5 ms·

For personal sites? Sure, why not. For anything commercial though, especially in media publishing, this is just insane. I'm beginning to think the old generat

For personal sites? Sure, why not. For anything commercial though, especially in media publishing, this is just insane. I'm beginning to think the old generation of "celebrity" web devs (the ones that became famous in the 2000s - now around in their 50s) has really lost touch with the modern web for some time now. And this comes from someone who's actually bought all of Jeremy's books. The fact that Google is switching away from third party cookies is surely not a matter of "resisting the tide" as Jeremy writes. It's actually about more control. Whoever controls the web platform (=the browser) can now control the ad landscape [1]. See how Google used AMP to promote a supposedly "faster" web (and it's now being sued for for preferencial ad placement) [2]. [1] https://www.reuters.com/technology/googles-browser-cookies-plan-anti-competitive-advertisers-tell-eu-2021-09-28/ https://www.reuters.com/technology/googles-browser-cookies-p... [2] https://www.theregister.com/2021/10/26/google_deliberately_throttled_ad_load/ https://www.theregister.com/2021/10/26/google_deliberately_t...

the__alchemist 5y ago
Your reaction is in line with this speculation about reactions from the article: "On today’s modern web it sounds like advice from a tinfoil-hat wearing conspiracy nut." Your post doesn't address any details from the article; it reads like a gut reaction.
horsawlarway 5y ago
I spent a good chunk of my career working in software security. I'm fairly damn well convinced at this point that a WHOLE LOT of modern security practices are actually technical run-arounds on missing legislation. Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course. We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!) It turns out small sites can make a pretty compelling web experience when they can coordinate and work together (links to each other, shared preferences, decentralized identity) and it's absolutely NOT a mistake that many large orgs are now using every technical lever than can to prevent that sort of organization. I see "Security" as filling the same space as union busting right now - make it impossible for those smaller than you to become threatening by banding together. When you keep them divided you can eat them at your leisure.
- actually_a_dog 5y ago
  > Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course. > We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!) I don't think I've ever seen a walled garden justified in the name of security. Generally, it seems to be more about keeping the user within your ecosystem, so you can capture the value of their attention (i.e. show them ads).
  - juanani 5y ago
    >I don't think I've ever seen a walled garden justified in the name of security. Hmm, have you ever heard of Apple?
  - kijin 5y ago
    Apple requires all apps to be installed through the App Store. Google requires all in-app payments to go through Google Play. The obvious reason for these requirements is that it's profitable for them. But how do they justify it to their users? More convenience? A unified experience? No, their most prominent argument is that it's safer that way.
    - actually_a_dog 5y ago
      Those examples are not applicable. The context of the article, and the comment I was quoting from, clearly indicate a web environment.
      - teddyh 5y ago
        Well, you wrote “a walled garden”, which could reasonably be interpreted as any walled garden in software generally. But if we are charitable and limit ourselves to web site “walled gardens”, how do YouTube and Facebook, etc. justify their “oops, you clicked on an external link! If might lead anywhere! Are you really, really sure you want to continue?”, if security is not their argument?
bee_rider 5y ago
He seems to have addressed your point already (I think. "just insane" is a little vague, so it is hard to tell what your objection is). > Easier said than done, right? Especially if you’re working on a site that currently relies on third-party tracking for its business model. But that exploitative business model won’t change unless people like us are willing to engage in a campaign of passive resistance. > I know, I know. If you refuse to add that third-party script, your boss will probably say, “Fine, I’ll get someone else to do it. Also, you’re fired.” > This tactic will only work if everyone agrees to do what’s right. We need to have one another’s backs. We need to support one another. The way people support one another in the workplace is through a union.
- actually_a_dog 5y ago
  True though this may be, I don't see unions gaining any real mindshare among developers. Whenever the subject comes up, you get the standard straw man arguments against unions, and that either ends the discussion, or turns it into some extended shit show that ultimately goes nowhere. While you might be able to easily "vote with your feet" in this industry, not everybody can afford to stand up for a principle like this on penalty of getting fired. I don't know what the real solution here is. I'd like to see unions make gains among software engineers, but there's a lot of animosity from people who think they'll be "held back" if they have to join a union. I don't see that kind of attitude going away anytime soon.
  - bee_rider 5y ago
    The IEEE code of ethics and the ACM code of ethics both have language in them about privacy, so I think those software engineers are not living up to the standards of their professional societies.
Puts 5y ago
I don't know what industries you've been working in but in any sensitive business third-party javascripts are under the same tight controls as any other code, and changes in javascripts are going through the same change management controls as any other code before entering production. Even Google have had issues with malware being distributed via adsense: https://www.businessinsider.com/google-has-shut-down-a-malicious-ad-attack-on-its-adsense-network-2016-11?r=US&IR=T https://www.businessinsider.com/google-has-shut-down-a-malic... Not to speak of the Megacart hacks: https://www.riskiq.com/blog/external-threat-management/magecart-british-airways-breach/ https://www.riskiq.com/blog/external-threat-management/magec...
- dec0dedab0de 5y ago
  You can't put third party javascript through change management. Unless you download and host it yourself, in which case it's not really third party.
  - Puts 5y ago
    Well we can absolutely talk semantics. Code written by a third-party is third-party code however it is hosted. Your conclusion is right however. If you are serious with your security and change management you host all scripts yourself. Or use sub-source integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
    - dec0dedab0de 5y ago
      Of course it's third party code. I meant that it's not really third party in the context of this article advocating for a same origin policy for javascript. I only came across SRI while dealing with CSP, and I didn't quite understand why anyone would subject themselves to that until just now. Thanks for pointing it out.

