6 ms·

Good. Web push is such a mess. The amount of people with Android phones like my grandma that accepted push notifications on some spam site, either by accident o

by hbn 4y ago

Good. Web push is such a mess. The amount of people with Android phones like my grandma that accepted push notifications on some spam site, either by accident or because users are so conditioned to just click "ok" to make popups go away, it's absurd.

maicro 4y ago
FYI, you can disable the ability for Chromium-based browsers to even ask the user if they want to allow notifications - on my Android phone in Chrome, it's under Settings, Site settings. There you can set "Notifications" to "Blocked" (and if you're paranoid like me, turn most others off as well).
- starik36 4y ago
  I doubt his grandma would find this option.
  - maicro 4y ago
    Absolutely fair, but that's why I set that on all browsers I configure for family, and recently had to walk my sister through on her phone when she accidentally allowed notifications from some website that started spamming her with various scam attempts.
- zakki 4y ago
  I don’t know if they’ll accept this solution. The other camp just want: “It works automatically like magic”. I just want to point out that we have to be familiar with the tools we used.
- babypuncher 4y ago
  You can do this in Firefox as well. However, nagging the shit out of users should not be the default behavior. They knew that this feature would get abused by every sleazy webmaster on the planet as soon as it was supported in popular browsers. The feature should have been properly designed in the first place. Now I'm content with letting it die. I appreciate Apple's willingness to more or less ignore open standards that hurt the user experience more than they benefit it.
- brigandish 4y ago
  I wonder, does setting this stop one from getting or subscribing to notifications on sites where they're wanted?
  - maicro 4y ago
    As I understand it (I never want notifications so don't have any experience with it), it's only blocking new sites from asking to send notifications. So if you find a site you want notifications from, you can change that back to "Ask" temporarily, allow for that site, and then change back to "Block" for all sites by default. Note that that behavior might be different on mobile vs. desktop browsers, but again, I don't really know how to test, sorry.
solarkraft 4y ago
The request mechanism is so broken. There shouldn't be a pop-up at all. The website should declare a notification source and you should be able to subscribe to it if you feel like it. Somewhere in the overflow menu. The website shouldn't even get the option to natively bother you about it.
- ocdtrekkie 4y ago
  That's the right way to do it, but then the Chromium team that implemented it doesn't get good numbers to use for their promo packets. And there's no understanding among a lot of web standards people that popups for site permissions are widely used by malicious actors. Apple consulted the community and thought about security, and that's why this implementation is refreshingly better.
  - account42 4y ago
    If it was just Chrome that made these user-hostile decisions then I wouln't care that much, but for some reason Mozilla decides to copy most of them.
    - ocdtrekkie 4y ago
      Eh, in most cases it is just Chrome. WebUSB, Web Serial, a dozen others, Chrome has implemented despite both Mozilla and Apple saying they won't because the risk of malicious use is too high. I would argue (and have argued before), if placed behind a well-understood consent concept like "installing" the PWA, it would be safer to implement these sorts of APIs.
  - danShumway 4y ago
    It's not just Web Push, most permissions should be user-prompted, not site-prompted. If the user doesn't know how to enable those permissions, then they also very likely don't know how to disable them either, which is a problem. If they don't know those permissions exist, they also probably don't know what the implications are of turning them on. Giving them a bunch of yes/no dialogs to click through doesn't change anything about the obligation to educate users about their device permissions, and if they are educated properly then they can set those permissions themselves. Google (and browser manufactures in general) kind of taught people that the way we do permissions is that apps ask for them and the user says yes/no, and the app responds. It's not entirely only their fault, but it's the wrong way to think about it in my opinion. I'm not even sure I like the word "permissions". Most permissions should be better thought of as "capabilities" and they should be something granted by the user, not requested by the app, and the app shouldn't be able to tell the difference between a phone/platform that doesn't support those capabilities at all and a phone/platform where the user has denied those capabilities. A lot of issues about how permissions aren't scalable or how they don't work stem from the way we think about permissions as if the default UX for them should be that they're handed to the user like a EULA to sign. ---- I'm still bitter over the fact that Chrome blocks webaudio behind a user action and literally breaks the website audio if you accidentally set it up when that permission isn't granted yet, and then disables all of those protections whenever you navigate pages within a domain. It's ridiculous; what should have happened is that by default, tabs in Chrome should just be muted globally, and audio code should just continue to work normally so that a massive number of web games don't just immediately break, and the user can untick the mute button and turn on sound for the very, very few websites where most users want sound. I'm bitter that they made all these justifications about how blocking the audio was important because it would save mobile data, and actually what happens is all of these sites just mute the audio by default, stream the video on mobile data anyway, and then unmute the video as soon as the user clicks anywhere. It's a bunch of bad justifications for a UX that makes it easier for websites to abuse users. We could have had more user-friendly behavior and not broken the entire web, but Chrome wanted to try out some weird statistical model for blocking/allowing audio playback instead of adding a button. The "spamming requests for things the user doesn't care about" problem is a lot easier to deal with if you invert "permissions" into something the user requests and not the site.
makeitdouble 4y ago
Can’t she revoke it from the notification screen when she sees a spammy one ? Sure it’s still better to never subscribe to unwanted notifications, but removing them isn’t much of a hassle in the current system IMO
- ocdtrekkie 4y ago
  Nobody who doesn't work in the industry knows how to do this. Browser site permissions are basically the absolutely most incomprehensible UI ever to ordinary users. It's why implementing these features without an app install is user hostile.
- spondyl 4y ago
  My parents are in the same boat. Revoking it assumes the user even has a mental model of what a notification is. That is: Something that you can opt out of or even necessarily that they gave permission in the first place. I suppose it's viewed a bit like receiving junk mail or advertisements on TV. That might seem absurd on the face of it like of course it's your device but not everyone is necessarily aware that they even have any agency (or are interested in learning yet more "computer nonsense") I'm being a bit over the top here but I consider it much the same problem as how you might use a car without understanding any of how it works. In the same way, plenty of people own mobile phones without any understanding of cause and effect. I'm pretty sure my parents don't even "see" permission prompts, they just sort of have this "thing" in the way of the "screen" and tap at it to go away rather than y'know, some sort of two way consent dialogue.
  - danShumway 4y ago
    > My parents are in the same boat. Revoking it assumes the user even has a mental model of what a notification is. That is: Something that you can opt out of or even necessarily that they gave permission in the first place. My feeling is that if a user doesn't know how to disable a permission, then they were not giving informed consent about enabling the permission. Being able to turn on a permission is an imperfect but ultimately better indicator that they likely know what the permission is (it's not completely bullet-proof, but it's better). Clicking "yes" just means that they clicked "yes", it doesn't mean anything more than that.
postalrat 4y ago
Are all the notifications from native apps fine? Or just the web notifications that are bad?
- runarberg 4y ago
  Good question. I think the main difference is that it is so much easier to visit an annoying website then to download an annoying app. And your GP mentions how a good compromise is to grant this access only to websites you install to your home screen (which I think is a comparable action to downloading an app).
- faizmokhtar 4y ago
  Last I checked, the push notifications that are masquerading as native popup asking user to install “antivirus” are all on web.
- sneak 4y ago
  I regularly get spam notifications from major/famous iOS apps. It's always an instant uninstall for me. IIRC this used to be against Apple App Store rules but I guess they got relaxed for spamming existing customers. Fastest way to lose me as a customer, TBH, is to disrespect my fiercely-guarded attention span with prompts to spend money while I'm busy being focused on making it.
  - latexr 4y ago
    > IIRC this used to be against Apple App Store rules It was. > but I guess they got relaxed for spamming existing customers. Apple themselves have sent notifications of that kind. The rule has since been dropped, I doubt it was ever enforced.

