5 ms·

The kind of spyware they’re imagining has been possible since the beginning of personal computers. Given the critics understand this, do they believe the requi

The kind of spyware they’re imagining has been possible since the beginning of personal computers. Given the critics understand this, do they believe the required knowledge to write a native app is too obscure at this point to be considered harmful? I say this because the measurable difference between a desktop keylogger and this is having to run the downloaded program manually. Heck I bet a lot of keyboard manufacturer’s “drivers” do this today.

hyperman1 5y ago
The thread model is different. On PCs, there was no fast/commercialized enough internet to worry much about spyware. What good is fingerprinting if you can't send the result to a server. What good is tracking every individual if nobody will pay you to send ads? Notice in the same way how good old IE6 with ActiveX was horribly insecure, but it didn't matter as much until the Internet itself became an ad-infested environment. Desktop software could theoretically do a lot of harm in the past, but there was no point apart from childish damage. Viruses were more a kind of graffiti. Ransomware did not exist, there was no way to pay the ransom. I don't like how e.g. Wayland pulls up high walls between software. Applications work best when they can easily share data, including robotic automatization, keylogging and screen recording. But it seems that innocent time is simply gone. Even major software companies shamelessly piss in the well by deploying trackers and malware together with their software. So I hate to say it but the wayland devs are probably doing it right.
danShumway 5y ago
> do they believe the required knowledge to write a native app is too obscure at this point to be considered harmful? No, but user expectations about safety between native apps and web apps are different. I will say that, personally, I think that native apps place far too little emphasis on security/fingerprinting, and I think that we're kind of ignoring a serious problem with the lack of default sandboxing for native apps. I don't know that it makes sense for every native app on my computer to have this kind of capability. I think most of the native apps on my computer shouldn't be able to access the Internet at all if I'm being honest. But that's just my personal opinion, other people have different approaches/philosophies about software -- and disregarding my own preferences, I think it makes a lot of sense to worry more about fingerprinting in an environment like the web where people are running a lot more untrusted code than they normally would. The web has kind of been a boon for native security, it's really good that users have a quick way to run code that doesn't involve download software and giving it access to their filesystem. It significantly lowers the number of opportunities for attacks. But that only works if the alternative to native apps is both: A) useful enough that users can commonly use it as an alternative to downloading software and running it on their filesystem B) sandboxed enough that it's not just equivalent security-wise to downloading software and running it on a native filesystem. Figuring out how to strike a balance between those two concerns is why thinking about security/fingerprinting on the web is hard.

hyperman1 5y ago

The thread model is different. On PCs, there was no fast/commercialized enough internet to worry much about spyware. What good is fingerprinting if you can't send the result to a server. What good is tracking every individual if nobody will pay you to send ads? Notice in the same way how good old IE6 with ActiveX was horribly insecure, but it didn't matter as much until the Internet itself became an ad-infested environment. Desktop software could theoretically do a lot of harm in the past, but there was no point apart from childish damage. Viruses were more a kind of graffiti. Ransomware did not exist, there was no way to pay the ransom. I don't like how e.g. Wayland pulls up high walls between software. Applications work best when they can easily share data, including robotic automatization, keylogging and screen recording. But it seems that innocent time is simply gone. Even major software companies shamelessly piss in the well by deploying trackers and malware together with their software. So I hate to say it but the wayland devs are probably doing it right.

danShumway 5y ago

> do they believe the required knowledge to write a native app is too obscure at this point to be considered harmful? No, but user expectations about safety between native apps and web apps are different. I will say that, personally, I think that native apps place far too little emphasis on security/fingerprinting, and I think that we're kind of ignoring a serious problem with the lack of default sandboxing for native apps. I don't know that it makes sense for every native app on my computer to have this kind of capability. I think most of the native apps on my computer shouldn't be able to access the Internet at all if I'm being honest. But that's just my personal opinion, other people have different approaches/philosophies about software -- and disregarding my own preferences, I think it makes a lot of sense to worry more about fingerprinting in an environment like the web where people are running a lot more untrusted code than they normally would. The web has kind of been a boon for native security, it's really good that users have a quick way to run code that doesn't involve download software and giving it access to their filesystem. It significantly lowers the number of opportunities for attacks. But that only works if the alternative to native apps is both: A) useful enough that users can commonly use it as an alternative to downloading software and running it on their filesystem B) sandboxed enough that it's not just equivalent security-wise to downloading software and running it on a native filesystem. Figuring out how to strike a balance between those two concerns is why thinking about security/fingerprinting on the web is hard.