11 ms·

Absolutely blown away by the number of things you can do from a web browser these days. All of this would've been unimaginable a mere 10 years ago, right around

Absolutely blown away by the number of things you can do from a web browser these days. All of this would've been unimaginable a mere 10 years ago, right around the time when Google Chrome was in its infancy (or just out of it, to be precise) and the web browser market was still dominated by Internet Explorer, with Opera, Firefox and Safari (back when there was a Windows version of Safari) taking up small slices of the market share. Another cool site to check out: https://coveryourtracks.eff.org https://coveryourtracks.eff.org -- a great tool to see how unique your browser's 'fingerprint' is and how well it protects you from trackers and other annoyances online.

pfundstein 6y ago
Screen sharing/recording was a new one for me when I saw this nifty site on an earlier HN post: https://gifcap.dev/ https://gifcap.dev/
- abhiminator 6y ago
  I found out about screen-sharing through browser when I started using Discord app on the web. Was a very revealing moment for me when it came to insane advances in web technology.
  - cblconfederate 6y ago
    I think it even predates discord, i think appear.in offered it many years ago
catchmeifyoucan 6y ago
I just tried cover your tracks. What's blowing my mind are the "System Fonts" field. As a designer, I constantly download fonts, and it makes my browser extremely unique it seems.
- gsnedders 6y ago
  This is why Safari only exposes pre-installed fonts that come with the system to web content; it removes what can be a very unique fingerprinting data point.
gfxgirl 6y ago
I'm so glad. I trust running whatsapp.com, messenger.com, slack.com, discord.com, bluejeans.com, zoom.com etc.. I do not trust installing the Whatsapp app, slack app, discord app, zoom app, or bluejeans app. In the browser I have control, native (at least on Windows) I don't. Those native apps, at least on windows, can basically do anything. Read my entire hard drive, scan my network, install a key logger, turn on my camera and mic, etc.... In the browser they can't
- chronogram 6y ago
  Indeed. They're sandboxed and you can alter the webapps in the browser. I mildly edit the CSS of most of the websites I frequently use over time with Stylus.
- VWWHFSfQ 6y ago
  As long as those apps will run in my web browser, I'll run them there. I don't install any of their "native" apps.. Although Google Meet is getting very difficult to run in Firefox. Crashes all the time.
  - sneak 6y ago
    I ran into the issue recently where Zoom's web client wouldn't display my camera's correct aspect ratio. Their full client (on a burner laptop, don't trust them) had a setting to fix it.
  - lrem 6y ago
    Works fine in my Firefox... And does Google even offer native PC apps any more? I work there and haven't heard of such a thing.
    - rplnt 6y ago
      Drive and Photos have native apps, for obvious reasons (sync).
  - padenot 6y ago
    Can you give us a couple of these crashes, that you can find in about:crashes (with the date sometimes its easy to find the right one) ? If you send a link to padenot@mozilla.com I can have a look, I'm on the media team at Mozilla (that includes WebRTC). Thanks!
etaioinshrdlu 6y ago
Year after year the web remains my favorite platform to use and develop for. No other platform comes even close to the compatibility, reach, staying power as the web. Here's to 100 more years of the web (or something web-like in the future).
- JohnBooty 6y ago
  I agree with you. But I'm afraid we're in its dying days, at least as far as the original ideals of the web were concerned. In our rush to make browsers more powerful application platforms rivaling operating systems themselves, we raised the bar so high that we ensured the web's destruction: by guaranteeing that it would eventually be effectively controlled by a single browser maker. In practice, this was probably always going to be Google, but if it wasn't Google it would simply have been some other Google-sized player.
dheera 6y ago
10 years ago it would have been unimaginable, but 20 years ago you could have done all of this with ActiveX controls. (Oh and yeah 20 years ago I had AJAJ by just loading the target URL in a hidden/offscreen iframe and reading its contents programmatically. Never mind the fact that I could also read contents from the user's hard drives ... although I didn't use it for this)
- abhiminator 6y ago
  Ah ActiveX -- a gold mine for malicious actors.
  - AnIdiotOnTheNet 6y ago
    You say that like the web hasn't been. Hell, even if everything always worked properly, there were not XSS attacks, and users weren't easily fooled, the web would still be full of malicious actors in the form of tracking and advertisement. Remember, we invented pop-up blockers because advertisers abused it, and we've been in an arms race with those assholes ever since. Tracking and ads in desktop apps came from the web ecosystem and now we're stuck with it.
    - spookthesunset 6y ago
      I don’t think you can equate the two. ActiveX was barely sandboxed... in fact I’d like to say they were not sandboxed at all. They were native code running basically as root on your machine. It was something that came back when Microsoft was still convinced the internet would be a fad. Those activeX things could do all sorts of fun exciting things on your computer.
      - AnIdiotOnTheNet 6y ago
        Oh ActiveX was definitely worse, I should know since I was using the internet plenty when it was prominent. My point is, though, that malicious actors still basically control the web. They may not be executing native code without any controls, but that doesn't mean that the modern web isn't still their playground.
danShumway 6y ago
Note that coveryourtracks will be biased towards people who are private. It's a good way of identifying information that you're leaking, but you'll also see stats like 1 in 11 users disabling Javascript, which is just not representative of most of the web -- 10% of users on most sites are not disabling JS. It's still very useful, but don't take every single number it reports as gospel. It's tracking how unique you are among people who purposefully visit a fingerprint testing site.
- CyberRabbi 6y ago
  I casually browse with Js disabled. Everyone should. It’s a security nightmare to casually surf the web with Js enabled once you realize the frequency of WebKit/blink zero days being disclosed per month. iOS watering hole attacks are especially prevalent, even if those exploits tend not to be persistent. They just need to steal all your info once. Exhibit A: https://www.bleepingcomputer.com/news/security/google-warns-iphone-users-of-data-stealing-malware-attacks/ https://www.bleepingcomputer.com/news/security/google-warns-...
  - danShumway 6y ago
    There are a lot of advantage to browsing casually with Javascript disabled, assuming you're OK with needing to manually fix some of the sites you visit. I browse that way myself as well; that's why I can see the results I see when I load up the tracking site. Side note that UMatrix is officially deprecated at this point, but it's still a great resource for disabling scripts globally and enabling them site-by-site as needed. But 1 in 11 people on the web are not disabling Javascript.
cblconfederate 6y ago
I think it was very much imaginable but browser makers were/are in no hurry to have their precious app store ecosystems replaced by web apps.
II2II 6y ago
I'm still trying to figure out whether these capabilities are a good thing or a bad thing. On the positive side, what can be done through a web browser is absolutely amazing and web browsers offer finer grained control over resource access than the typical desktop operating system. On the negative side, most of these capabilities have privacy and security risks that are disproportionate to their value in a medium that is primarily used for media consumption.
- luxuryballs 6y ago
  One might even say that it’s a net negative for society.
luxuryballs 6y ago
Hold up the browser is sending them a unique-to-me microphone test audio recording hash? Um?

