4 ms·

I am still on team "why haven't these been deprecated by all major browsers yet". I literally get calls from people who believe their computer has "malware", a

I am still on team "why haven't these been deprecated by all major browsers yet". I literally get calls from people who believe their computer has "malware", and it's just dozens of notification subscriptions in their browser spewing adult content ads onto their screen. Of all the web APIs out there, this is the one most aggressively misused for spam ads, and most rarely actually useful. We literally spent a decade demanding people add a popup blocker into the web browser, and a decade later, injected a popup ad tool back into the browser.

moritonal 4y ago
I disagree, I think it's a great feature that let's apps like ProtonMail not require a desktop app. What it needs is a user-driven gesture restriction and a harsh penalty by Google for firing on first-load.
- ocdtrekkie 4y ago
  If a web standard only works if Google "penalizes" people, it's a bad web standard. I hate having to express this weekly, but Google is not the web. I really don't think any mail client needs corner of screen popups to be useful: I respond to most emails within 5-10 minutes, have used web email since 2005, and I've never wanted or allowed push notifications on my desktop. It is, at best, a solution looking for a problem, and at worst, an adtech popup spec maliciously impressed upon the web with a casual justification for building it.
  - endisneigh 4y ago
    Why not disable notifications if you don’t like them? This functionality is opt in. If you don’t toggle this feature flag you’d never even know. Lol
    - dijit 4y ago
      > Why not disable notifications if you don’t like them? Lol The “Lol” at the end of your comment is misplaced, comes off as condescending. Not everyone is the same as you, maybe they had considered turning them off and it’s possible that they believe that it may not be an option. For people outside of tech who do not mess with the settings of their devices, ironically the same people who are likely to be abused by this feature, then having a toggle is not very useful overall anyway. But, I’m not happy with your tone as it brings down the whole conversation to the same tired old flame war/shit slinging that inevitably happens when someone starts it with mild condescension on the internet.
      - endisneigh 4y ago
        Given that the feature in question is explicitly opt in, there’s no problem then.
    - ocdtrekkie 4y ago
      Notifications is enabled by default on every major browser that supports them. I turn them off, and at work, push a policy to disable them across the org, but it's still something I see and hear a lot afflicting non-technical users, especially seniors.
- rektide 4y ago
  I agree that it's a great feature. It's just actively terrible for 99.9999% of websites. There is a user-gesture restriction. So now there's an HTML pop-up on dozens of pages. Imo the user-gesture + permission-modal design is fundamentally bad. We penalize sites by making them have to maim their cover with grotesque user-gesture cutouts, then, once the user clicks (makes a user gesture) they have to click again. Sites should just request push notifications, without user gestures. Something should show up in the awesome-bar, and users can enable it at their leasure. Rather than an active "pull" flow for permissions, we need a "push" flow where users can passively enable/disable some permissions freely, in a more chill way. Conversion rates would plummet, but the whole web would be a much more pleasant place & actually operate for-the-user, which is what the internet is for[1]. [1] https://datatracker.ietf.org/doc/html/rfc8890 https://datatracker.ietf.org/doc/html/rfc8890
- teakettle42 4y ago
  > I think it's a great feature that let's apps like ProtonMail not require a desktop app. For many users, being forced into web-only non-native cloud “apps” is not actually feature. Especially for something like end-to-end ostensibly client-side encrypted e-mail.
  - endisneigh 4y ago
    Why would you be forced exactly? Developers can still make native apps.
    - teakettle42 4y ago
      Forced by developers that refuse to make the necessary investment in producing native applications, because — with features like web push notifications — the poor web UX is something these developers consider “good enough”. This thread is about actively facilitating that kind of behavior by developers.
      - endisneigh 4y ago
        That’s not what forced means. Consider that there are developers who have apps with no notifications at all. For some, something is better than nothing. Personally I like web notifications, if the site doesn’t implement them well then turn it off for that site.
        teakettle42 4y ago
        “Forced” means to be compelled by force or necessity. I’m forced to use crappy web apps for work. How does it benefit Apple — or Apple’s users — for Apple to facilitate forcing users into crappy, non-native web apps?
