4 ms·

> interactive graphics on the web, and getImageData() is essentially your way of accessing a pixel buffer I'm sure it's a great feature when you need it, but m

> interactive graphics on the web, and getImageData() is essentially your way of accessing a pixel buffer I'm sure it's a great feature when you need it, but most websites have no legitimate need for it. Having this sort of feature off/blocked by default and whitelisted on a case-by-case basis makes a lot of sense to me. Are you trying to use a webapp image editor? Makes sense to whitelist it. Are you trying to read a local newspaper article online? Keep that shit off by default. In fact, that's how I treat even first-party javascript, because most websites are made worse by turning javascript on. It seems to follow a 90-9-1 rule; 90% of websites need no javascript, 9% need first-party javascript whitelisted, and 1% require some 3rd-party javascript.

woojoo666 4y ago
Whether or not you need it is tangential imo. People should be able to experience cool interactive visuals on websites without sacrificing their privacy
horsawlarway 4y ago
The problem here is that the main audience impacted by these "permissions prompts" has zero idea whether what the site is requesting makes any sense. You - as a developer - probably know that an image editing site might need this permission and other sites don't. The average user has zero (ZERO) clue. They don't know, they don't really care. Instead they arbitrarily accept or deny based on how scary the popup text is, or how annoying it becomes, or how much they depend on the site. Which is pretty terrible from all perspectives - Users get prompts that require decisions that they don't have the knowledge or context for. - Valid sites & businesses lose traffic because some users are scared away by scary sounding prompts that they don't understand. - Malicious sites still get a broad swath of data on users who don't give a rats ass about the prompts and have been conditions to just always hit yes. I think this style of implementation is basically always indicative of a failure.
- mmis1000 4y ago
  I think that is basically why vista's UAC prompt is so hated. They jump on so many place may or may not relevant to user's safety. And users don't really have clue the request is valid or not. Ends up just accept everything or "ok google, how to disable the damn UAC propmt"

woojoo666 4y ago

Whether or not you need it is tangential imo. People should be able to experience cool interactive visuals on websites without sacrificing their privacy

horsawlarway 4y ago

The problem here is that the main audience impacted by these "permissions prompts" has zero idea whether what the site is requesting makes any sense. You - as a developer - probably know that an image editing site might need this permission and other sites don't. The average user has zero (ZERO) clue. They don't know, they don't really care. Instead they arbitrarily accept or deny based on how scary the popup text is, or how annoying it becomes, or how much they depend on the site. Which is pretty terrible from all perspectives - Users get prompts that require decisions that they don't have the knowledge or context for. - Valid sites & businesses lose traffic because some users are scared away by scary sounding prompts that they don't understand. - Malicious sites still get a broad swath of data on users who don't give a rats ass about the prompts and have been conditions to just always hit yes. I think this style of implementation is basically always indicative of a failure.

mmis1000 4y ago
I think that is basically why vista's UAC prompt is so hated. They jump on so many place may or may not relevant to user's safety. And users don't really have clue the request is valid or not. Ends up just accept everything or "ok google, how to disable the damn UAC propmt"