by hbn 4y ago

maicro 4y ago

FYI, you can disable the ability for Chromium-based browsers to even ask the user if they want to allow notifications - on my Android phone in Chrome, it's under Settings, Site settings. There you can set "Notifications" to "Blocked" (and if you're paranoid like me, turn most others off as well).

starik36 4y ago
I doubt his grandma would find this option.
- maicro 4y ago
  Absolutely fair, but that's why I set that on all browsers I configure for family, and recently had to walk my sister through on her phone when she accidentally allowed notifications from some website that started spamming her with various scam attempts.
zakki 4y ago
I don’t know if they’ll accept this solution. The other camp just want: “It works automatically like magic”. I just want to point out that we have to be familiar with the tools we used.
babypuncher 4y ago
You can do this in Firefox as well. However, nagging the shit out of users should not be the default behavior. They knew that this feature would get abused by every sleazy webmaster on the planet as soon as it was supported in popular browsers. The feature should have been properly designed in the first place. Now I'm content with letting it die. I appreciate Apple's willingness to more or less ignore open standards that hurt the user experience more than they benefit it.
brigandish 4y ago
I wonder, does setting this stop one from getting or subscribing to notifications on sites where they're wanted?
- maicro 4y ago
  As I understand it (I never want notifications so don't have any experience with it), it's only blocking new sites from asking to send notifications. So if you find a site you want notifications from, you can change that back to "Ask" temporarily, allow for that site, and then change back to "Block" for all sites by default. Note that that behavior might be different on mobile vs. desktop browsers, but again, I don't really know how to test, sorry.

solarkraft 4y ago

The request mechanism is so broken. There shouldn't be a pop-up at all. The website should declare a notification source and you should be able to subscribe to it if you feel like it. Somewhere in the overflow menu. The website shouldn't even get the option to natively bother you about it.