        endisneigh 4y ago
        Again, no one is being forced. This isn’t even opt out, it’s opt-in. So, yeah, no one is forcing anyone. It’s simply an option.
ABeeSea 4y ago
I use browser notifications for google calendar every day. It is slightly annoying that the notification chime plays for each calendar tab I have open and forgot to close though.
cosmotic 4y ago
The best use of this feature is 'Chrome apps' or "Edge apps" where a web version of an app (like facebook messenger or whatsapp) can live inside the process of the browser instead of their own whole separate process, drastically reducing memory usage and energy consumption. Though it's kind of a workaround for the electron app anti-pattern.
Beltalowda 4y ago
It's useful for "native" web-based apps, both on mobile devices and things like Electron. But for regular browsers: yeah nah. Although, for some things like Telegram web or email it could be useful; the problem here is (as always): how do you allow the useful uses without the twats moving in to engage in their twattery? I never heard of this before though, but turns out it's been in Firefox since 2016. I did set "always deny" for notifications a few years ago as I got so tired of all the sites whining about it, so I guess that includes these push things too(?) Sites still whine about it with in-site popups of course if they see that permission is denied... Sigh... When looking it up a bit for this comment I found this description that I found somewhat amusing: "Web push notifications allow users to opt-in to timely updates from sites they love and allow you to effectively re-engage them with customized, relevant content." Lotsa words for "allows you to spam them ads".
hbn 4y ago
Yeah I was glad Apple was holding out on this. We've had years now to realize that this API is basically only going to be used to trick users into getting spammed with garbage they don't want. I don't know why Apple chose now to implement them.
tshaddox 4y ago
> I literally get calls from people who believe their computer has "malware", and it's just dozens of notification subscriptions in their browser spewing adult content ads onto their screen. That is most definitely malware.
- ocdtrekkie 4y ago
  I agree, Google Chrome is malware. As in these cases it is actually just notification API subscriptions, a feature browsers chose to implement.
  - tshaddox 4y ago
    I'm under the impression that Chrome requires approval for each origin to deliver notifications.
    - ocdtrekkie 4y ago
      It does. But that is not adequate. Unfortunately Google does not understand users at all, and hence, unfortunately does not understand practical security. The first thing you have to understand is that users click everything, especially when it isn't doing what they want. So websites throw these prompts up endlessly, hoping users will inadvertently click it. Worse, some sites will abuse alert() and essentially demand the user accept installing an extension or enabling notifications to proceed. (Particularly guilty here is search ads and the garbage ads Edge puts on their new tab page.) Then the doubly problematic design here is that websites can prompt people to accept these, but users have to find an obscure setting to either remove those approvals or deny new requests. Users by and large don't even know that exists. I disable notification requests in every browser I put my hands on, but unfortunately I can't put my hands on every browser on Earth. It's really up to web standards bodies and browser vendors to realize the API is doing drastically more harm than good.
      - tshaddox 4y ago
        I agree that software (especially "platform-y" software like web browsers) vendors have responsibility to provide informative and unobtrusive UI, in order to (among other reasons) protect users from malware. I also agree that Chrome doesn't do a great job here, and that web notifications need a lot of re-thinking across the board. But I don't agree with the leap to "Google Chrome is malware." Chrome isn't doing enough to protect their users from notifications from malicious websites, but I reject the sensationalist conclusion that Google Chrome itself is malware.
usrn 4y ago
No one would care about web push if sideloading worked.
- collaborative 4y ago
  True. Although it is nice to have an app be truly cross-platform. If MS released Windows with pre-installed WSA we would be half way there. The truth is we are still perhaps a decade away from this and everyone running M1's happening so until then PWAs fill the gap
om2 4y ago
We have a number of technical protections to limit abuse potential and will be monitoring the situation. Websites like Twitter, Facebook, Protonmail, Slack, etc seem like they could benefit from push notifications for the same reason their native apps do. It’s true that other websites ask for low value / spammy uses.
- ocdtrekkie 4y ago
  I've seen so much abuse in this on desktop I really think it should be intentionally hard to turn this on. Like registry-editing-level hard.

