So, the network scan gives me about 40 extra devices in my network. Should I be worried?
Show HN: What every browser knows about you
151–160 of 209 posts
Re: Show HN: What every browser knows about you
#152This inspired me the idea of creating a NoScript label for web sites that don't use javascript. It could be an information passed in the page header as a specification (contract). I have a few web sites without javascript. Is NoScript supported by iOS safari ?
I assume you're talking about the element (as opposed to something to do with the browser extension with a similar name)?
In which case, it is definitely worth making websites as usable as possible without JavaScript. is supported by pretty much all web browsers, including iOS Safari.
Even if your website relies heavily on JavaScript, it is still a good idea to let non-JavaScript users know via a element that JavaScript is required, instead of having the page look like a broken mess (or a blank screen).
Do also keep in mind that search engines (generally) do not run JavaScript, so if you want page content to be indexed, it has to be present on the page as it is rendered without JavaScript. may help achieve that.
Re: Show HN: What every browser knows about you
#153Earlier quoted context omitted.
Simply visiting a YouTube link should result in the video to start streaming right away though? How will you know that a download is desired or not?
tags are a more standardized part of the web. Although I should be able to disable auto-buffering as well as auto-play. Ideally the user can control whether all types of content get loaded—images, CSS, JavaScript, web fonts—or even allow/deny individual domains or files, but so far browsers require an extension like uMatrix for that.
The fact that some browsers do allow you to control these things, even if you have to use an extension because they don't support it themselves, is crucially important and totally acceptable. AFAIK there is nothing equivalent to NoScript for IE, however, so that's just one of many reasons I don't use it.
I don't really mind the trend in browsers over the last several years to give explicit access to more OS resources, it frees us from both Flash and Java Applets, Adobe's PDF reader, and other crap. But I'm not sure the browser replacements, at least in the short term, will actually get the security models any better. Is there any reason to prefer all these new JS APIs over allowing a Java Applet, besides "Java Applets are insecure"? It's certainly not performance -- I know many people chuckle when someone demos the latest X in JS (with or without WebGL) where X was done better with less hardware years ago via an applet. Secure or not, it's incredibly difficult to actually run an applet these days, and it's a strange disconnect with how the browser is fine doing so much else without warning. Will we see a similar increase in difficulty for running JS that can be just as insecure?
I've been a NoScript and adblock advocate for many years, but the first is often met with alien stares and the second is only successful when I install it on their browser myself or when I'm recommending adblocking to either other technical people or people who really hate ads even on TV. There's a weird resistance some people have that can get brought up in both cases, though, and it's probably going to take more than a few big public fails due to malicious websites before people will stop bringing it up. The argument adblocking users have been making for ages: this is my computer, my browser, and neither is under any obligation to act in a particular way based on the contents of what your server sends me. I don't like your ads? I can choose not to see them. I don't trust your JS? I can choose not to execute it. I don't like your theme? I can load my own. It's very weird to me that people oppose this view.
Re: Show HN: What every browser knows about you
#154I see NoScript being recommended but if you're not using Firefox this isn't an option. Lukily both uBlock[1] and uMatrix[2] are cross platform and will work on most (any?) Chromium based browsers as well as Firefox. All instances of uBlock in this post are referring to uBlock Origin[1].
In addition to NoScript both uBlock[1] and uMatrix[2] can be configured to block javascript (you can block both 3rd and 1st party javascript with either). In fact even on Firefox I would recommend trying uMatrix instead of NoScript because of the interface but my opinion is probably biased since I've been using it for some time now. You can keep NoScript enabled in this situation just make sure to whitelist TLD's and allow scripts globally (also remove the built in whitelist while you're at it).
If you want a simpler solution which offers the best bang for your buck then using uBlock in medium mode[3] is what I would recommend. This will block 3rd-party scripts and iframes (globally). Any page breakage that occurs as a result can be very easily handled by setting a noop for scripts and/or iframes for that pages scope. You can also block 1st party scripts if you really want to but it will likely cause a lot more stuff to break. uBlock can also enable browser settings that will prevent WebRTC leakage under certain circumstances.
On a side note if you're using even just uBlock then that will likely remove the need for running additional privacy extensions (save ones that deal with cookies) like Disconnect which also block network requests (you can use the Disconnect lists from within uBlock). uMatrix does give you the control over cookies.
[1] https://github.com/gorhill/uBlock
[2] https://github.com/gorhill/uMatrix
[3] https://github.com/gorhill/uBlock/wiki/Blocking-mode:-medium...
Re: Show HN: What every browser knows about you
#155This inspired me the idea of creating a NoScript label for web sites that don't use javascript. It could be an information passed in the page header as a specification (contract). I have a few web sites without javascript. Is NoScript supported by iOS safari ?
I think you should be able to achieve that already via the Content Security Policy headers: https://developer.mozilla.org/en-US/docs/Web/Security/CSP
CSP is widely supported by now, including iOS webkit: http://caniuse.com/#feat=contentsecuritypolicy
Re: Show HN: What every browser knows about you
#156I guess I'll stick to Opera 12 since it does so much better than firefox.
Re: Show HN: What every browser knows about you
#157Re: Show HN: What every browser knows about you
#158Earlier quoted context omitted.
Yeah, and that's also a great example of what should NOT be allowed without the user's EXPLICIT permission - simply visiting a link should not result in a torrent download!
Simply visiting a YouTube link should result in the video to start streaming right away though? How will you know that a download is desired or not?
> Simply visiting a YouTube link should result in the video to start streaming right away though?
I hate that. Is there a reliable way to turn that behavior off?
Re: Show HN: What every browser knows about you
#159The speedtest http://webkay.robinlinus.com/scripts/speedtest.js downloads a 5mb file from http://www.kenrockwell.com/contax/images/g2/examples/3112003... . You might want to change that to something on a big company CDN to avoid killing kenrockwell.com's server.
Thanks a lot for the feedback! I changed it to https://upload.wikimedia.org/wikipedia/commons/2/2d/Snake_Ri... for now. Can you suggest a better image?
I suppose something that's unlikely to ever 404, and on a CDN that's "fast" for folks everywhere in the world would be best, so upload.wikimedia.org is a good choice.
Re: Show HN: What every browser knows about you
#160Earlier quoted context omitted.
And that's why so many sites break with it.
When the parts that break are leaking user hardware and network information, I'll take the break thanks.
It isn't like there is no legitimate use case for these technologies. It's just that they are accessible without any supervision.