pfundstein 6y ago

Screen sharing/recording was a new one for me when I saw this nifty site on an earlier HN post: https://gifcap.dev/ https://gifcap.dev/

abhiminator 6y ago
I found out about screen-sharing through browser when I started using Discord app on the web. Was a very revealing moment for me when it came to insane advances in web technology.
- cblconfederate 6y ago
  I think it even predates discord, i think appear.in offered it many years ago

catchmeifyoucan 6y ago

I just tried cover your tracks. What's blowing my mind are the "System Fonts" field. As a designer, I constantly download fonts, and it makes my browser extremely unique it seems.

gsnedders 6y ago
This is why Safari only exposes pre-installed fonts that come with the system to web content; it removes what can be a very unique fingerprinting data point.

gfxgirl 6y ago

I'm so glad. I trust running whatsapp.com, messenger.com, slack.com, discord.com, bluejeans.com, zoom.com etc.. I do not trust installing the Whatsapp app, slack app, discord app, zoom app, or bluejeans app. In the browser I have control, native (at least on Windows) I don't. Those native apps, at least on windows, can basically do anything. Read my entire hard drive, scan my network, install a key logger, turn on my camera and mic, etc.... In the browser they can't

chronogram 6y ago
Indeed. They're sandboxed and you can alter the webapps in the browser. I mildly edit the CSS of most of the websites I frequently use over time with Stylus.
VWWHFSfQ 6y ago
As long as those apps will run in my web browser, I'll run them there. I don't install any of their "native" apps.. Although Google Meet is getting very difficult to run in Firefox. Crashes all the time.
- sneak 6y ago
  I ran into the issue recently where Zoom's web client wouldn't display my camera's correct aspect ratio. Their full client (on a burner laptop, don't trust them) had a setting to fix it.
- lrem 6y ago
  Works fine in my Firefox... And does Google even offer native PC apps any more? I work there and haven't heard of such a thing.
  - rplnt 6y ago
    Drive and Photos have native apps, for obvious reasons (sync).
- padenot 6y ago
  Can you give us a couple of these crashes, that you can find in about:crashes (with the date sometimes its easy to find the right one) ? If you send a link to padenot@mozilla.com I can have a look, I'm on the media team at Mozilla (that includes WebRTC). Thanks!

etaioinshrdlu 6y ago

Year after year the web remains my favorite platform to use and develop for. No other platform comes even close to the compatibility, reach, staying power as the web. Here's to 100 more years of the web (or something web-like in the future).

