13 ms·

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letti

• masa331 6y ago
  No no no. The problem isn't JavaScript or web capabilities here. It's the companies and people who use them in evil ways. I would rather handle that even if it's much much harder.
  • alentist 6y ago
    Yes yes yes. Luckily for us, these problems are technically solvable, no handling (?) "evil ways" (?) needed. The latter proposal is both ill-defined and a waste of time and resources. Better to spend those resources on designing more secure systems.
  • DavideNL 6y ago
    Yea... You need either a law/sanctions, or a technical restriction that can't be circumvented. Hopefully both, someday :)
  • xg15 6y ago
    And how would you address this problem?
    • CogitoCogito 6y ago
      Regulation seems appropriate.
      • Daho0n 6y ago
        So different website features per country? Or do you mean regulation decides how a browser implements it? Either way I don't see how that would ever work.
        • CogitoCogito 6y ago
          You are aware there are country-specific (or even more local) regulations covering companies today right? In fact essentially all regulations are. So why are you acting like my proposition is somehow unprecedented?
          • TaylorAlexander 6y ago
            Isn’t it obvious? Most companies subject to regulations are physically located somewhere. It’s much harder to enforce regulations against companies that operate in every global jurisdiction at once.
            • CogitoCogito 6y ago
              There are like 3 companies that do the vast majority of advertising. They have operations in countries they do business with. Do you think they’re hard to track down? Web tracking has consolidated over time hence enforcement is _easier_.
          • Daho0n 6y ago
            Because this is about websites, not companies. I'm not a company. Do my website use a different regulated subset of JavaScript than yours? If it is a company do they follow local rules or local for the hosting company? What about sites that incorporate sources from different locations? Do JavaScript library developers now have to create a version of their script for each countries regulation? Then the US regulation will decide the rules for all of the worlds JavaScript development and deployment. No, which technologies that can be used on a website doesn't belong at regulators but developers. What can and cannot be tracked and collected belongs at regulators.
    • mikem170 6y ago
      I browse in firefox with javascript turned off, in ublock, with a bunch of other restrictions [0], and temporary containers. I make exceptions for a couple dozen sites, like my bank, open street maps, etc. Youtube is my only soft spot here, the rest of google I keep blocked. I can make one-off exceptions to read a tab in front of me, but that's not routine, it's not hard to find sites that support this. [0] https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js
      • nunez 6y ago
        How do you use the internet with JS turned off? Every time I try doing this, I undo it five seconds later because of so many sites breaking instantly. (I sometimes browse the web with w3m; sites blocking you because of no JS happens often)
        • boring_twenties 6y ago
          Many sites break instantly. If I care enough about those sites, I whitelist them. Otherwise I move on. On the other hand, many sites work better with JS disabled: they load much faster, don't slow down scrolling, don't break copy & paste, and so on. edit: I should probably make clear that I'm not the same user you responded to
        • mikem170 6y ago
          I can usually find alternatives that works without javascript. Or I find sources outside of the big tracking companies, like openstreetmaps instead of google maps, etc. I'm not a promiscuous browser, if I click on an interesting link and I get an empty page because it insists on javascript I close that tab and figure I saved myself from wasting my time on a crappy ad-tracking-infested website, so many of which are lame anyways. That being said I do sometimes enable javascript temporarily on sites when I am desperately looking for some specific bit of info, then I reset back to my default-off when finished. I've been doing this for a couple/few years, and it doesn't seem like a big deal to me. I'm happy to have that reminder that a site is irritating me insisting on javascript for no good reason, more often I go elsewhere and that suits me fine. It saves me from having to worry about so many nefarious things that go on in this space. Why not give it a try? Ublock lets you default disable all javascript and enable it on the page you are looking at with a couple clicks, and edit/revert your list of rules whenever you want. You might be pleasantly surprised at how few times you need to fiddle with it after you set it up for your important sites.
  • ballenf 6y ago
    I don't think it's either/or. Yeah we need to act against companies abusing it, but we also need to be prudent and put locks on our houses when we know there are thieves and spies who would love to sneak inside and take notes on our every move. What frustrates me the most is that we can't individually disable web api's that provide no value to us. Yeah, that would give greater entropy to fingerprinting, but I'm willing to take that tradeoff if I could prevent webrtc, motion sensing, screen size detection, or web assembly e.g. except on selected whitelisted websites.
