4 ms·

A part of the issue is IMO that browsers have become ridiculously bloated everything-programs. You could take about 90% of that out and into dedicated tools and

A part of the issue is IMO that browsers have become ridiculously bloated everything-programs. You could take about 90% of that out and into dedicated tools and end up with something vastly saner and safer and not a lot less capable for all practical purposes. Instead, we collectively are OK with frosting this atrocious layer cake that is today's web with multiple flavors of security measures of sometimes questionable utility. End of random rant.

sefrost 1y ago
You are right from a technical point, I think, but in reality - how would one begin to make that change?
lukan 1y ago
"You could take about 90% of that out and into dedicated tools " But then you would loose plattform independency, the main selling point of this atrocity. Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. The best thing to happen, that I can see, is that a sane subset crystalizes, that people start to use dominantly, with the rest becoming legacy, only maintained to have it still working. But I do dream of a fresh rewrite of the web since university (and the web was way slimmer back then), but I got a bit more pragmatic and I think I understood now the massive problem of solving trusted human communication better. It ain't easy in the real world.
- gmueckl 1y ago
  But do we need e.g serial port or raw USB access straight from a random website? Even WebRTC is a bit of a stretch. There is a lot of cruft in modern browsers that does little except increase attack surface. This all just drives a need to come up with ever more tacked-on protection schemes because browsers have big targets painted on them.
  - shadowgovt 1y ago
    How else am I going to make a game in the browser that be controlled with a controller?
    - gmueckl 1y ago
      Every decent host OS already has a dedicated driver stack to provide game controller input to applications in a useful manner. Why the heck would you ship a reimplementation of that in JS in a website?
      - shadowgovt 1y ago
        So that you can take input from countrollers that haven't been invented yet and won't fit the HID model.
        gmueckl 1y ago
        If it hasn't been invented yet, you don't need driver software for it, do you? ;) Anyway, in your scenario the controller would be essentially a one off and you'd be better off writing a native app to interface with it for the one computer this experiment will run on.
        account42 1y ago
        If it hasn't been invented yet we don't know the implications of giving a website access to it either. And that's before realizing it's already a bad idea with existing devices because they were never designed for giving untrusted actors direct access.
        shadowgovt 1y ago
        That's why we have a privacy and security sandbox in browsers.
    - account42 1y ago
      You don't, that's the point: not everything needs to be crammed into a browser.
- smaudet 1y ago
  > Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. I think the giant major downside, is that they've written a rootkit that runs on everything, and to try to make up for that they want to make it so only sites they allow can run. It's not really very powerful at all if nobody can use it, at that point you are better off just not bothering with it at all. The Internet may remain, but the Web may really be dead.
  - lukan 1y ago
    "It's not really very powerful at all if nobody can use it" But people do use it, like the both of us right now? People also use maps, do online banking, play games, start complex interactive learning environments, collaborate in real time on documents etc. All of that works right now.
  - sofixa 1y ago
    > to try to make up for that they want to make it so only sites they allow can run What do you mean, you can run whatever you want on localhost, and it's quite easy to host whatever you want for whoever you want too. Maybe the biggest modern added barrier to entry is that having TLS is strongly encouraged/even needed for some things, but this is an easily solved problem.
    - lkjdsklf 1y ago
      The blog post and several anecdotes in the comments prove otherwise
- ngold 1y ago
  Not sure if it counts but I've been enjoying librewolf. I believe just a stripped down firefox.
nemothekid 1y ago
>A part of the issue is IMO that browsers have become ridiculously bloated everything-programs. I don't see how that solves the issue that PSL tries to fix. I was a script kiddy hosting neopets phishing pages on free cpanel servers from <random>.ripway.com back in 2007. Browsers were way less capable then.
- lukan 1y ago
  PSL and the way cookies work is just part of the mess. A new approach could solve that in a different way, taking into account all the experience we had with scriptkiddies and professional scammers and pishers since then. But I also don't really have an idea where and how to start.
  - shadowgovt 1y ago
    And of course, if the new solution completely invalidates old sites, it just won't get picked up. People prefer slightly broken but accessible to better designed but inaccessible.
    - motorest 1y ago
      > People prefer slightly broken but accessible to better designed but inaccessible. It's not even broken as the edge cases are addressed by ad-hoc solutions. OP is complaining about global infrastructure not having a pristine design. At best it's a complain over a desirable trait. It's hardly a reason to pull the Jr developer card and mindlessly advocate for throwing everything out and starting over.
    - friendzis 1y ago
      > People prefer slightly broken but accessible to better designed but inaccessible. We live in world where whatever faang adopts is de facto a standard. Accessible these days means google/gmail/facebook/instagram/tiktok works. Everything else is usually forced to follow along. People will adopt whatever gives them access to their daily dose of doomscrolling and then complain about rather crucial part of their lives like online banking not working. > And of course, if the new solution completely invalidates old sites, it just won't get picked up. Old sites don't matter, only high-traffic sites riddled with dark patterns matter. That's the reality, even if it is harsh.
Kim_Bruning 1y ago
Are you saying we should make a <Unix Equivalent Of A Browser?> A large set of really simple tools that each do one thing really really really pedantically well? This might be what's needed to break out of the current local optimum.
- gmueckl 1y ago
  I haven't thought of it that way, but that might be a solution.
  - magackame 1y ago
    There was an attempt in that direction. https://www.uzbl.org/ https://www.uzbl.org/
- acka 1y ago
  Maybe it's time to revive something like the uzbl[1] project, or start something similar. [1] https://www.uzbl.org/ https://www.uzbl.org/

sefrost 1y ago

You are right from a technical point, I think, but in reality - how would one begin to make that change?

