6 ms·

> According to Qurium, TacoLoco is a traffic monetization network that uses deceptive tactics to trick Internet users into enabling "push notifications," a cros

> According to Qurium, TacoLoco is a traffic monetization network that uses deceptive tactics to trick Internet users into enabling "push notifications," a cross-platform browser standard that allows websites to show pop-up messages which appear outside of the browser. An elderly relative of mine was hit by this a couple years back: his computer's desktop was constantly being spammed with messages on startup, and there was no simple way to turn them all off. It turned out that they were all notifications from web workers that he'd inadvertently allowed at some point prior. (I set his browser to auto-deny notifications so it wouldn't happen again.)

creeble 1y ago
Elderly neighbor for me. Quite insipid; it took me a few minutes to realize that they were browser-based when I first got to the computer.
KevinGlass 1y ago
I honestly think desktop notifications in their current form are one of the worst features of the modern web. Sure it's nice to get an email alert but on my experience there's probably a thousand confused old people getting spammed for each person that intentionally enabled it. What's worse is they look like native OS alerts (on Windows) so when one says "SECURYIRT ALERT!! CALL NOW" it's that much more effective at getting people on the phone with scammers.
- cortesoft 1y ago
  So many sites ask for permission to send notifications that have zero reason to do so. Why would I want push notifications from a shopping or news site?
  - tim-- 1y ago
    Honestly, push notifications from a news site arguably is one of the few sites that I see having a reason to send push notifications. Communication platforms; messaging apps (Slack, Discord etc); email sites (gmail and co.) also make sense. Financial platforms (banks, Stripe etc) Once you start getting out of these two categories, then yeah, it gets silly. No way should an airline website even be allowed to ask to send push notifications. Google does have a way for Chrome users to not show the notification window (https://yespo.io/blog/google-chrome-will-now-block-abusive-browser-notifications https://yespo.io/blog/google-chrome-will-now-block-abusive-b...) by default (https://support.google.com/webtools/answer/9799829?hl=en https://support.google.com/webtools/answer/9799829?hl=en) but I really wish that this was flipped, so that Google would first need to approve sites to use notifications, similar to the Public Suffix List.
    - vanviegen 1y ago
      > No way should an airline website even be allowed to ask to send push notifications. Your flight is delayed/now boarding/etc?
      - dmonitor 1y ago
        I'm rarely at a computer in the airport without my phone
        graemep 1y ago
        I would prefer to know about a delayed flight before I get to the airport. Your phone needs a web browser or an app. An app for every airline you ever use? You already have a web browser. They could SMS but its more expensive to send, often even more so for customers on roaming to receive. Nothing else is universal. I think there are much better possible solutions. An open notification standard or reasonable pricing of bulk sending SMS would do it.
        codingminds 1y ago
        We still have eMail in place. If they don't want to spend money on an SMS they can send an eMail. If browser notification permissions would have a TTL, I'd might considering it. But until this happens I won't allow anyone to send me browser notifications. And even then I'd be very picky.
        mr_mitm 1y ago
        Emails have essentially become notifications anyway. All my emails are things like "your booking has been confirmed", "your package has been shipped", "your invoice is ready for download", "a login from a new device happened", "your flight is delayed", etc.
        PaulHoule 1y ago
        Emails have a mature ecosystem. We've been getting spam and scam emails since 1994, we have tools for dealing with it.
  - ryukoposting 1y ago
    I wonder how many people's browsers get push notifications from Temu, or Amazon.
  - jeroenhd 1y ago
    Same reason you subscribe to their newsletters. To get discounts. I don't understand why people would want that, but neither do I understand the people who actually enter their email address in those "subscribe to my newsletter" popovers.
- codedokode 1y ago
  Instead of desktop notifications web apps should use pinned tabs and show a badge in the tab header.
  - layer8 1y ago
    That’s more a browser implementation issue though. Browser could offer that as a choice for how to handle notifications, on a per-website basis.
- zamadatix 1y ago
  I feel like the web would be a better place if "allow notifications" popups were only allowed for PWAs the user already installed. I.e. they have to manually interact with the page and then click the prompt acknowledging they want to install the site as an application on their computer before the site can start popping up windows from the browser asking for notification permissions. It's not that there are 0 use cases where it could possibly be convenient to get notifications from a plain site but, like you said with the email example, 95% of the legitimate use cases are probably better modeled as an app anyways.
  - PaulHoule 1y ago
    What's "progressive" about installing software? It's always saddened me that people failed to understand the web platform, and never more so than today when that platform could be on the verge of extinction. Young people don't remember this: in the 1990s if a big corporation wanted to make a 1-line change to an application deployed to a fleet of desktops they'd have to update every single machine and to do so they'd probably have to hire at least 1 FTE and probably more for installer engineering and other makework. With the web it is often git pull on the server and you're done! As it is I can find web sites with search, links from other sites, bookmarks and history. If you "install" applications you just clutter up your desktop with 300 icons for applications you don't really use which makes it hard to find the 2-3 that you really use.