  • throwaway9d0291 6y ago
    Doesn't the same argument apply to basically every security and privacy feature? "No no no. The problem isn't unencrypted network connections, it's companies and people who use them in evil ways. I would rather handle that even if it's much harder." Should we not have introduced HTTPS? Permission models on modern operating systems? 2-factor authentication? What about Javascript makes it different to the problems solved by these other features?
• fimbulvetr 6y ago
  Somewhat off topic but have you see all of the recent (2 years) malware using webassembly? It's difficult to disable in chrome, somewhat difficult to disable in firefox, and no extensions seem to help. I'd love make it as easy to disable as JS.
  • dotancohen 6y ago
    Webassembly is about to become as necessary for browsing the modern web as Javascript is today. For much of the same reasons: you must keep it on to be tracked, so it will be "made necessary" on as much of the commercial web as possible.
  • bilinguliar 6y ago
    No surprise WebAssembly is disabled in Chrome on OpenBSD.
• nicklaf 6y ago
  This is why I whitelist Javscript on a per-subdomain basis. I think NoScript does this but I use a simpler extension[0] and then rely on uBlock origin and multi account containers for privacy once I've whitelisted sites. [0] https://addons.mozilla.org/en-US/firefox/addon/disable-javascript/ https://addons.mozilla.org/en-US/firefox/addon/disable-javas...
  • gorhill 6y ago
    In case you are not aware, uBO also allows to wholly disable/enable JS on a per-site basis.[1] --- [1] https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-scripting https://github.com/gorhill/uBlock/wiki/Per-site-switches#no-...
    • nicklaf 6y ago
      Ah, brilliant! Thanks for pointing that out to me (and for uBO).
• musicale 6y ago
  This is what tempers my enthusiasm for WebAssembly - it will undoubtedly be used for all sorts of user-hostile and malicious activity.
  • eeZah7Ux 6y ago
    ...and with zero accountability. Any website can push 10MB of obfuscated, debugger-resistant, code on your computer. Obfuscated to resist ad-blockers and anti-tracking features.
    • throwaway525142 6y ago
      asm.js was a thing before WebAssembly, with the same downsides, except maybe a little less browser support for debugging, inspecting, etc. asm.js was able to exist without browser support in Chrome, so WebAssembly support doesn't really bring anything new to the table. At least that's how I understand it, care to give ideas why it's not a positive change? :)
      • namibj 6y ago
        WASM is fast enough that you can internally sell it as "speed improvement" to keep your developers happy and who else might question your intentions. asm.JS tends to be slower than direct JS.
      • eeZah7Ux 6y ago
        > care to give ideas why it's not a positive change? What I wrote above: it's going to encourages 10x more bloated and obfuscated websites. Apart from the security and privacy issues, it will make the web even less accessible to users with slower Internet connections (some 2bln people) and visually-impaired users.
• tannhaeuser 6y ago
  It didn't sound reasonable when JavaScript was introduced, and it didn't sound reasonable with WASM, yet here we are.
• amanzi 6y ago
  Couldn't this particular trick be done purely server-side?
• nalekberov 6y ago
  Well, I agree with you, but to be honest it's not Javascript, it's Web APIs gave a lot opportunities to surveillance capitalists. But even if you turn off Javascript, you are not invisible or untraceable, you are just getting a little harder to be tracked. I don't wanna name anyone, but there are tons of famous websites that tracks by including <img> tags and referencing pixel trackers. I usually browse with JS turned off, it's blazingly fast, and, well most websites work without any significant drawbacks.
• austincheney 6y ago
  > Note that the root of all evil here is Javascript Not exactly. The root of all evil here is HTTP. You don’t need any JavaScript to plant cookies or other tracking assets. As a proof this technique is used to track users in email, such as embedding a 1 pixel image in an email retrieved via HTTP.
  • bluGill 6y ago
    Which is why I turn off HTML email by default, and even when I turn it on for one message images are not loaded except by a second step. I rarely get to the first step and even less often the second.
