5 ms·

Why not a choice? Individuals could choose a "secure" browser or browser mode that provides increased protection from such attacks or a "compatible" one that i

Why not a choice? Individuals could choose a "secure" browser or browser mode that provides increased protection from such attacks or a "compatible" one that is less likely to break old websites.

jahewson 2y ago
That’s not a real choice though. All it takes is one website that is essential to me not supporting the secure mode and I’m forced to opt-out. The upstream website is making the choice for me.
kergonath 2y ago
> Individuals could choose a "secure" browser or browser mode that provides increased protection from such attacks or a "compatible" one that is less likely to break old websites. And then we get thousands of posts whining about Safari being broken because it is "not like Chrome" and developers moaning that their unsafe pet API is not supported. Web developers are never going to play ball.
- amatecha 2y ago
  idunno, as a professional web dev since 1998, I don't understand why Google, Apple and Mozilla are trying so hard to make the web browser like a complete OS (I technically understand why, I just think it's ridiculous). The amount of obscure APIs being added just boosts the surface area for vulnerabilities and makes low-resource web browsing nearly impossible. You either get "a web browser that works" or "a web browser that can load almost nothing", and basically nothing in between. I had to stop using Firefox on my old ThinkPad because after opening a few windows, it churns the CPU so hard it's not usable for a solid minute+. Let that finish up, and I have to wait again if I dare to open another page. i5-3220m, 8gb of RAM (where the OS uses like 200mb of RAM)... there's no excuse for this to not be able to browse the web. Some fun examples of "your browser is an OS on top of your OS": The Screen Wake Lock API provides a way to prevent devices from dimming or locking the screen when an application needs to keep running. https://developer.mozilla.org/en-US/docs/Web/API/Screen_Wake_Lock_API https://developer.mozilla.org/en-US/docs/Web/API/Screen_Wake... The Web Serial API provides a way for websites to read from and write to serial devices. https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_... The Window Management API allows you to get detailed information on the displays connected to your device and more easily place windows on specific screens, paving the way towards more effective multi-screen applications. https://developer.mozilla.org/en-US/docs/Web/API/Window_Management_API https://developer.mozilla.org/en-US/docs/Web/API/Window_Mana... The Compute Pressure API is a JavaScript API that enables you to observe the pressure of system resources such as the CPU. https://developer.mozilla.org/en-US/docs/Web/API/Compute_Pressure_API https://developer.mozilla.org/en-US/docs/Web/API/Compute_Pre... (my thesis is, not all web developers want this stuff, and usually when I talk to people in the industry they agree, it's excessive)
  - lxgr 2y ago
    Well, for better or worse, the web is an application platform these days. I consider it pretty great, since the alternative is installing native apps for things I'm using exactly once or very rarely. There's a case to be made though that maybe these things should only be available to PWAs, which is what Apple is already doing for some functionality on iOS, including push notifications.
    - fennecbutt 2y ago
      What? I thought Apple was trying to quietly kill pwas, probably bc they don't go thru their app store. And also bc if you make a good enough sandbox then you don't need to pay for "all the wooork we put in"
      - lxgr 2y ago
        They certainly don’t have a lot of love for them as a first-class app development environment, but they are also their fig leaf of “open access” to the platform. Regardless of that, I do like the idea of PWAs getting access to a higher tier of web APIs, especially those increasing the attack surface, as “installing an app” makes even non-sophisticated users do more of a double take than “visiting a website” in terms of access to their system.
      - indymike 2y ago
        iOS just really improved support for pwas sometime in the last part of last years. It's much better.
  - Khaine 2y ago
    I agree with you, particularly when 90% of sites people visit are to read, watch, or engage with content.
  - ChadNauseam 2y ago
    Every web developer is fine with 10% of the feature set, it’s just a different 10% for each dev. I am regularly annoyed by the inconsistent browser support for Web MIDI, something 99% of web devs probably don’t care about at all. It would be easier to sandbox if there were fewer features of course, but in practice we rarely see exploits even in complicated low-level APIs like webgpu (which must be a nightmare to make secure given how many buggy drivers and different devices it has to support). So it seems like in practice we are able to sandbox these APIs securely, and having them provides an incredible benefit to users who are able to securely and easily run applications (how else do you recommend people do this on desktop platforms?).
kelnos 2y ago
Users don't want to make these kinds of choices, and generally there's no good way to educate them enough to figure out what they actually want.
ameliaquining 2y ago
People are downvoting you, but Apple does actually offer this: https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120 I think they've gotten away with it because it's a pretty obscure setting and they say a bunch of things like "most users should not enable this, and if you do enable it you should expect things to break".