the__alchemist 5y ago

Your reaction is in line with this speculation about reactions from the article: "On today’s modern web it sounds like advice from a tinfoil-hat wearing conspiracy nut." Your post doesn't address any details from the article; it reads like a gut reaction.

horsawlarway 5y ago

I spent a good chunk of my career working in software security. I'm fairly damn well convinced at this point that a WHOLE LOT of modern security practices are actually technical run-arounds on missing legislation. Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course. We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!) It turns out small sites can make a pretty compelling web experience when they can coordinate and work together (links to each other, shared preferences, decentralized identity) and it's absolutely NOT a mistake that many large orgs are now using every technical lever than can to prevent that sort of organization. I see "Security" as filling the same space as union busting right now - make it impossible for those smaller than you to become threatening by banding together. When you keep them divided you can eat them at your leisure.

actually_a_dog 5y ago
> Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course. > We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!) I don't think I've ever seen a walled garden justified in the name of security. Generally, it seems to be more about keeping the user within your ecosystem, so you can capture the value of their attention (i.e. show them ads).
- juanani 5y ago
  >I don't think I've ever seen a walled garden justified in the name of security. Hmm, have you ever heard of Apple?
- kijin 5y ago
  Apple requires all apps to be installed through the App Store. Google requires all in-app payments to go through Google Play. The obvious reason for these requirements is that it's profitable for them. But how do they justify it to their users? More convenience? A unified experience? No, their most prominent argument is that it's safer that way.
  - actually_a_dog 5y ago
    Those examples are not applicable. The context of the article, and the comment I was quoting from, clearly indicate a web environment.
    - teddyh 5y ago
      Well, you wrote “a walled garden”, which could reasonably be interpreted as any walled garden in software generally. But if we are charitable and limit ourselves to web site “walled gardens”, how do YouTube and Facebook, etc. justify their “oops, you clicked on an external link! If might lead anywhere! Are you really, really sure you want to continue?”, if security is not their argument?

bee_rider 5y ago

He seems to have addressed your point already (I think. "just insane" is a little vague, so it is hard to tell what your objection is). > Easier said than done, right? Especially if you’re working on a site that currently relies on third-party tracking for its business model. But that exploitative business model won’t change unless people like us are willing to engage in a campaign of passive resistance. > I know, I know. If you refuse to add that third-party script, your boss will probably say, “Fine, I’ll get someone else to do it. Also, you’re fired.” > This tactic will only work if everyone agrees to do what’s right. We need to have one another’s backs. We need to support one another. The way people support one another in the workplace is through a union.

actually_a_dog 5y ago
True though this may be, I don't see unions gaining any real mindshare among developers. Whenever the subject comes up, you get the standard straw man arguments against unions, and that either ends the discussion, or turns it into some extended shit show that ultimately goes nowhere. While you might be able to easily "vote with your feet" in this industry, not everybody can afford to stand up for a principle like this on penalty of getting fired. I don't know what the real solution here is. I'd like to see unions make gains among software engineers, but there's a lot of animosity from people who think they'll be "held back" if they have to join a union. I don't see that kind of attitude going away anytime soon.
- bee_rider 5y ago
  The IEEE code of ethics and the ACM code of ethics both have language in them about privacy, so I think those software engineers are not living up to the standards of their professional societies.

Puts 5y ago

I don't know what industries you've been working in but in any sensitive business third-party javascripts are under the same tight controls as any other code, and changes in javascripts are going through the same change management controls as any other code before entering production. Even Google have had issues with malware being distributed via adsense: https://www.businessinsider.com/google-has-shut-down-a-malicious-ad-attack-on-its-adsense-network-2016-11?r=US&IR=T https://www.businessinsider.com/google-has-shut-down-a-malic... Not to speak of the Megacart hacks: https://www.riskiq.com/blog/external-threat-management/magecart-british-airways-breach/ https://www.riskiq.com/blog/external-threat-management/magec...

dec0dedab0de 5y ago
You can't put third party javascript through change management. Unless you download and host it yourself, in which case it's not really third party.
- Puts 5y ago
  Well we can absolutely talk semantics. Code written by a third-party is third-party code however it is hosted. Your conclusion is right however. If you are serious with your security and change management you host all scripts yourself. Or use sub-source integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
  - dec0dedab0de 5y ago
    Of course it's third party code. I meant that it's not really third party in the context of this article advocating for a same origin policy for javascript. I only came across SRI while dealing with CSP, and I didn't quite understand why anyone would subject themselves to that until just now. Thanks for pointing it out.