3 ms·

I'm torn on whether to see this "AI Kill switch" as a win on respecting the users, or something to keep us distractewd while they ship through "Trusted Types" A

I'm torn on whether to see this "AI Kill switch" as a win on respecting the users, or something to keep us distractewd while they ship through "Trusted Types" API that sounds like further restriction of end-user computing freedoms.

LiamPowell 8mo ago
I would absolutely love to hear your reasoning that leads to type systems being considered a "restriction of end-user computing freedoms". For those that don't know what trusted types are: Simply put, it splits the string type in to unsanitised_string_from_user and safe_escaped_string where unsafe strings can not be used in function parameters that only take a safe string That's heavily simplifying of course, but it's the basic idea.
- TeMPOraL 8mo ago
  Skimming the API docs on MDN, it makes sure the site vendor gets to run filtering code over anything you'd want to inject via e.g. user script or console, securing it with CSP. I expect this to make user scripts work as well as they do on Chrome now. If there's a workaround, I'd love to hear about it.
  - LiamPowell 8mo ago
    Worst case you just run your userscript before any policies are created, but in most cases it's not going to impact userscripts.
  - duskdozer 8mo ago
    Oh just great. The web is bad enough already, I think I'll have to go live in the woods if userscripts get kneecapped
debugnik 8mo ago
Aren't those just overengineered sanitizers?
- TeMPOraL 8mo ago
  Question is, can you sidestep or disable them in user scripts or in developer tools, without disabling CSP entirely or doing something even more invasive (and generally precluding use of that browser instance for browsing)?
  - evilpie 8mo ago
    We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)
    - duskdozer 8mo ago
      Sorry, so you mean something like Violentmonkey scripts would be unaffected?
    - TeMPOraL 8mo ago
      I sincerely thank you for doing that - and for saying it!
lastorset 8mo ago
You may be thinking of the much-hated "Trusted Computing" initiative. "Trusted" here means that the JavaScript dev picks a sanitizing library they trust, not that Mozilla decides what software is trustworthy.
- TeMPOraL 8mo ago
  Nah, my issue isn't with users vs. Mozilla, but users vs. "JavaScript dev", specifically the difference of opinion on who should have final say on what gets executed and what doesn't.

LiamPowell 8mo ago

I would absolutely love to hear your reasoning that leads to type systems being considered a "restriction of end-user computing freedoms". For those that don't know what trusted types are: Simply put, it splits the string type in to unsanitised_string_from_user and safe_escaped_string where unsafe strings can not be used in function parameters that only take a safe string That's heavily simplifying of course, but it's the basic idea.

TeMPOraL 8mo ago
Skimming the API docs on MDN, it makes sure the site vendor gets to run filtering code over anything you'd want to inject via e.g. user script or console, securing it with CSP. I expect this to make user scripts work as well as they do on Chrome now. If there's a workaround, I'd love to hear about it.
- LiamPowell 8mo ago
  Worst case you just run your userscript before any policies are created, but in most cases it's not going to impact userscripts.
- duskdozer 8mo ago
  Oh just great. The web is bad enough already, I think I'll have to go live in the woods if userscripts get kneecapped

debugnik 8mo ago

Aren't those just overengineered sanitizers?

TeMPOraL 8mo ago
Question is, can you sidestep or disable them in user scripts or in developer tools, without disabling CSP entirely or doing something even more invasive (and generally precluding use of that browser instance for browsing)?
- evilpie 8mo ago
  We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)
  - duskdozer 8mo ago
    Sorry, so you mean something like Violentmonkey scripts would be unaffected?
  - TeMPOraL 8mo ago
    I sincerely thank you for doing that - and for saying it!

lastorset 8mo ago

You may be thinking of the much-hated "Trusted Computing" initiative. "Trusted" here means that the JavaScript dev picks a sanitizing library they trust, not that Mozilla decides what software is trustworthy.

TeMPOraL 8mo ago
Nah, my issue isn't with users vs. Mozilla, but users vs. "JavaScript dev", specifically the difference of opinion on who should have final say on what gets executed and what doesn't.