moritonal 4y ago

I disagree, I think it's a great feature that let's apps like ProtonMail not require a desktop app. What it needs is a user-driven gesture restriction and a harsh penalty by Google for firing on first-load.

ocdtrekkie 4y ago
If a web standard only works if Google "penalizes" people, it's a bad web standard. I hate having to express this weekly, but Google is not the web. I really don't think any mail client needs corner of screen popups to be useful: I respond to most emails within 5-10 minutes, have used web email since 2005, and I've never wanted or allowed push notifications on my desktop. It is, at best, a solution looking for a problem, and at worst, an adtech popup spec maliciously impressed upon the web with a casual justification for building it.
- endisneigh 4y ago
  Why not disable notifications if you don’t like them? This functionality is opt in. If you don’t toggle this feature flag you’d never even know. Lol
  - dijit 4y ago
    > Why not disable notifications if you don’t like them? Lol The “Lol” at the end of your comment is misplaced, comes off as condescending. Not everyone is the same as you, maybe they had considered turning them off and it’s possible that they believe that it may not be an option. For people outside of tech who do not mess with the settings of their devices, ironically the same people who are likely to be abused by this feature, then having a toggle is not very useful overall anyway. But, I’m not happy with your tone as it brings down the whole conversation to the same tired old flame war/shit slinging that inevitably happens when someone starts it with mild condescension on the internet.
    - endisneigh 4y ago
      Given that the feature in question is explicitly opt in, there’s no problem then.
  - ocdtrekkie 4y ago
    Notifications is enabled by default on every major browser that supports them. I turn them off, and at work, push a policy to disable them across the org, but it's still something I see and hear a lot afflicting non-technical users, especially seniors.
rektide 4y ago
I agree that it's a great feature. It's just actively terrible for 99.9999% of websites. There is a user-gesture restriction. So now there's an HTML pop-up on dozens of pages. Imo the user-gesture + permission-modal design is fundamentally bad. We penalize sites by making them have to maim their cover with grotesque user-gesture cutouts, then, once the user clicks (makes a user gesture) they have to click again. Sites should just request push notifications, without user gestures. Something should show up in the awesome-bar, and users can enable it at their leasure. Rather than an active "pull" flow for permissions, we need a "push" flow where users can passively enable/disable some permissions freely, in a more chill way. Conversion rates would plummet, but the whole web would be a much more pleasant place & actually operate for-the-user, which is what the internet is for[1]. [1] https://datatracker.ietf.org/doc/html/rfc8890 https://datatracker.ietf.org/doc/html/rfc8890
teakettle42 4y ago
> I think it's a great feature that let's apps like ProtonMail not require a desktop app. For many users, being forced into web-only non-native cloud “apps” is not actually feature. Especially for something like end-to-end ostensibly client-side encrypted e-mail.
- endisneigh 4y ago
  Why would you be forced exactly? Developers can still make native apps.
  - teakettle42 4y ago
    Forced by developers that refuse to make the necessary investment in producing native applications, because — with features like web push notifications — the poor web UX is something these developers consider “good enough”. This thread is about actively facilitating that kind of behavior by developers.
    - endisneigh 4y ago
      That’s not what forced means. Consider that there are developers who have apps with no notifications at all. For some, something is better than nothing. Personally I like web notifications, if the site doesn’t implement them well then turn it off for that site.
      - teakettle42 4y ago
        “Forced” means to be compelled by force or necessity. I’m forced to use crappy web apps for work. How does it benefit Apple — or Apple’s users — for Apple to facilitate forcing users into crappy, non-native web apps?
        endisneigh 4y ago
        Again, no one is being forced. This isn’t even opt out, it’s opt-in. So, yeah, no one is forcing anyone. It’s simply an option.