    - zamadatix 1y ago
      It's progressive because you're progressing the permissions and features the website can access beyond those of a normal page. It has nothing to do with progressing the web to 90s style app installation and the update mechanism is nothing like that either, it functions as a locally cached webpage not as something you need an SCCM push to load a new binary or something. PWAs do not have to be accessed through desktop icons either - just launch them through the browser's interface as you seem to prefer. If you've ever seen a machine with a default Chrome install then it had about a half dozen PWAs installed without any such desktop shortcuts. The best uses I've gotten out of PWAs are on my Linux machine where there either isn't a native app or I wouldn't trust installing one from the manufacturer if there was. At the same time I don't want random websites to have access to the permissions these apps would need so I load the PWA version of the website and now I've got the ideal island of something served as a website but with the elevated permissions it needs.
_Algernon_ 1y ago
One of the first settings I change in any new browser is to forbid notification requests from all pages, and disable dom.beforeUnload (stops websites being able to prompt to confirm if I want to close the tab). Those functionalities are probably the most abused browser functionalities and definitely shouldn't be enabled by default (or if so only for a whitelist of sites).
- privatelypublic 1y ago
  How do you do this? I'm looking to do it for the clipboard API. Browsers should be able to block copy and paste.
  - AugustoCAS 1y ago
    A quick google shows this for FF (taken from a thread in StackOverflow): > In Firefox you can completely disable beforeunload events by setting dom.disable_beforeunload to true in about:config. Extensions may be needed for other browsers. A word of caution: I'm not 100% sure, but I wonder if some web collaboration tools might use this to ensure data has been synced with a server.
    - LadyCailin 1y ago
      It surely has a lot of legitimate uses, even if it is primarily abused. I’ve used it before to do various cleanup tasks, to have a more timely “user disconnected” event, rather than waiting on some timeout to occur server side. Having said that, it should never be the end of the world to disable, sites should never have data loss due to this event missing, because if so, they already have a data loss problem when for instance the power goes out.
      - dizhn 1y ago
        I am not sure if this is implemented using this functionality but when I am on a console session on proxmox and hit ctrl+w due to muscle memory, it's nice to have a warning telling me the tab will be closed. Same with all kinds of remote access tools. One legit use case I can think of.
mapt 1y ago
The entire idea of push notifications on browsers was obviously toxic from the start, especially the privileged status "Do you want to enable notifications?" popups had. I think the idea comes from the 2010's hype about Phone-Ifying The Desktop. Someone clearly thought they were recreating the Google Reader / RSS ecosystem (Mozilla had RSS in the browser in a flop)... but everyone else was just enthusiastic about dark patterns that were viable in mobile apps that didn't exist in a desktop browser.
- hsbauauvhabzb 1y ago
  IMO random websites prompting to access your location data is far more problematic
  - riddlemethat 1y ago
    DocuSign tracks your location when you sign a document unless you disable it in the browser. Learned that a few years ago.
  - mtillman 1y ago
    The biggest problem there is that several browsers don't want to remember your response of "No" for more than one day. They want you to be constantly tracked. I'd like to be able to tell all browsers, never track my location or send me a notification from any website but that's not what they want. Orion by Kagi is a breath of fresh air in this department.
- radlad 1y ago
  I think notifications came about as part of Progressive Web Apps (PWA).
- jeroenhd 1y ago
  I use this feature all the time and I love it. Not having to install dozens of apps just to see the occasional notification is a dream come true. The way it's trivial for browsers to fake OS notifications on some platforms is a clear design flaw, though. I get the need for it (PWAs and such) but unless the website sending a notification is a PWA, there's no need for a notification to be that ambiguous. The current system, where Chrome (the only browser that matters) collects information about websites and only shows the permission popup on some websites has mostly killed useful notification support for a lot of websites.
QuantumGood 1y ago
I have run into this. My notes: Google Chrome (Desktop & Android) chrome://settings/content/notifications Or Settings > Privacy and security > Site settings > Notifications Under "Default behavior," select: Don’t allow sites to send notifications. ------------------ Mozilla Firefox (Desktop) Settings > Privacy & Security Scroll to the "Permissions" section, find "Notifications," and click "Settings…" At the bottom, check: Block new requests asking to allow notifications. ------------------ Microsoft Edge Settings > Cookies and site permissions > Notifications Set the default to block all notification requests. ------------------ Safari (macOS) Safari > Settings (or Preferences) > Websites tab > Notifications Untick: Allow websites to ask for permission to send notifications ------------------ Samsung Internet (Android) Settings > Notifications > Allow or block sites
PaulHoule 1y ago
Advocacy for "progressive web apps" always fell flat to me. There are a few reasons, such as web workers being a Rube Goldberg machine when people just wanted the kind of facility to control caches and fetching that Netscape Netcaster had in 1997. It was predictable to me that the usage breakdown of push notification was going to be 50% spam 49% scams 1% other and now people are just catching up to the obvious.

creeble 1y ago

Elderly neighbor for me. Quite insipid; it took me a few minutes to realize that they were browser-based when I first got to the computer.

