6 ms·

The web already has a user-facing permissions system; it wouldn't be hard to add many of these under that umbrella (USB, Bluetooth, and Sensors stand out as obv

• chipperyman573 6y ago
  I own a business and recently had to change all the pictures on my website from webp to png because safari both refuses to render webp and pretends to accept them. I hate it so much and see very real costs in increased bandwith (every image is around 3-4x bigger) but I have no choice because I want people with iphones to be able to buy things from me. Safari is honestly just as bad as chrome but for different reasons (ios safari was arguably the single biggest cause of the death of flash, for example). I also had to go through and fix a few other pseudo css classes that only safari didn't support which was really annoying, what a waste of time. I don't think many people would consider "Don't use safari" banners a valid option unless the website was somehow really focused on non-apple users or not trying to sell something.
  • _bxg1 6y ago
    I use Roll20, a popular web app for playing tabletop games with others over the internet. It doesn't work in Firefox or Safari; it's the only reason I keep Chromium on my machine.
    • Kalium 6y ago
      Really? That's very odd. I use in just fine with Firefox weekly.
      • _bxg1 6y ago
        It might only be the video/audio chat that's broken, but I know something about it was broken
        • fenwick67 6y ago
          About 6 months ago I remember it being totally unusable on FF, even without using the AV stuff.
    • chipperyman573 6y ago
      For every example you can find me of a website that doesn't support safari I could find 10 that make exceptions to do so. The point isn't that nobody does it, it's just that most companies who want to make money from the general population (aka most of them) have to. Roll20 is also such a niche thing already it's not really a fair example. People who want to use roll20 will use another browser because they want to play dnd with their friends. Most stores don't have that social aspect.
      • _bxg1 6y ago
        My point is that if YouTube stopped working on Firefox because they didn't agree to a new standard Google had invented, lots of people would stop using Firefox. It takes someone who really cares about these issues to bother switching back and forth between two different browsers because you want to use a non-Chromium for most things but have to use Chromium for a couple of things. The vast majority would just say "well, whatever" and switch completely.
        • deleted 6y ago
          [deleted]
    • 6y ago
  • uryga 6y ago
    > safari both refuses to render webp and pretends to accept them weird, i haven't had that issue! i run a site that's set up¹ to redirect image requests to a WebP version if the Accept header allows it; half our team uses Macs w/ Safari and no one reported any issues with images. --- ¹ wordpress + webp-express: https://github.com/rosell-dk/webp-express https://github.com/rosell-dk/webp-express i guess it's possible they special-case Safari, i'll check later
    • chipperyman573 6y ago
      It could've been my setup, to be honest I had just finished fixing all the pseudo classes and was kind of frustrated and decided to just switch to png after I couldn't figure it out in 5 minutes hahaha But whatever the case is, Safari definately does not support webp and special exceptions need to be made to support this edge case.
      • cookiengineer 6y ago
        > https://caniuse.com/#search=webp https://caniuse.com/#search=webp Nope you are right, when reading the linked issues, safari doesn’t have webp support.
        • ComputerGuru 6y ago
          Yeah, but that’s not the issue/question. Not supporting webp is fine, the important thing is that it doesn’t send an accept header that includes it. I don’t believe it does.
          • uryga 6y ago
            just had a friend with a Mac test it. when requesting foo.jpg (from an <img> tag), it sends: Accept: image/png, image/svg+xml, image/*;q=0, video/*;q=0.8, */*;q=0.5 the server responds with foo.jpg. i also tested it in Firefox, which sends: Accept: image/webp, */* the server responds with foo-converted.webp. honestly, i'm not entirely sure how image/*;q=0 */* etc are handled, but it works; i also briefly looked at the plugin's source, and i haven't found any special handling for Safari. btw, here's a test page linked in their docs: http://toste.dk/rh.php http://toste.dk/rh.php --- edit: looking at the generated .htaccess, it appears that WebP is served only if Accept contains an explicit `image/webp` (no wildcards), so that explains it.
  • stx 6y ago
    > ios safari was arguably the single biggest cause of the death of flash I count that as a good thing about ios safari.
    • deleted 6y ago
      [deleted]
• josteink 6y ago
  > The web already has a user-facing permissions system; it wouldn't be hard to add many of these under that umbrella (USB, Bluetooth, and Sensors stand out as obvious candidates that should've been behind that barrier from the beginning) Let’s add Javascript to that list too. Not all sites need it, and given the abuse it’s responsible for, it shouldn’t be permitted unless a user opts in.
  • vbezhenar 6y ago
    Chrome allows to disable JavaScript by default and only allowing it on some websites. Probably privacy and security-conscious users use that feature.
    • Shared404 6y ago
      Pretty sure most privacy conscious users don't use Chrome.
  • hombre_fatal 6y ago
    That was also the logic behind Windows Vista's UAC popup.
    • josteink 6y ago
      A great example! That single move from Microsoft more or less eliminated the need for any normal application run by any normal user to require admin-rights to function, something which up to that point more or less had been the norm. Developers fixed their applications to work with a sane privilege level and pretty much everyone was better off. Let’s do the same with the rampant JS-abuse on the web.
