3 ms·

Not necessarily. There are “web standards” pushed by Google that are inherently inimical to increased privacy and cannot be implemented with sufficient security

Not necessarily. There are “web standards” pushed by Google that are inherently inimical to increased privacy and cannot be implemented with sufficient security for a billion devices. I have to use Chrome and Chromium-based browsers for a lot of what I do, and the very first thing I do when I have to set it up or configure a new profile is _disable_ crap like: - Web USB - Web MIDI - Web HID - Web Push - Web Motion Sensors - Site protocol handlers - Web Serial Ports - Web local file editing - Payment handlers - VR - Attention That is, I make it so that sites aren’t even allowed to ASK me for those permissions. I know that a regular did a Web MIDI site recently that is sort of neat, but the protocol is essentially impossible to secure. Each and every single one of those things provides additional security risk, fingerprinting opportunities, and privacy leaks BY DESIGN, and I can’t ever see turning them on.

afavour 5y ago
I feel like Web USB and Web MIDI always come up in conversations like these and I don’t think I’ve ever met anyone that cares too deeply about either. Don’t get me wrong, I know there’s a market for them, but in the context of this conversation they just feel like diversions. When I talk about Apple dedicating resources to Safari I mean that IndexedDB was broken for years. And was broken again just last month: https://www.theregister.com/2021/06/16/apple_safari_indexeddb_bug/ https://www.theregister.com/2021/06/16/apple_safari_indexedd... This isn’t engineering that priotisises battery life. This is flat out neglect. Aren’t there unit tests for these kind of things pre-release? I don’t want to be able to interface with a MIDI keyboard on my site, I just want to be able to store data reliably.
- berkes 5y ago
  To pile on, several other APIs have little or no privacy issues, when done right. Push notifications: no, obviously I don't want seo-loaden-adwords-stuffing.blog to send me push-notifications. But I do want m.twitter.com, weatheralerts.app or m.issuetracker.local to send me those. I don't want cdn.random-ad-network.com to read my location. But I do want weatheralerts and publictransport.planner to read them. bird.watcher is free to use my camera and littlealchemy.app is free to use localstorage. Apple decides for me that I don't want this. Protecting users' privacy would mean research and innovation in how to make those choices. Anything from centralised whitelists to better UX for those permissions. Apple invests in none of these and instead denies it to all.

afavour 5y ago

I feel like Web USB and Web MIDI always come up in conversations like these and I don’t think I’ve ever met anyone that cares too deeply about either. Don’t get me wrong, I know there’s a market for them, but in the context of this conversation they just feel like diversions. When I talk about Apple dedicating resources to Safari I mean that IndexedDB was broken for years. And was broken again just last month: https://www.theregister.com/2021/06/16/apple_safari_indexeddb_bug/ https://www.theregister.com/2021/06/16/apple_safari_indexedd... This isn’t engineering that priotisises battery life. This is flat out neglect. Aren’t there unit tests for these kind of things pre-release? I don’t want to be able to interface with a MIDI keyboard on my site, I just want to be able to store data reliably.

berkes 5y ago
To pile on, several other APIs have little or no privacy issues, when done right. Push notifications: no, obviously I don't want seo-loaden-adwords-stuffing.blog to send me push-notifications. But I do want m.twitter.com, weatheralerts.app or m.issuetracker.local to send me those. I don't want cdn.random-ad-network.com to read my location. But I do want weatheralerts and publictransport.planner to read them. bird.watcher is free to use my camera and littlealchemy.app is free to use localstorage. Apple decides for me that I don't want this. Protecting users' privacy would mean research and innovation in how to make those choices. Anything from centralised whitelists to better UX for those permissions. Apple invests in none of these and instead denies it to all.