KevinGlass 1y ago

I honestly think desktop notifications in their current form are one of the worst features of the modern web. Sure it's nice to get an email alert but on my experience there's probably a thousand confused old people getting spammed for each person that intentionally enabled it. What's worse is they look like native OS alerts (on Windows) so when one says "SECURYIRT ALERT!! CALL NOW" it's that much more effective at getting people on the phone with scammers.

cortesoft 1y ago
So many sites ask for permission to send notifications that have zero reason to do so. Why would I want push notifications from a shopping or news site?
- tim-- 1y ago
  Honestly, push notifications from a news site arguably is one of the few sites that I see having a reason to send push notifications. Communication platforms; messaging apps (Slack, Discord etc); email sites (gmail and co.) also make sense. Financial platforms (banks, Stripe etc) Once you start getting out of these two categories, then yeah, it gets silly. No way should an airline website even be allowed to ask to send push notifications. Google does have a way for Chrome users to not show the notification window (https://yespo.io/blog/google-chrome-will-now-block-abusive-browser-notifications https://yespo.io/blog/google-chrome-will-now-block-abusive-b...) by default (https://support.google.com/webtools/answer/9799829?hl=en https://support.google.com/webtools/answer/9799829?hl=en) but I really wish that this was flipped, so that Google would first need to approve sites to use notifications, similar to the Public Suffix List.
  - vanviegen 1y ago
    > No way should an airline website even be allowed to ask to send push notifications. Your flight is delayed/now boarding/etc?
    - dmonitor 1y ago
      I'm rarely at a computer in the airport without my phone
      - graemep 1y ago
        I would prefer to know about a delayed flight before I get to the airport. Your phone needs a web browser or an app. An app for every airline you ever use? You already have a web browser. They could SMS but its more expensive to send, often even more so for customers on roaming to receive. Nothing else is universal. I think there are much better possible solutions. An open notification standard or reasonable pricing of bulk sending SMS would do it.
        codingminds 1y ago
        We still have eMail in place. If they don't want to spend money on an SMS they can send an eMail. If browser notification permissions would have a TTL, I'd might considering it. But until this happens I won't allow anyone to send me browser notifications. And even then I'd be very picky.
        mr_mitm 1y ago
        Emails have essentially become notifications anyway. All my emails are things like "your booking has been confirmed", "your package has been shipped", "your invoice is ready for download", "a login from a new device happened", "your flight is delayed", etc.
        PaulHoule 1y ago
        Emails have a mature ecosystem. We've been getting spam and scam emails since 1994, we have tools for dealing with it.
- ryukoposting 1y ago
  I wonder how many people's browsers get push notifications from Temu, or Amazon.
- jeroenhd 1y ago
  Same reason you subscribe to their newsletters. To get discounts. I don't understand why people would want that, but neither do I understand the people who actually enter their email address in those "subscribe to my newsletter" popovers.
codedokode 1y ago
Instead of desktop notifications web apps should use pinned tabs and show a badge in the tab header.
- layer8 1y ago
  That’s more a browser implementation issue though. Browser could offer that as a choice for how to handle notifications, on a per-website basis.
zamadatix 1y ago
I feel like the web would be a better place if "allow notifications" popups were only allowed for PWAs the user already installed. I.e. they have to manually interact with the page and then click the prompt acknowledging they want to install the site as an application on their computer before the site can start popping up windows from the browser asking for notification permissions. It's not that there are 0 use cases where it could possibly be convenient to get notifications from a plain site but, like you said with the email example, 95% of the legitimate use cases are probably better modeled as an app anyways.
- PaulHoule 1y ago
  What's "progressive" about installing software? It's always saddened me that people failed to understand the web platform, and never more so than today when that platform could be on the verge of extinction. Young people don't remember this: in the 1990s if a big corporation wanted to make a 1-line change to an application deployed to a fleet of desktops they'd have to update every single machine and to do so they'd probably have to hire at least 1 FTE and probably more for installer engineering and other makework. With the web it is often git pull on the server and you're done! As it is I can find web sites with search, links from other sites, bookmarks and history. If you "install" applications you just clutter up your desktop with 300 icons for applications you don't really use which makes it hard to find the 2-3 that you really use.
  - zamadatix 1y ago
    It's progressive because you're progressing the permissions and features the website can access beyond those of a normal page. It has nothing to do with progressing the web to 90s style app installation and the update mechanism is nothing like that either, it functions as a locally cached webpage not as something you need an SCCM push to load a new binary or something. PWAs do not have to be accessed through desktop icons either - just launch them through the browser's interface as you seem to prefer. If you've ever seen a machine with a default Chrome install then it had about a half dozen PWAs installed without any such desktop shortcuts. The best uses I've gotten out of PWAs are on my Linux machine where there either isn't a native app or I wouldn't trust installing one from the manufacturer if there was. At the same time I don't want random websites to have access to the permissions these apps would need so I load the PWA version of the website and now I've got the ideal island of something served as a website but with the elevated permissions it needs.

