up on integrating it—which is a shame, because it's a low-flash solution to a real problem and is user-centered and -controlled.)
    • efreak 7y ago
      It wouldn't surprise me if user control is the problem most services have with RSS
• nitwit005 7y ago
  I'd be shocked if typical users understood what push notifications are, or even what those social network links for sharing things do. Sometimes there are counters on those sharing links, and a tiny portion of visitors seem to click them.
• dgellow 7y ago
  > Then you're out of step with what users want these days. Two things: 1. The person you respond to is also a user, no reason to dismiss their point of view 2. I don’t think browsers asked users for what they want! It’s a bit disingenuous to say “that’s what users want” when the communication is one way only.
  • onion2k 7y ago
    Try talking to some developer relations people from the Google Web team, Mozzila, Microsoft etc. They're all very receptive to feature requests. It absolutely isn't a one way street.
    • wtallis 7y ago
      How are feature requests from web developers to browser vendors evidence that browser vendors are paying attention to the desires of end users?
      • onion2k 7y ago
        The evidence is that the end users use these things when they're implemented in browsers and web developers adopt them in their apps.
        • pjmorris 7y ago
          I promise that I have never asked for a notification or a pop-up. They 'work' from the point of view of web sites and browser vendors, maybe more so than from the perspective of users.
          • onion2k 7y ago
            I promise that I have never asked for a notification or a pop-up. Very few people ask for a specific implementation of a feature unless they want you to clone something they've seen elsewhere. People don't do that. In user focus groups I've been in though users have told me that they find it hard to know when they need to pay attention to something, or when they've been tagged in to something, or to know when a server side task has completed, or when a long-running webworker process has completed. All of those things are obvious use cases for some sort of notification, and when the feature has been implemented users both enable them and click on them. Heck, I got a Google Calendar notification pop-up while I was writing this comment. The problem is that you don't want notifications so you want them to be removed from browsers and then no one gets notifications even if they want them. That's not reasonable. The answer is that you need to be able to block them easily; to turn that feature off for yourself. This exists (in Chrome) - chrome://settings/content/notifications You can disable them for all sites. And yet you'd rather complain that they exist instead.
• vincnetas 7y ago
  And because of that only megacorp is capable of developing web browser for "free".
• bryanrasmussen 7y ago
  Ok, a lot of these features requires the site to ask the user for permission to use them. What is the percentage of users giving permission for the usage? In my experience not that great even when asking for something that will definitely improve the user experience in that context of the site they are on. If users don't really give you permissions to use these things it implies to me that users don't really want them.
• raxxorrax 7y ago
  > Then you're out of step with what users want these days. We hear this pretty often without any evidence. He is a user, you are a user, that makes two opinions. I think the reality that companies set the rules and people just swallow what they get because alternatives require huge efforts. We also heard that users want large tiles that are all over their desktop with zero functionality.
  • stickfigure 7y ago
    In terms of development effort, maintaining a browser fork that merely disables these features seems pretty easy. If you think users would prefer that, why not make one? I personally don't think it would take off, because I think most user attitudes range from "want these features" to "ambivalence". But if you're so certain, why not try?
    • StefanKarpinski 7y ago
      Why does it require a fork? Having an advanced settings page with checkboxes for each of these web features seems straightforward and not overly confusing to normal users.
      • traviscj 7y ago
        > fork? Because it runs contrary to maintainer’s interests?
      • ksec 7y ago
        This, I have Safari Debug Mode on purely to disable all the annoyance. And with the current state of things there will likely never be an extension to do that.
      • oatmealsnap 7y ago
        Pretty sure that exists in Firefox
    • GuiA 7y ago
      Maintaining a fork that does that isn’t trivial, but it’s certainly doable by any one engineer. However, maintaining such a fork is not the only prerequisite for it “taking off”. It may well be that my great uncle would love that feature - but how are you going to get his attention when several vendors are already spending millions of dollars in marketing/design/etc to influence which browser he uses?
• andrepd 7y ago
  >when I hit a share button on a page Why would the share button be on a page? Surely this should be a native browser/OS function (as implemented km android, for instance)
• frereubu 7y ago
  Slightly off-topic perhaps, because I think you're making a general point, but although you may want the native shared box it only works for Safari users - https://caniuse.com/#search=web%20share%20api https://caniuse.com/#search=web%20share%20api - with apparently very little appetite for it from other browser vendors. Maybe its time will come, but I think there are lots of issues with implementation.
  • untog 7y ago
    No, it works on Chrome on Android too, so that’s the vast majority of mobile uses covered.
• enos_feedler 7y ago
  I think browser product teams are out of step with what users want these days. It is easy to confuse the browser ecosystem with users. Or even claim that the browser ecosystem is good for users, and therefore doing things to improve the ecosystem _is_ doing things the user wants. In truth, the user just wants to see the web page and have the browser get out of the way. You know who does that well? Native. Identity and payments are now _solved_ there. The web is still trying to figure out this out and probably never will. Too busy working on things that don't matter. Then something like AMP shows up, which actually builds _on_ the ecosystem, in _favor_ of the user experience, and people blow up about it. The browser ecosystem is sort of in a sad state, leadership wise.
• Ntrails 7y ago
  > But to take an example, when I hit a share button on a page.. You have already lost me, I do not believe I have ever done this, or wanted to do it