5 ms·

It's super feasible if you own the API default.

lxgr 2y ago
It's definitely a quick way to get all your users to switch to a different browser or figure out how to disable updates forever.
- throwaway894345 2y ago
  I mean, if all major browsers do it roughly once then users will complain to the few broken websites. They won’t even think to blame the browser if every other site works fine and the broken site is broken on all browsers.
  - lxgr 2y ago
    Good luck trying to get Google or Microsoft to throw their paying enterprise users under the bus in the interest of slightly safer sandboxing defaults.
    - throwaway894345 2y ago
      I wasn’t suggesting it would happen, only that the “users would stop updating their browsers” scenario seemed unlikely.
- connicpu 2y ago
  One spot where safari is in an advantageous position to force a new default, as long as they roll it out on iOS first.
dfedbeef 2y ago
You just announce you are making a change and then turn it on later.
- schrodinger 2y ago
  After building enterprise APIs for a few years, you’d be amazed at how hard it is to get companies to make even minor changes; backwards compatibility is key. Often it’s because they _can’t_ make the change themselves since they outsourced the code to a consulting agency. So they’d have to sign a new contract and get an agency to make the change. They just won’t, and you’ll have a browser that people stop using.
  - bee_rider 2y ago
    It is probably outside the scope of what one company can do (although Apple is quite large…). But we need to fix our understanding of backwards compatibility. If a computer system provides the ability to keep doing something, but the way it provides that capability requires it to be insecure, then the system should not really be thought of as “backward compatible.” Because reasonably prudent people can’t actually keep doing the thing they were doing before. Of source, modern computers on the modern web don’t really provide the ability to do much at all in a reasonably prudent fashion, so it is all a bit moot I guess.
- lxgr 2y ago
  Announce what to whom? To the hundreds of millions of users out there that don't even know what a browser is, let alone why it's now talking to them about something called a "site isolation framework"?
  - plufz 2y ago
    I would guess you would use a deprecation message in the console? Like they have done over cookie changes, etc. A normal user would obviously not check the console, but the devs or admins of the site sure might.
    - lxgr 2y ago
      That's assuming there's still a dev around that has knowledge of, or even access to, the source code of a given webapp depending on the legacy functionality.

lxgr 2y ago

It's definitely a quick way to get all your users to switch to a different browser or figure out how to disable updates forever.

throwaway894345 2y ago
I mean, if all major browsers do it roughly once then users will complain to the few broken websites. They won’t even think to blame the browser if every other site works fine and the broken site is broken on all browsers.
- lxgr 2y ago
  Good luck trying to get Google or Microsoft to throw their paying enterprise users under the bus in the interest of slightly safer sandboxing defaults.
  - throwaway894345 2y ago
    I wasn’t suggesting it would happen, only that the “users would stop updating their browsers” scenario seemed unlikely.
connicpu 2y ago
One spot where safari is in an advantageous position to force a new default, as long as they roll it out on iOS first.

dfedbeef 2y ago

You just announce you are making a change and then turn it on later.

schrodinger 2y ago
After building enterprise APIs for a few years, you’d be amazed at how hard it is to get companies to make even minor changes; backwards compatibility is key. Often it’s because they _can’t_ make the change themselves since they outsourced the code to a consulting agency. So they’d have to sign a new contract and get an agency to make the change. They just won’t, and you’ll have a browser that people stop using.
- bee_rider 2y ago
  It is probably outside the scope of what one company can do (although Apple is quite large…). But we need to fix our understanding of backwards compatibility. If a computer system provides the ability to keep doing something, but the way it provides that capability requires it to be insecure, then the system should not really be thought of as “backward compatible.” Because reasonably prudent people can’t actually keep doing the thing they were doing before. Of source, modern computers on the modern web don’t really provide the ability to do much at all in a reasonably prudent fashion, so it is all a bit moot I guess.
lxgr 2y ago
Announce what to whom? To the hundreds of millions of users out there that don't even know what a browser is, let alone why it's now talking to them about something called a "site isolation framework"?
- plufz 2y ago
  I would guess you would use a deprecation message in the console? Like they have done over cookie changes, etc. A normal user would obviously not check the console, but the devs or admins of the site sure might.
  - lxgr 2y ago
    That's assuming there's still a dev around that has knowledge of, or even access to, the source code of a given webapp depending on the legacy functionality.