3 ms·

Things like this seem niche enough to safely put behind a permission dialog. 99.9% of sites/web apps have no legitimate need for this functionality.

shuckles 3y ago
Permissions dialogs solve for a problem product creators have and create more problems for users.
ninkendo 3y ago
That’s how location services and notifications work today, and all it means is that websites just constantly nag me to enable them. Things like this make for a more annoying web all around, because now it’s just one more tool sites can use to track me and increase engagement. (Edit: sibling poster chuckles said it way better than I can.) If I had my way, JavaScript on the web would be limited to XMLHttpRequest and basic DOM manipulation and couldn’t do anything else. A totally separate “rich” JavaScript engine could be opted into by the user for any website that presents itself as an “application” like ones that legitimately want audio API’s like these. All these half-baked web app “standards” that google is forcing down our throats can be confined to that leper colony. Then the most important bit: browsers could let me completely disable the “rich” engine, and I can go back to having a sane web experience again.
- latexr 3y ago
  > That’s how location services and notifications work today, and all it means is that websites just constantly nag me to enable them. It also means you can tell the browser to outright deny every request, thus avoiding even getting prompted. If a website detects the request was denied and still prompts you any other way, that’s an undeniable signal to close the tab and never return.
  - ninkendo 3y ago
    Right, I think the fact that these features exist at all means sites are gonna ask for them… even if your browser denies it, the site can easily pop up a dialog saying “hey you should give us notification access!”. The result is that the web just keeps getting incrementally worse and worse. It’s all good intentions in creating these API’s but the result is that everything just gets more terrible.
- jwells89 3y ago
  I’m kinda surprised that no fork of Firefox has added both global and domain-scoped toggles for web feature support. I know there’s flags in about:config but that only covers some things and isn’t very user friendly. That’d let users turn support for all the fancy bits off by default and enable them in the tiny handful of cases that they’re actually desired. This way as far as sites are concerned your browser simply doesn’t support those features and thus can’t nag you.
  - burnerthrow008 3y ago
    It’s not as extensive as you’re asking for, but check out the Firefox extension uMatrix.
mindslight 3y ago
When a surveillance company (in this case Google) is leading the push, security against surveillance isn't on their list of requirements. In fact it's more of an anti-requirement, which escapes human judgement via design by committee or other anti-scrutiny technique. So then we end up with yet another insecure API that we've got to suffer for years as the browser makers who actually care about security painstakingly figure out how to mitigate the vulnerabilities in the original standard. And I'm all for focusing on technical security, but it's worth mentioning that the biggest most concentrated win would be making commercial digital surveillance illegal (ie the path the GDPR tries to head in). Imagine if large public companies had to make their revenue by honest means instead of working as advanced persistent threats.

shuckles 3y ago

Permissions dialogs solve for a problem product creators have and create more problems for users.

ninkendo 3y ago

That’s how location services and notifications work today, and all it means is that websites just constantly nag me to enable them. Things like this make for a more annoying web all around, because now it’s just one more tool sites can use to track me and increase engagement. (Edit: sibling poster chuckles said it way better than I can.) If I had my way, JavaScript on the web would be limited to XMLHttpRequest and basic DOM manipulation and couldn’t do anything else. A totally separate “rich” JavaScript engine could be opted into by the user for any website that presents itself as an “application” like ones that legitimately want audio API’s like these. All these half-baked web app “standards” that google is forcing down our throats can be confined to that leper colony. Then the most important bit: browsers could let me completely disable the “rich” engine, and I can go back to having a sane web experience again.

latexr 3y ago
> That’s how location services and notifications work today, and all it means is that websites just constantly nag me to enable them. It also means you can tell the browser to outright deny every request, thus avoiding even getting prompted. If a website detects the request was denied and still prompts you any other way, that’s an undeniable signal to close the tab and never return.
- ninkendo 3y ago
  Right, I think the fact that these features exist at all means sites are gonna ask for them… even if your browser denies it, the site can easily pop up a dialog saying “hey you should give us notification access!”. The result is that the web just keeps getting incrementally worse and worse. It’s all good intentions in creating these API’s but the result is that everything just gets more terrible.
jwells89 3y ago
I’m kinda surprised that no fork of Firefox has added both global and domain-scoped toggles for web feature support. I know there’s flags in about:config but that only covers some things and isn’t very user friendly. That’d let users turn support for all the fancy bits off by default and enable them in the tiny handful of cases that they’re actually desired. This way as far as sites are concerned your browser simply doesn’t support those features and thus can’t nag you.
- burnerthrow008 3y ago
  It’s not as extensive as you’re asking for, but check out the Firefox extension uMatrix.

mindslight 3y ago

When a surveillance company (in this case Google) is leading the push, security against surveillance isn't on their list of requirements. In fact it's more of an anti-requirement, which escapes human judgement via design by committee or other anti-scrutiny technique. So then we end up with yet another insecure API that we've got to suffer for years as the browser makers who actually care about security painstakingly figure out how to mitigate the vulnerabilities in the original standard. And I'm all for focusing on technical security, but it's worth mentioning that the biggest most concentrated win would be making commercial digital surveillance illegal (ie the path the GDPR tries to head in). Imagine if large public companies had to make their revenue by honest means instead of working as advanced persistent threats.