3 ms·

"gngr by default disables cookies, Javascripts, referrers, third-party frames and has a minimalistic UA string: "gngr.info/major-version"." So they want to dis

"gngr by default disables cookies, Javascripts, referrers, third-party frames and has a minimalistic UA string: "gngr.info/major-version"." So they want to disable by default every website online? I'm all for innovation but why not just invent a completely new browser that is a better runtime for apps if you're going to disable every website anyway?. Heck, pick a more easily optimizable language than javascript as the default scripting language, have built in GPG so we can throw away passwords, force HTTPS everywhere, use a non-centralized dns like namecoin - why not just go all the way here?

pmoriarty 12y ago
HN itself is perfectly readable without cookies or Javascript. Even if you want to login, vote, comment, and post, all of that can be done without Javascript (though you do need to at least temporarily enable cookies). I am really grateful to HN for making this design choice. Javascript is superflous for 99.9% of websites. It's an unfortunate design choice to use it anyway. I wish I could say that I hope website creators would move away from Javascript and other "dynamic" (ie. turing-complete, overpowered) technologies. But it's clear that's not going to happen. In light of that, privacy and security tools will have to adapt and somehow find a way to protect their user's privacy and security despite having Javascript enabled. Right now, the best hope I see for something like that is having light-weight disposable VMs/jails/containers and sandboxes. At least that could limit the damage that Javascript does to a single tab or session.
- abroncs 12y ago
  > Javascript is superflous for 99.9% of websites. For web sites, yes. For web applications though (of which there are more every day), it's definitely not.
  - smt88 12y ago
    "Superfluous" is not the same as "not necessary in practice" in this case. There are many websites that use JavaScript for polyfills, browser detection, screen detection, and scroll detection. In some cases there are alternatives, but that doesn't mean those alternatives are ubiquitous.
- nbrogi 12y ago
  Are you guys kidding!? JavaScript is not useless at all. None of you use Gmail..? Any other web app of any kind? Facebook..? I read their page and honestly I don't see who would want to be unable to use 90% of the web to have privacy.
hrjet 12y ago
> Heck, pick a more easily optimizable language than javascript as the default scripting language, have built in GPG so we can throw away passwords, force HTTPS everywhere, use a non-centralized dns like namecoin - why not just go all the way here? We actually do want to implement some of those ideas (and other similar ones)! But we don't believe it is necessary to ditch the existing standards for that. There can be a transitionary period and this (or any other browser) could be a test-bed for new ideas.
a1369209993 12y ago
> "gngr.info/major-version" That ... is not minimalistic. Speaking as a person whose browser sends `User-Agent: browser` and `Referer: https://news.ycombinator.com/` https://news.ycombinator.com/` (that is, dynamically the root of the requested site). I have never seen anything break because of user-agent, and only a few things because of referer (and more than a few things break when I do send correct referers). I do agree with the going all the way part though; web browsers seem to view security as a afterthought to be bolted on after the fact.
typedweb 12y ago
Why not just use lynx/links/w3m?

pmoriarty 12y ago

HN itself is perfectly readable without cookies or Javascript. Even if you want to login, vote, comment, and post, all of that can be done without Javascript (though you do need to at least temporarily enable cookies). I am really grateful to HN for making this design choice. Javascript is superflous for 99.9% of websites. It's an unfortunate design choice to use it anyway. I wish I could say that I hope website creators would move away from Javascript and other "dynamic" (ie. turing-complete, overpowered) technologies. But it's clear that's not going to happen. In light of that, privacy and security tools will have to adapt and somehow find a way to protect their user's privacy and security despite having Javascript enabled. Right now, the best hope I see for something like that is having light-weight disposable VMs/jails/containers and sandboxes. At least that could limit the damage that Javascript does to a single tab or session.

abroncs 12y ago
> Javascript is superflous for 99.9% of websites. For web sites, yes. For web applications though (of which there are more every day), it's definitely not.
- smt88 12y ago
  "Superfluous" is not the same as "not necessary in practice" in this case. There are many websites that use JavaScript for polyfills, browser detection, screen detection, and scroll detection. In some cases there are alternatives, but that doesn't mean those alternatives are ubiquitous.
nbrogi 12y ago
Are you guys kidding!? JavaScript is not useless at all. None of you use Gmail..? Any other web app of any kind? Facebook..? I read their page and honestly I don't see who would want to be unable to use 90% of the web to have privacy.

hrjet 12y ago

> Heck, pick a more easily optimizable language than javascript as the default scripting language, have built in GPG so we can throw away passwords, force HTTPS everywhere, use a non-centralized dns like namecoin - why not just go all the way here? We actually do want to implement some of those ideas (and other similar ones)! But we don't believe it is necessary to ditch the existing standards for that. There can be a transitionary period and this (or any other browser) could be a test-bed for new ideas.

a1369209993 12y ago

> "gngr.info/major-version" That ... is not minimalistic. Speaking as a person whose browser sends `User-Agent: browser` and `Referer: https://news.ycombinator.com/` https://news.ycombinator.com/` (that is, dynamically the root of the requested site). I have never seen anything break because of user-agent, and only a few things because of referer (and more than a few things break when I do send correct referers). I do agree with the going all the way part though; web browsers seem to view security as a afterthought to be bolted on after the fact.

typedweb 12y ago

Why not just use lynx/links/w3m?