Why not a choice? Individuals could choose a "secure" browser or browser mode that provides increased protection from such attacks or a "compatible" one that is less likely to break old websites.

jahewson 2y ago

That’s not a real choice though. All it takes is one website that is essential to me not supporting the secure mode and I’m forced to opt-out. The upstream website is making the choice for me.

kergonath 2y ago

> Individuals could choose a "secure" browser or browser mode that provides increased protection from such attacks or a "compatible" one that is less likely to break old websites. And then we get thousands of posts whining about Safari being broken because it is "not like Chrome" and developers moaning that their unsafe pet API is not supported. Web developers are never going to play ball.

amatecha 2y ago
idunno, as a professional web dev since 1998, I don't understand why Google, Apple and Mozilla are trying so hard to make the web browser like a complete OS (I technically understand why, I just think it's ridiculous). The amount of obscure APIs being added just boosts the surface area for vulnerabilities and makes low-resource web browsing nearly impossible. You either get "a web browser that works" or "a web browser that can load almost nothing", and basically nothing in between. I had to stop using Firefox on my old ThinkPad because after opening a few windows, it churns the CPU so hard it's not usable for a solid minute+. Let that finish up, and I have to wait again if I dare to open another page. i5-3220m, 8gb of RAM (where the OS uses like 200mb of RAM)... there's no excuse for this to not be able to browse the web. Some fun examples of "your browser is an OS on top of your OS": The Screen Wake Lock API provides a way to prevent devices from dimming or locking the screen when an application needs to keep running. https://developer.mozilla.org/en-US/docs/Web/API/Screen_Wake_Lock_API https://developer.mozilla.org/en-US/docs/Web/API/Screen_Wake... The Web Serial API provides a way for websites to read from and write to serial devices. https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Serial_... The Window Management API allows you to get detailed information on the displays connected to your device and more easily place windows on specific screens, paving the way towards more effective multi-screen applications. https://developer.mozilla.org/en-US/docs/Web/API/Window_Management_API https://developer.mozilla.org/en-US/docs/Web/API/Window_Mana... The Compute Pressure API is a JavaScript API that enables you to observe the pressure of system resources such as the CPU. https://developer.mozilla.org/en-US/docs/Web/API/Compute_Pressure_API https://developer.mozilla.org/en-US/docs/Web/API/Compute_Pre... (my thesis is, not all web developers want this stuff, and usually when I talk to people in the industry they agree, it's excessive)
- lxgr 2y ago
  Well, for better or worse, the web is an application platform these days. I consider it pretty great, since the alternative is installing native apps for things I'm using exactly once or very rarely. There's a case to be made though that maybe these things should only be available to PWAs, which is what Apple is already doing for some functionality on iOS, including push notifications.
  - fennecbutt 2y ago
    What? I thought Apple was trying to quietly kill pwas, probably bc they don't go thru their app store. And also bc if you make a good enough sandbox then you don't need to pay for "all the wooork we put in"
    - lxgr 2y ago
      They certainly don’t have a lot of love for them as a first-class app development environment, but they are also their fig leaf of “open access” to the platform. Regardless of that, I do like the idea of PWAs getting access to a higher tier of web APIs, especially those increasing the attack surface, as “installing an app” makes even non-sophisticated users do more of a double take than “visiting a website” in terms of access to their system.
    - indymike 2y ago
      iOS just really improved support for pwas sometime in the last part of last years. It's much better.
- Khaine 2y ago
  I agree with you, particularly when 90% of sites people visit are to read, watch, or engage with content.
- ChadNauseam 2y ago
  Every web developer is fine with 10% of the feature set, it’s just a different 10% for each dev. I am regularly annoyed by the inconsistent browser support for Web MIDI, something 99% of web devs probably don’t care about at all. It would be easier to sandbox if there were fewer features of course, but in practice we rarely see exploits even in complicated low-level APIs like webgpu (which must be a nightmare to make secure given how many buggy drivers and different devices it has to support). So it seems like in practice we are able to sandbox these APIs securely, and having them provides an incredible benefit to users who are able to securely and easily run applications (how else do you recommend people do this on desktop platforms?).

kelnos 2y ago

Users don't want to make these kinds of choices, and generally there's no good way to educate them enough to figure out what they actually want.

ameliaquining 2y ago

People are downvoting you, but Apple does actually offer this: https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120 I think they've gotten away with it because it's a pretty obscure setting and they say a bunch of things like "most users should not enable this, and if you do enable it you should expect things to break".