  • neotek 6y ago
    >Not all sites need it, and given the abuse it’s responsible for, it shouldn’t be permitted unless a user opts in. And 99.999% of internet users will therefore be trained to blindly click "accept" on any permission popups a website shows them, since outside of HN pretty much everybody loves and appreciates the rich functionality javascript provides.
• alerighi 6y ago
  I don't think these features are bad, they are useful in some ways. Why we need USB on the browser? Think about updating the firmware of a device, you just go to the webpage, connect the device to the USB and update it, without having to download and install a tool to flash it, for an operation that you need to do just one time. This is only one example of many that we can make, another could be IDEs in the browser to program boards like Arduino, without installing software on the PC. Battery status? It could be useful to know if the PC is connected to a power source and the level of the battery, even for a stupid scenario like watching a video, when I'm low on battery I usually reduce the resolution of a YouTube video because reproducing a 4k60p video uses a lot of resources, and drains the battery quickly. It would be useful if the webapp could just do that automatically, maybe on YouTube an option like reduce resolution when low on battery. Or for games, or whatever uses a lot of resources. Think about it: the only reason because Electron apps exist (and we waste 200Mb of disk for each one of them) is only because browsers don't have APIs to access the filesystem! To me is a waste, the browser should give each application (let's stop calling them sites, they are no longer that) the APIs and permissions to access hardware, just like on mobile devices you have a dialog that says "this app would like to access the internal storage, consent or deny?". Where is the problem? The user should give the privilege (only one time) and you finally can do basically 99% of work in the browser (and maybe the browser introduces also API to run the application in a window), you no longer need Electron just to do these kind of things, is still more secure than Electron because the code is sandboxed by the browser, and you don't have to worry about packaging your software for different operating systems.
  • vbezhenar 6y ago
    Another use-case for USB is to access crypto tokens. There are USB devices which store private key and allow to perform crypto operations. It's much safer than storing private key in file system. Using those keys in website is a useful feature.
    • goalieca 6y ago
      Ditto for smart cards. I've seen a lot of activex apps over the years do this.
• fenwick67 6y ago
  > I think for this we can blame Chromium's dominance. As the author said, many of these features were probably motivated by Chrome OS. And the devil's bargain of letting Chromium take such complete control over the web is that Google can strongarm whichever new "standards" they like into the Web. The dark side to this is that the Chrome team can implement an API as an experiment, then when it's ready, propose it to the standards body and push it through before anybody else can catch up.
  • _bxg1 6y ago
    Yeah, that too
  • deleted 6y ago
    [deleted]
  • andrewguenther 6y ago
    I don't really see it as a dark side, but an important part of standardization. Why standardize an API no one wants? What's the best way to know someone wants it? What's the best way to work out the kinks in a proposal? A reference implementation. I get what you're saying though. Google has the manpower to crank these out at a volume none of its competitors can, but I don't think that's a failure of the standards process.
    • pferde 6y ago
      I don't think it's about the manpower, but more about controlling a browser engine that powers an ever-increasing number of mainstream browsers. Chrome's lumbering march to total dominance has been frightening to watch for many years now, and it only seems to be accelerating.
      • londons_explore 6y ago
        The fact they accept PRs from outside changes your argument a little. If you have a good idea for a new web standard, you can download the chromium source, add your new standard, build your cool webservice to work with it, and send the chromium OWNERS (many of whom don't work for Google) a PR. Sure, there will be a bunch of rounds of review and questioning if your feature really is suitable for the whole web, but at the end of the day you'll probably get it in. Then you can add it to Firefox. You could theoretically add it to safari too, but they don't really like taking PR's these days...
• mindslight 6y ago
  > The standards committee doesn't want WebBatteryStatus? Fine, we'll implement it anyway and now Chrome desktop/mobile, Chromebooks, and Edge will all have it. Sites that want to use it will probably just use it and throw up a "Use Chrome" notification for Firefox and Safari. The right answer is for Mozilla to implement the API, and leave it disabled by default. Disabled meaning it reports 90% full all the time, or some suitable probability distribution. If a specific API is actually useful for something, then the browser can notice if it being used and pop up its own permissions dialog to enable the API per-site.
  • usefulcat 6y ago
    That is starting to sound a lot like some sort of arms race.
    • no_wizard 6y ago
      Truth is, from the browser vendor perspective, it already is. Firefox used to be in an "arms race" of sorts when it was one of the most dominate browsers as well. Google just intensifies this reality as Microsoft with internet explorer rested on their laurels at a certain point which let Mozilla not have to push as fast/hard as they do now.
    • mindslight 6y ago
      Yes, as is any ecosystem with competing parties. Surveillance companies want to exfiltrate as much information as possible, users want security. Every new facet added to the API is a site for this competition. Which is why every new web API needs to be reviewed by someone looking out for security of the users.
• _448 6y ago
  Reminds me of the EEE and Microsoft post recently on HN.