JohnBooty 6y ago
I agree with you. But I'm afraid we're in its dying days, at least as far as the original ideals of the web were concerned. In our rush to make browsers more powerful application platforms rivaling operating systems themselves, we raised the bar so high that we ensured the web's destruction: by guaranteeing that it would eventually be effectively controlled by a single browser maker. In practice, this was probably always going to be Google, but if it wasn't Google it would simply have been some other Google-sized player.

dheera 6y ago

10 years ago it would have been unimaginable, but 20 years ago you could have done all of this with ActiveX controls. (Oh and yeah 20 years ago I had AJAJ by just loading the target URL in a hidden/offscreen iframe and reading its contents programmatically. Never mind the fact that I could also read contents from the user's hard drives ... although I didn't use it for this)

abhiminator 6y ago
Ah ActiveX -- a gold mine for malicious actors.
- AnIdiotOnTheNet 6y ago
  You say that like the web hasn't been. Hell, even if everything always worked properly, there were not XSS attacks, and users weren't easily fooled, the web would still be full of malicious actors in the form of tracking and advertisement. Remember, we invented pop-up blockers because advertisers abused it, and we've been in an arms race with those assholes ever since. Tracking and ads in desktop apps came from the web ecosystem and now we're stuck with it.
  - spookthesunset 6y ago
    I don’t think you can equate the two. ActiveX was barely sandboxed... in fact I’d like to say they were not sandboxed at all. They were native code running basically as root on your machine. It was something that came back when Microsoft was still convinced the internet would be a fad. Those activeX things could do all sorts of fun exciting things on your computer.
    - AnIdiotOnTheNet 6y ago
      Oh ActiveX was definitely worse, I should know since I was using the internet plenty when it was prominent. My point is, though, that malicious actors still basically control the web. They may not be executing native code without any controls, but that doesn't mean that the modern web isn't still their playground.

danShumway 6y ago

Note that coveryourtracks will be biased towards people who are private. It's a good way of identifying information that you're leaking, but you'll also see stats like 1 in 11 users disabling Javascript, which is just not representative of most of the web -- 10% of users on most sites are not disabling JS. It's still very useful, but don't take every single number it reports as gospel. It's tracking how unique you are among people who purposefully visit a fingerprint testing site.

CyberRabbi 6y ago
I casually browse with Js disabled. Everyone should. It’s a security nightmare to casually surf the web with Js enabled once you realize the frequency of WebKit/blink zero days being disclosed per month. iOS watering hole attacks are especially prevalent, even if those exploits tend not to be persistent. They just need to steal all your info once. Exhibit A: https://www.bleepingcomputer.com/news/security/google-warns-iphone-users-of-data-stealing-malware-attacks/ https://www.bleepingcomputer.com/news/security/google-warns-...
- danShumway 6y ago
  There are a lot of advantage to browsing casually with Javascript disabled, assuming you're OK with needing to manually fix some of the sites you visit. I browse that way myself as well; that's why I can see the results I see when I load up the tracking site. Side note that UMatrix is officially deprecated at this point, but it's still a great resource for disabling scripts globally and enabling them site-by-site as needed. But 1 in 11 people on the web are not disabling Javascript.

cblconfederate 6y ago

I think it was very much imaginable but browser makers were/are in no hurry to have their precious app store ecosystems replaced by web apps.

II2II 6y ago

I'm still trying to figure out whether these capabilities are a good thing or a bad thing. On the positive side, what can be done through a web browser is absolutely amazing and web browsers offer finer grained control over resource access than the typical desktop operating system. On the negative side, most of these capabilities have privacy and security risks that are disproportionate to their value in a medium that is primarily used for media consumption.

luxuryballs 6y ago
One might even say that it’s a net negative for society.

luxuryballs 6y ago

Hold up the browser is sending them a unique-to-me microphone test audio recording hash? Um?