ABeeSea 4y ago

I use browser notifications for google calendar every day. It is slightly annoying that the notification chime plays for each calendar tab I have open and forgot to close though.

cosmotic 4y ago

The best use of this feature is 'Chrome apps' or "Edge apps" where a web version of an app (like facebook messenger or whatsapp) can live inside the process of the browser instead of their own whole separate process, drastically reducing memory usage and energy consumption. Though it's kind of a workaround for the electron app anti-pattern.

Beltalowda 4y ago

It's useful for "native" web-based apps, both on mobile devices and things like Electron. But for regular browsers: yeah nah. Although, for some things like Telegram web or email it could be useful; the problem here is (as always): how do you allow the useful uses without the twats moving in to engage in their twattery? I never heard of this before though, but turns out it's been in Firefox since 2016. I did set "always deny" for notifications a few years ago as I got so tired of all the sites whining about it, so I guess that includes these push things too(?) Sites still whine about it with in-site popups of course if they see that permission is denied... Sigh... When looking it up a bit for this comment I found this description that I found somewhat amusing: "Web push notifications allow users to opt-in to timely updates from sites they love and allow you to effectively re-engage them with customized, relevant content." Lotsa words for "allows you to spam them ads".

hbn 4y ago

Yeah I was glad Apple was holding out on this. We've had years now to realize that this API is basically only going to be used to trick users into getting spammed with garbage they don't want. I don't know why Apple chose now to implement them.

tshaddox 4y ago

> I literally get calls from people who believe their computer has "malware", and it's just dozens of notification subscriptions in their browser spewing adult content ads onto their screen. That is most definitely malware.

ocdtrekkie 4y ago
I agree, Google Chrome is malware. As in these cases it is actually just notification API subscriptions, a feature browsers chose to implement.
- tshaddox 4y ago
  I'm under the impression that Chrome requires approval for each origin to deliver notifications.
  - ocdtrekkie 4y ago
    It does. But that is not adequate. Unfortunately Google does not understand users at all, and hence, unfortunately does not understand practical security. The first thing you have to understand is that users click everything, especially when it isn't doing what they want. So websites throw these prompts up endlessly, hoping users will inadvertently click it. Worse, some sites will abuse alert() and essentially demand the user accept installing an extension or enabling notifications to proceed. (Particularly guilty here is search ads and the garbage ads Edge puts on their new tab page.) Then the doubly problematic design here is that websites can prompt people to accept these, but users have to find an obscure setting to either remove those approvals or deny new requests. Users by and large don't even know that exists. I disable notification requests in every browser I put my hands on, but unfortunately I can't put my hands on every browser on Earth. It's really up to web standards bodies and browser vendors to realize the API is doing drastically more harm than good.
    - tshaddox 4y ago
      I agree that software (especially "platform-y" software like web browsers) vendors have responsibility to provide informative and unobtrusive UI, in order to (among other reasons) protect users from malware. I also agree that Chrome doesn't do a great job here, and that web notifications need a lot of re-thinking across the board. But I don't agree with the leap to "Google Chrome is malware." Chrome isn't doing enough to protect their users from notifications from malicious websites, but I reject the sensationalist conclusion that Google Chrome itself is malware.

usrn 4y ago

No one would care about web push if sideloading worked.

collaborative 4y ago
True. Although it is nice to have an app be truly cross-platform. If MS released Windows with pre-installed WSA we would be half way there. The truth is we are still perhaps a decade away from this and everyone running M1's happening so until then PWAs fill the gap

om2 4y ago

We have a number of technical protections to limit abuse potential and will be monitoring the situation. Websites like Twitter, Facebook, Protonmail, Slack, etc seem like they could benefit from push notifications for the same reason their native apps do. It’s true that other websites ask for low value / spammy uses.

ocdtrekkie 4y ago
I've seen so much abuse in this on desktop I really think it should be intentionally hard to turn this on. Like registry-editing-level hard.