3 ms·

It seems the decision was made in the name of security: https://hsivonen.fi/no-encoding-menu/ https://hsivonen.fi/no-encoding-menu/ > Supporting the specific

It seems the decision was made in the name of security: https://hsivonen.fi/no-encoding-menu/ https://hsivonen.fi/no-encoding-menu/ > Supporting the specific manually-selectable encodings caused significant complexity in the HTML parser when trying to support the feature securely (i.e. not allowing certain encodings to be overridden). With the current approach, the parser needs to know of one flag to force chardetng, which the parser has to be able to run in other situations anyway, to run. > Elaborate UI surface for a niche feature risks the whole feature getting removed > Telemetry [...] suggested that users aren’t that good at choosing correctly manually. In other words, it's trying to protect users from themselves by dumbing down the browser. (Never mind that people who know what they are doing have probably also turned off telemetry...)

thaumasiotes 2y ago
Wow. That writeup is insane. >> Supporting the specific manually-selectable encodings caused significant complexity in the HTML parser when trying to support the feature securely (i.e. not allowing certain encodings to be overridden). There's no explanation of why you'd want this, or why it's security-relevant. (Farther down, there's a mention of self-XSS, which definitely isn't relevant.) >> Elaborate UI surface for a niche feature risks the whole feature getting removed They've already removed the whole feature. That was easier to do after they mostly disabled it, not harder. >> Telemetry showed users making a selection from the menu when the encoding of the page being overridden had come from a previous selection from the menu. That would be an example of "working as expected". The removal of the ability to do this is the problem that disabling the encoding menu causes! Under the old, correct approach, you'd guess what the encoding was until you got it right. Under the new approach, the browser guesses for you, and if the first guess is wrong, screw you.

thaumasiotes 2y ago

Wow. That writeup is insane. >> Supporting the specific manually-selectable encodings caused significant complexity in the HTML parser when trying to support the feature securely (i.e. not allowing certain encodings to be overridden). There's no explanation of why you'd want this, or why it's security-relevant. (Farther down, there's a mention of self-XSS, which definitely isn't relevant.) >> Elaborate UI surface for a niche feature risks the whole feature getting removed They've already removed the whole feature. That was easier to do after they mostly disabled it, not harder. >> Telemetry showed users making a selection from the menu when the encoding of the page being overridden had come from a previous selection from the menu. That would be an example of "working as expected". The removal of the ability to do this is the problem that disabling the encoding menu causes! Under the old, correct approach, you'd guess what the encoding was until you got it right. Under the new approach, the browser guesses for you, and if the first guess is wrong, screw you.