ocdtrekkie 4y ago
That's the right way to do it, but then the Chromium team that implemented it doesn't get good numbers to use for their promo packets. And there's no understanding among a lot of web standards people that popups for site permissions are widely used by malicious actors. Apple consulted the community and thought about security, and that's why this implementation is refreshingly better.
- account42 4y ago
  If it was just Chrome that made these user-hostile decisions then I wouln't care that much, but for some reason Mozilla decides to copy most of them.
  - ocdtrekkie 4y ago
    Eh, in most cases it is just Chrome. WebUSB, Web Serial, a dozen others, Chrome has implemented despite both Mozilla and Apple saying they won't because the risk of malicious use is too high. I would argue (and have argued before), if placed behind a well-understood consent concept like "installing" the PWA, it would be safer to implement these sorts of APIs.
- danShumway 4y ago
  It's not just Web Push, most permissions should be user-prompted, not site-prompted. If the user doesn't know how to enable those permissions, then they also very likely don't know how to disable them either, which is a problem. If they don't know those permissions exist, they also probably don't know what the implications are of turning them on. Giving them a bunch of yes/no dialogs to click through doesn't change anything about the obligation to educate users about their device permissions, and if they are educated properly then they can set those permissions themselves. Google (and browser manufactures in general) kind of taught people that the way we do permissions is that apps ask for them and the user says yes/no, and the app responds. It's not entirely only their fault, but it's the wrong way to think about it in my opinion. I'm not even sure I like the word "permissions". Most permissions should be better thought of as "capabilities" and they should be something granted by the user, not requested by the app, and the app shouldn't be able to tell the difference between a phone/platform that doesn't support those capabilities at all and a phone/platform where the user has denied those capabilities. A lot of issues about how permissions aren't scalable or how they don't work stem from the way we think about permissions as if the default UX for them should be that they're handed to the user like a EULA to sign. ---- I'm still bitter over the fact that Chrome blocks webaudio behind a user action and literally breaks the website audio if you accidentally set it up when that permission isn't granted yet, and then disables all of those protections whenever you navigate pages within a domain. It's ridiculous; what should have happened is that by default, tabs in Chrome should just be muted globally, and audio code should just continue to work normally so that a massive number of web games don't just immediately break, and the user can untick the mute button and turn on sound for the very, very few websites where most users want sound. I'm bitter that they made all these justifications about how blocking the audio was important because it would save mobile data, and actually what happens is all of these sites just mute the audio by default, stream the video on mobile data anyway, and then unmute the video as soon as the user clicks anywhere. It's a bunch of bad justifications for a UX that makes it easier for websites to abuse users. We could have had more user-friendly behavior and not broken the entire web, but Chrome wanted to try out some weird statistical model for blocking/allowing audio playback instead of adding a button. The "spamming requests for things the user doesn't care about" problem is a lot easier to deal with if you invert "permissions" into something the user requests and not the site.

makeitdouble 4y ago

Can’t she revoke it from the notification screen when she sees a spammy one ? Sure it’s still better to never subscribe to unwanted notifications, but removing them isn’t much of a hassle in the current system IMO

ocdtrekkie 4y ago
Nobody who doesn't work in the industry knows how to do this. Browser site permissions are basically the absolutely most incomprehensible UI ever to ordinary users. It's why implementing these features without an app install is user hostile.
spondyl 4y ago
My parents are in the same boat. Revoking it assumes the user even has a mental model of what a notification is. That is: Something that you can opt out of or even necessarily that they gave permission in the first place. I suppose it's viewed a bit like receiving junk mail or advertisements on TV. That might seem absurd on the face of it like of course it's your device but not everyone is necessarily aware that they even have any agency (or are interested in learning yet more "computer nonsense") I'm being a bit over the top here but I consider it much the same problem as how you might use a car without understanding any of how it works. In the same way, plenty of people own mobile phones without any understanding of cause and effect. I'm pretty sure my parents don't even "see" permission prompts, they just sort of have this "thing" in the way of the "screen" and tap at it to go away rather than y'know, some sort of two way consent dialogue.
- danShumway 4y ago
  > My parents are in the same boat. Revoking it assumes the user even has a mental model of what a notification is. That is: Something that you can opt out of or even necessarily that they gave permission in the first place. My feeling is that if a user doesn't know how to disable a permission, then they were not giving informed consent about enabling the permission. Being able to turn on a permission is an imperfect but ultimately better indicator that they likely know what the permission is (it's not completely bullet-proof, but it's better). Clicking "yes" just means that they clicked "yes", it doesn't mean anything more than that.

postalrat 4y ago

Are all the notifications from native apps fine? Or just the web notifications that are bad?

runarberg 4y ago
Good question. I think the main difference is that it is so much easier to visit an annoying website then to download an annoying app. And your GP mentions how a good compromise is to grant this access only to websites you install to your home screen (which I think is a comparable action to downloading an app).
faizmokhtar 4y ago
Last I checked, the push notifications that are masquerading as native popup asking user to install “antivirus” are all on web.
sneak 4y ago
I regularly get spam notifications from major/famous iOS apps. It's always an instant uninstall for me. IIRC this used to be against Apple App Store rules but I guess they got relaxed for spamming existing customers. Fastest way to lose me as a customer, TBH, is to disrespect my fiercely-guarded attention span with prompts to spend money while I'm busy being focused on making it.
- latexr 4y ago
  > IIRC this used to be against Apple App Store rules It was. > but I guess they got relaxed for spamming existing customers. Apple themselves have sent notifications of that kind. The rule has since been dropped, I doubt it was ever enforced.