_Algernon_ 1y ago

One of the first settings I change in any new browser is to forbid notification requests from all pages, and disable dom.beforeUnload (stops websites being able to prompt to confirm if I want to close the tab). Those functionalities are probably the most abused browser functionalities and definitely shouldn't be enabled by default (or if so only for a whitelist of sites).

privatelypublic 1y ago
How do you do this? I'm looking to do it for the clipboard API. Browsers should be able to block copy and paste.
- AugustoCAS 1y ago
  A quick google shows this for FF (taken from a thread in StackOverflow): > In Firefox you can completely disable beforeunload events by setting dom.disable_beforeunload to true in about:config. Extensions may be needed for other browsers. A word of caution: I'm not 100% sure, but I wonder if some web collaboration tools might use this to ensure data has been synced with a server.
  - LadyCailin 1y ago
    It surely has a lot of legitimate uses, even if it is primarily abused. I’ve used it before to do various cleanup tasks, to have a more timely “user disconnected” event, rather than waiting on some timeout to occur server side. Having said that, it should never be the end of the world to disable, sites should never have data loss due to this event missing, because if so, they already have a data loss problem when for instance the power goes out.
    - dizhn 1y ago
      I am not sure if this is implemented using this functionality but when I am on a console session on proxmox and hit ctrl+w due to muscle memory, it's nice to have a warning telling me the tab will be closed. Same with all kinds of remote access tools. One legit use case I can think of.

mapt 1y ago

The entire idea of push notifications on browsers was obviously toxic from the start, especially the privileged status "Do you want to enable notifications?" popups had. I think the idea comes from the 2010's hype about Phone-Ifying The Desktop. Someone clearly thought they were recreating the Google Reader / RSS ecosystem (Mozilla had RSS in the browser in a flop)... but everyone else was just enthusiastic about dark patterns that were viable in mobile apps that didn't exist in a desktop browser.

hsbauauvhabzb 1y ago
IMO random websites prompting to access your location data is far more problematic
- riddlemethat 1y ago
  DocuSign tracks your location when you sign a document unless you disable it in the browser. Learned that a few years ago.
- mtillman 1y ago
  The biggest problem there is that several browsers don't want to remember your response of "No" for more than one day. They want you to be constantly tracked. I'd like to be able to tell all browsers, never track my location or send me a notification from any website but that's not what they want. Orion by Kagi is a breath of fresh air in this department.
radlad 1y ago
I think notifications came about as part of Progressive Web Apps (PWA).
jeroenhd 1y ago
I use this feature all the time and I love it. Not having to install dozens of apps just to see the occasional notification is a dream come true. The way it's trivial for browsers to fake OS notifications on some platforms is a clear design flaw, though. I get the need for it (PWAs and such) but unless the website sending a notification is a PWA, there's no need for a notification to be that ambiguous. The current system, where Chrome (the only browser that matters) collects information about websites and only shows the permission popup on some websites has mostly killed useful notification support for a lot of websites.

QuantumGood 1y ago

I have run into this. My notes: Google Chrome (Desktop & Android) chrome://settings/content/notifications Or Settings > Privacy and security > Site settings > Notifications Under "Default behavior," select: Don’t allow sites to send notifications. ------------------ Mozilla Firefox (Desktop) Settings > Privacy & Security Scroll to the "Permissions" section, find "Notifications," and click "Settings…" At the bottom, check: Block new requests asking to allow notifications. ------------------ Microsoft Edge Settings > Cookies and site permissions > Notifications Set the default to block all notification requests. ------------------ Safari (macOS) Safari > Settings (or Preferences) > Websites tab > Notifications Untick: Allow websites to ask for permission to send notifications ------------------ Samsung Internet (Android) Settings > Notifications > Allow or block sites

PaulHoule 1y ago

Advocacy for "progressive web apps" always fell flat to me. There are a few reasons, such as web workers being a Rube Goldberg machine when people just wanted the kind of facility to control caches and fetching that Netscape Netcaster had in 1997. It was predictable to me that the usage breakdown of push notification was going to be 50% spam 49% scams 1% other and now people are just catching up to the obvious.