    • bromuro 6y ago
      HTML should be an opt-in too! :)
• goflyapig 6y ago
  It sounds like they're talking about ETags [1] here. I don't think JavaScript has anything to do with it. [1] https://en.wikipedia.org/wiki/HTTP_ETag#Typical_usage https://en.wikipedia.org/wiki/HTTP_ETag#Typical_usage
  • simias 6y ago
    Ooh, that's interesting. The way it was described made me think that you needed some JS to check if the data was in cache or not. I guess it's probably a bad idea to let the browser send this type of potentially unique info to the server by default, but I understand how it makes sense from a performance perspective. As far as I'm concerned privacy should always trump performance, but I realize that not everybody shares this point of view.
  • yc12340 6y ago
    ETags and Last-Modified headers can be used for long-term user tagging, but without Javascript they provide a lot less value in terms of tracking. Suppose, that you are visiting a web site with Evil Embedding (an iframe tag or script, that loads Evil Resource on behalf of advertiser). If your browser requests Evil Resource without telling advertiser the name of top-level site, the advertiser gets little. They get to know, that user 9062342154 is online and they are asking for Evil Resource X, but that's all. They can't even tell, which specific website is being visited! The real problems start, when the top level web site cooperates with advertiser by running a Javascript "bridge", that acts both as an arbiter and a communication channel for siphoning your information. In addition to transferring information, the bridge acts as anti-fraud measure to confirm, that there is no foul play on the part of web site operator. Since the script is Turing-complete and can be updated anytime, there is no way to restrict it's actions.
    • pflanze 6y ago
      > If your browser requests Evil Resource without telling advertiser the name of top-level site, the advertiser gets little. But the advertiser will get the referrer so will know the domain name? (And if they didn't, they could require the site operator to include the site name in the resource URL.)
• scrollaway 6y ago
  > it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specifically, it's the only reason many kids can do remote learning as efficiently as they can. Dude/dudette, I'm not a big fan of JS but let's recognize the good it has brought on the world, instead of complaining in the likes of what amounts to "if only we still lived in caves, we wouldn't have those pesky problems with online advertising" or something.
  • Const-me 6y ago
    > It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. I think Basic, Pascal or Python achieved more at that. > it's the only reason many kids can do remote learning as efficiently as they can. The main reason is internets and TCP/IP, that’s essential and irreplaceable. Another important reason is h.264, equivalents do exist, but given the state of hardware acceleration it’s irreplaceable, at least not on mobile devices. JavaScript ain’t an essential tech, as it’s replaceable on both clients and servers. Your kids would learn equally efficiently using a native app instead of these JS-rich web sites.
    • scrollaway 6y ago
      I've worked with python 17 years. I've taught python, javascript and typescript. There is a universe between how accessible JS is vs Python. And TCPIP may have helped but just because it's essential part of the stack doesn't mean the remote learning could have happened without JS existing (in the time it did). The web would be a glorified FTP server if some people here had their way.
      • wirthjason 6y ago
        As a Python programmer myself I’m curious, what’s the difference?
• eeZah7Ux 6y ago
  > Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created No, it was already very unreasonable, especially as the browsers of the time had even worse sandboxing than now.
• exporectomy 6y ago
  Turing completeness isn't the problem. If Javascript was one of those non-Turing-complete languages that don't have loops, etc. then it could still be used to track people. I think you're using that term to make your opinion sound powerful, but the power comes from what it has access to.
• scott_w 6y ago
  Firefox explicitly talks about abusing IMAGE caches and you’re waffling about JS. The two things are not related here so stop trying to conflate them.
  • tremon 6y ago
    The image caches offer no means to identify individual users unless you're able to re-parse the client side (cached) data. Guess what component is essential to perform that client-side parsing?
    • scott_w 6y ago
      So tracking pixels in email clients aren’t a thing? Trust me, people will find ways around it without JS. Reinventing Flash, for a start.
      • yc12340 6y ago
        Yes, tracking pixels aren't a thing (anymore). Gmail no longer loads them. Thunderbird no longer loads them. Most providers, offering online email, have already caught on. > Trust me, people will find ways around it without JS. Reinventing Flash, for a start. There is no need for that. Why bother, when you can write a mobile app in proper computer language and eliminate the middleman (browser)?
        • scott_w 6y ago
          The fact Flash existed disproves your hypothesis.