4 ms·

God I hate the modern web. Why the hell does my browser need more than periodic contact with any server other than my DNS provider and the host of the website

by causi 5y ago

God I hate the modern web. Why the hell does my browser need more than periodic contact with any server other than my DNS provider and the host of the website I'm connecting to?

MauranKilom 5y ago
What does "more than periodic" mean? But to answer your question: For example, to inform you that an update is available.
- account42 5y ago
  Updates and associated checks should not be done by each application itself.
  - Karunamon 5y ago
    Hard disagree. Having that in the hands of the OS is a separation of concerns issue. I want my OS people focusing on OS stuff. The versions of installed apps is up to the developers of those apps, doubly so on something like a browser that updates rapidly.
    - pessimizer 5y ago
      No, the versions of installed apps should be up to me. And my OS should help me manage that.
- causi 5y ago
  "Need" is the key phrase. If it wants to check for updates, do telemetry, fiddle around, whatever, that's fine by me. It should not shit the bed if it has to go a few hours without doing so, however. For example, you recall a couple of years ago when Mozilla screwed up their certificates and every Firefox extension was simultaneously disabled. That should not have happened. That should have resulted in a pop-up box that said "The security of your extensions cannot be verified. Using them at this time could be highly dangerous. Disable them to browse safely? Yes/No" Instead Mozilla just blanket turned them all off, which had the potential for getting people killed as they suddenly found themselves not protected by VPN/Tor/NoScript/etc extensions.
  - rockdoe 5y ago
    Software shouldn't have bugs, got it. It should be written by bug-free programmers that foresee every possible failure mode (that they can never imagine happening, because they won't write bugs themselves).
npteljes 5y ago
Even DNS is pretty WTF worthy if you think about it. Contacting a third party about the website you're about to visit. On an unencrypted channel no less. Another third party request is Firefox's phishing/malware protection. It periodically downloads their own bad site collection and if you visit a site, it check if it's on the list. And if it isn't, it checks with Google if the site is okay. https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_how-does-phishing-and-malware-protection-work-in-firefox https://support.mozilla.org/en-US/kb/how-does-phishing-and-m... P.s. Tor Browser turns this Safe Browsing feature off. Looks like I'm on the same page as them on the implications of it.
- account42 5y ago
  Wow, I did not realize it would send URLs to Google. That does not sound GDPR-compliant. But even without the privacy issue, you should turn off save browsing because google should not be in control of what users can and cannot donwload. They clearly do not care about keeping that list free of false positives, for example: http://dege.freeweb.hu/dgVoodoo2/ http://dege.freeweb.hu/dgVoodoo2/ > It does NOT contain any malware. Use a browser that is free of Google Shit Browsing security service crap (which is based on tons of noname antivirus "engines", look at VirusTotal if interested). I have also experienced Googles disregard for false positives on that list myself. While they may "remove" false listings after you bug them, those entries will just be re-added the next week and of course because this is Google there is no way to get an actual human to look into it. It is insane that all browsers allow a private company to maintain such a list without complete transparency and publicly visible reasoning for why each entry is in it as well as well defined procedures to contest false postives with agagain, publicly visible reasons for denial.
  - dblohm7 5y ago
    > Wow, I did not realize it would send URLs to Google. That does not sound GDPR-compliant. That's not how Firefox does safe browsing. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-... "One of the most persistent misunderstandings about Safe Browsing is the idea that the browser needs to send all visited URLs to Google in order to verify whether or not they are safe."
rockdoe 5y ago
Security updates for the browser, certificate checks (so you know it's the right website you're connecting to....) you can't get away from.

by causi 5y ago

God I hate the modern web. Why the hell does my browser need more than periodic contact with any server other than my DNS provider and the host of the website I'm connecting to?

MauranKilom 5y ago

What does "more than periodic" mean? But to answer your question: For example, to inform you that an update is available.

account42 5y ago
Updates and associated checks should not be done by each application itself.
- Karunamon 5y ago
  Hard disagree. Having that in the hands of the OS is a separation of concerns issue. I want my OS people focusing on OS stuff. The versions of installed apps is up to the developers of those apps, doubly so on something like a browser that updates rapidly.
  - pessimizer 5y ago
    No, the versions of installed apps should be up to me. And my OS should help me manage that.
causi 5y ago
"Need" is the key phrase. If it wants to check for updates, do telemetry, fiddle around, whatever, that's fine by me. It should not shit the bed if it has to go a few hours without doing so, however. For example, you recall a couple of years ago when Mozilla screwed up their certificates and every Firefox extension was simultaneously disabled. That should not have happened. That should have resulted in a pop-up box that said "The security of your extensions cannot be verified. Using them at this time could be highly dangerous. Disable them to browse safely? Yes/No" Instead Mozilla just blanket turned them all off, which had the potential for getting people killed as they suddenly found themselves not protected by VPN/Tor/NoScript/etc extensions.
- rockdoe 5y ago
  Software shouldn't have bugs, got it. It should be written by bug-free programmers that foresee every possible failure mode (that they can never imagine happening, because they won't write bugs themselves).

npteljes 5y ago

Even DNS is pretty WTF worthy if you think about it. Contacting a third party about the website you're about to visit. On an unencrypted channel no less. Another third party request is Firefox's phishing/malware protection. It periodically downloads their own bad site collection and if you visit a site, it check if it's on the list. And if it isn't, it checks with Google if the site is okay. https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_how-does-phishing-and-malware-protection-work-in-firefox https://support.mozilla.org/en-US/kb/how-does-phishing-and-m... P.s. Tor Browser turns this Safe Browsing feature off. Looks like I'm on the same page as them on the implications of it.

account42 5y ago
Wow, I did not realize it would send URLs to Google. That does not sound GDPR-compliant. But even without the privacy issue, you should turn off save browsing because google should not be in control of what users can and cannot donwload. They clearly do not care about keeping that list free of false positives, for example: http://dege.freeweb.hu/dgVoodoo2/ http://dege.freeweb.hu/dgVoodoo2/ > It does NOT contain any malware. Use a browser that is free of Google Shit Browsing security service crap (which is based on tons of noname antivirus "engines", look at VirusTotal if interested). I have also experienced Googles disregard for false positives on that list myself. While they may "remove" false listings after you bug them, those entries will just be re-added the next week and of course because this is Google there is no way to get an actual human to look into it. It is insane that all browsers allow a private company to maintain such a list without complete transparency and publicly visible reasoning for why each entry is in it as well as well defined procedures to contest false postives with agagain, publicly visible reasons for denial.
- dblohm7 5y ago
  > Wow, I did not realize it would send URLs to Google. That does not sound GDPR-compliant. That's not how Firefox does safe browsing. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-... "One of the most persistent misunderstandings about Safe Browsing is the idea that the browser needs to send all visited URLs to Google in order to verify whether or not they are safe."

rockdoe 5y ago

Security updates for the browser, certificate checks (so you know it's the right website you're connecting to....) you can't get away from.