4 ms·

I'd definitely prefer a web app to a mobile app. I just wish there was a way to automatically turn all this off when I'm just reading an article or filling a f

by swiley 6y ago

I'd definitely prefer a web app to a mobile app. I just wish there was a way to automatically turn all this off when I'm just reading an article or filling a form, browsers should have a special app mode.

moron4hire 6y ago
It's the inconsistency of the whole thing. Location API still exists, but you have to grant permission. But Battery API. WHOA NOW! That might be used to identify someone! Never mind all the tracking pixels and Google Analytics scripts on the page. Never mind IP Address plus Time of Day gets you greater than 50% of the way to identifying the user. This little battery discharge rate, that's the villain. Better remove it completely. HTTP Referer header is so unreliable and so frequently used to spam server logs that it would break nothing to remove it completely, yet it's still there and we've got people complaining about the `navigator.hardwareConcurrency` value "leaking information". Why does WebAudio need a user activation, but WebGL can run straight away, maybe even in a Worker where you'll never even see it? The userAgent string alone tells you tons of information about a user, especially when you consider how frequently browsers bump version numbers versus how much user upgrade patterns can lag behind. But Ambient Light Events, man, they might be used to capture the user's face, one pixel at a time, over the course of a year, so that's clearly evil, too! Because it's not really about security. It's all about pushing developers off of the Web and into app stores. Mozilla goes along because they're locked in an abusive relationship with their misinformed users, the 5% of the world that is so-called "privacy conscious" people who comprise their only user base. If you create an app that makes good use of advanced features, then it has a higher likelihood of being something people are willing to pay for. So what does an app developer do, if they need this functionality? They make a native app instead. The user is still giving up the information (not to mention their email address at the point of purchase), but the app now has to give up 30% of revenue and be at the whims of a group of unelected technocrats' ever-changing, unspecified censorship criteria.
- swiley 6y ago
  The anti web app people don't like the inconsistency either, everything except basic HTML rendering and form submission should require a permission prompt.
  - moron4hire 6y ago
    You would still be 100% fingerprintable. IP Address + Time of Access is pretty much all you need.

by swiley 6y ago

moron4hire 6y ago

It's the inconsistency of the whole thing. Location API still exists, but you have to grant permission. But Battery API. WHOA NOW! That might be used to identify someone! Never mind all the tracking pixels and Google Analytics scripts on the page. Never mind IP Address plus Time of Day gets you greater than 50% of the way to identifying the user. This little battery discharge rate, that's the villain. Better remove it completely. HTTP Referer header is so unreliable and so frequently used to spam server logs that it would break nothing to remove it completely, yet it's still there and we've got people complaining about the `navigator.hardwareConcurrency` value "leaking information". Why does WebAudio need a user activation, but WebGL can run straight away, maybe even in a Worker where you'll never even see it? The userAgent string alone tells you tons of information about a user, especially when you consider how frequently browsers bump version numbers versus how much user upgrade patterns can lag behind. But Ambient Light Events, man, they might be used to capture the user's face, one pixel at a time, over the course of a year, so that's clearly evil, too! Because it's not really about security. It's all about pushing developers off of the Web and into app stores. Mozilla goes along because they're locked in an abusive relationship with their misinformed users, the 5% of the world that is so-called "privacy conscious" people who comprise their only user base. If you create an app that makes good use of advanced features, then it has a higher likelihood of being something people are willing to pay for. So what does an app developer do, if they need this functionality? They make a native app instead. The user is still giving up the information (not to mention their email address at the point of purchase), but the app now has to give up 30% of revenue and be at the whims of a group of unelected technocrats' ever-changing, unspecified censorship criteria.

swiley 6y ago
The anti web app people don't like the inconsistency either, everything except basic HTML rendering and form submission should require a permission prompt.
- moron4hire 6y ago
  You would still be 100% fingerprintable. IP Address + Time of Access is pretty much all you need.