lukan 1y ago

"You could take about 90% of that out and into dedicated tools " But then you would loose plattform independency, the main selling point of this atrocity. Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. The best thing to happen, that I can see, is that a sane subset crystalizes, that people start to use dominantly, with the rest becoming legacy, only maintained to have it still working. But I do dream of a fresh rewrite of the web since university (and the web was way slimmer back then), but I got a bit more pragmatic and I think I understood now the massive problem of solving trusted human communication better. It ain't easy in the real world.

gmueckl 1y ago
But do we need e.g serial port or raw USB access straight from a random website? Even WebRTC is a bit of a stretch. There is a lot of cruft in modern browsers that does little except increase attack surface. This all just drives a need to come up with ever more tacked-on protection schemes because browsers have big targets painted on them.
- shadowgovt 1y ago
  How else am I going to make a game in the browser that be controlled with a controller?
  - gmueckl 1y ago
    Every decent host OS already has a dedicated driver stack to provide game controller input to applications in a useful manner. Why the heck would you ship a reimplementation of that in JS in a website?
    - shadowgovt 1y ago
      So that you can take input from countrollers that haven't been invented yet and won't fit the HID model.
      - gmueckl 1y ago
        If it hasn't been invented yet, you don't need driver software for it, do you? ;) Anyway, in your scenario the controller would be essentially a one off and you'd be better off writing a native app to interface with it for the one computer this experiment will run on.
      - account42 1y ago
        If it hasn't been invented yet we don't know the implications of giving a website access to it either. And that's before realizing it's already a bad idea with existing devices because they were never designed for giving untrusted actors direct access.
        shadowgovt 1y ago
        That's why we have a privacy and security sandbox in browsers.
  - account42 1y ago
    You don't, that's the point: not everything needs to be crammed into a browser.
smaudet 1y ago
> Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. I think the giant major downside, is that they've written a rootkit that runs on everything, and to try to make up for that they want to make it so only sites they allow can run. It's not really very powerful at all if nobody can use it, at that point you are better off just not bothering with it at all. The Internet may remain, but the Web may really be dead.
- lukan 1y ago
  "It's not really very powerful at all if nobody can use it" But people do use it, like the both of us right now? People also use maps, do online banking, play games, start complex interactive learning environments, collaborate in real time on documents etc. All of that works right now.
- sofixa 1y ago
  > to try to make up for that they want to make it so only sites they allow can run What do you mean, you can run whatever you want on localhost, and it's quite easy to host whatever you want for whoever you want too. Maybe the biggest modern added barrier to entry is that having TLS is strongly encouraged/even needed for some things, but this is an easily solved problem.
  - lkjdsklf 1y ago
    The blog post and several anecdotes in the comments prove otherwise
ngold 1y ago
Not sure if it counts but I've been enjoying librewolf. I believe just a stripped down firefox.

nemothekid 1y ago

>A part of the issue is IMO that browsers have become ridiculously bloated everything-programs. I don't see how that solves the issue that PSL tries to fix. I was a script kiddy hosting neopets phishing pages on free cpanel servers from <random>.ripway.com back in 2007. Browsers were way less capable then.

lukan 1y ago
PSL and the way cookies work is just part of the mess. A new approach could solve that in a different way, taking into account all the experience we had with scriptkiddies and professional scammers and pishers since then. But I also don't really have an idea where and how to start.
- shadowgovt 1y ago
  And of course, if the new solution completely invalidates old sites, it just won't get picked up. People prefer slightly broken but accessible to better designed but inaccessible.
  - motorest 1y ago
    > People prefer slightly broken but accessible to better designed but inaccessible. It's not even broken as the edge cases are addressed by ad-hoc solutions. OP is complaining about global infrastructure not having a pristine design. At best it's a complain over a desirable trait. It's hardly a reason to pull the Jr developer card and mindlessly advocate for throwing everything out and starting over.
  - friendzis 1y ago
    > People prefer slightly broken but accessible to better designed but inaccessible. We live in world where whatever faang adopts is de facto a standard. Accessible these days means google/gmail/facebook/instagram/tiktok works. Everything else is usually forced to follow along. People will adopt whatever gives them access to their daily dose of doomscrolling and then complain about rather crucial part of their lives like online banking not working. > And of course, if the new solution completely invalidates old sites, it just won't get picked up. Old sites don't matter, only high-traffic sites riddled with dark patterns matter. That's the reality, even if it is harsh.

Kim_Bruning 1y ago

Are you saying we should make a <Unix Equivalent Of A Browser?> A large set of really simple tools that each do one thing really really really pedantically well? This might be what's needed to break out of the current local optimum.

gmueckl 1y ago
I haven't thought of it that way, but that might be a solution.
- magackame 1y ago
  There was an attempt in that direction. https://www.uzbl.org/ https://www.uzbl.org/
acka 1y ago
Maybe it's time to revive something like the uzbl[1] project, or start something similar. [1] https://www.uzbl.org/ https://www.uzbl.org/