Online tracking: A 1-million-site measurement and analysis • Hacker News Board

Re: Online tracking: A 1-million-site measurement and analysis

#231

Post by cm3 » Thu, May 19, 2016, 8:13 PM UTC

dredmorbius wrote: post #228

kbenson wrote: post #226

Earlier quoted context omitted.

As I see it, the web is the most vibrant medium of expression and innovation we have today. While I don't doubt there would be gains in security to limiting it in many aspects, I question whether the specific level of security gain would be worth the loss of innovation and expression. I think there are many areas we could focus on instead that would increase security without the same level of negative consequences, s…

As cm3 notes, usability is as much if not more a concern than privacy and security . Though I'd not dislodge any of these three from a position of high primacy. There's a risk / frequency trade off with all of these. Privacy can be quite possibly costly or fatal, though slightly more rare. Not so rare though that 20% of all Web users in a US Department of Commerce survey (see my recent comments history) report known…

I have this hope that Servo will lend itself to modularity and building a usable web client with it.

Re: Online tracking: A 1-million-site measurement and analysis

#232

Post by dredmorbius » Thu, May 19, 2016, 8:18 PM UTC

cm3 wrote: post #231

dredmorbius wrote: post #228

Earlier quoted context omitted.

As cm3 notes, usability is as much if not more a concern than privacy and security . Though I'd not dislodge any of these three from a position of high primacy. There's a risk / frequency trade off with all of these. Privacy can be quite possibly costly or fatal, though slightly more rare. Not so rare though that 20% of all Web users in a US Department of Commerce survey (see my recent comments history) report known…

I have this hope that Servo will lend itself to modularity and building a usable web client with it.

What's Servo?

Re: Online tracking: A 1-million-site measurement and analysis

#233

Post by shostack » Thu, May 19, 2016, 8:20 PM UTC

Zooper wrote: post #170

ultramancool wrote: post #115

As soon as I saw these APIs being added I immediately dropped into about:config and disabled them. How the hell do these people think this is a good idea to do without asking any permissions? Put these in your user prefs.js file on Firefox: user_pref("dom.battery.enabled", false); user_pref("device.sensors.enabled", false); user_pref("dom.vibrator.enabled", false); user_pref("dom.enable_performance", false); user_pre…

Thank you, user, for making your fingerprint hash more unique by disabling certain default features, given your user-agent string, thus opting into cat-facts.

Disabling them probably makes you significantly more unique than those that don't just because the vast majority of people never will disable them.

Re: Online tracking: A 1-million-site measurement and analysis

#234

Post by kbenson » Thu, May 19, 2016, 8:29 PM UTC

dredmorbius wrote: post #232

cm3 wrote: post #231

Earlier quoted context omitted.

I have this hope that Servo will lend itself to modularity and building a usable web client with it.

What's Servo?

Mozilla's replacement to the Gecko engine that run's Firefox, written in rust. Often covered here[1], the benchmarks look really promising. Small portions of the codebase are already trickling back to FF where applicable.

The complexity and size of a modern web browser and the need to better engineering tools to combat this are often touted as some of the reasoning the Rust project started.

1: https://hn.algolia.com/?query=servo&sort=byPopularity&prefix...

Re: Online tracking: A 1-million-site measurement and analysis

#235

Post by kbenson » Thu, May 19, 2016, 8:42 PM UTC

cm3 wrote: post #227

kbenson wrote: post #226

Earlier quoted context omitted.

As I see it, the web is the most vibrant medium of expression and innovation we have today. While I don't doubt there would be gains in security to limiting it in many aspects, I question whether the specific level of security gain would be worth the loss of innovation and expression. I think there are many areas we could focus on instead that would increase security without the same level of negative consequences, s…

It's not just security, the other half is usability. The way popular web sites work is that they change stuff around regularly only to make it look different but change the behavior as well. This breaks stuff like existing functionality, key+mouse sequences to get stuff done, places you've learned to look at and navigate to quickly. Computers and modern appliances (including cars) are strangely affected by this const…

Consider the implications of what this means though. If sites are not free to innovate, things like Github and Gmail wouldn't exist. They only reason we aren't stuck with a Hotmail interface circa 2002 is because people were able to innovate on the web. To lock down CSS (or Javascript, there's no reason I can think of you would lock CSS and not Javascript) to a specific set of capabilities is both a statement that it is sufficient for all needs, and that we can decide by committee what is a good set of standards to lock into. I think both assertions are laughable false.

If we had locked down CSS five years ago, what CSS would be not be capable of using today? If we lock it down today, what would we be missing out on that would come five years from now?

Design by committee is horribly inefficient, and rarely takes into consideration the full needs of the users. What's more, it can't take into consideration future needs. Design by committee gets us XML. Adoption by iteration and evolution gets us JSON. XML has its place, but JSON is overwhelmingly more popular in certain contexts for a reason, it fits the domain better.

Lastly, iterating on Github and Gmail would not stop even if there was a complete lack of CSS and Javascript, it would just be more tedious as everything was done through a full page serve, just like the old days. That wouldn't prevent site redesigns along with missing or broken features, it would just make everything look shittier, perform slower, and use more server side resources.

That said, a sane standard for embedded interfaces, where choice is restricted, it needs to live a long time, and needs to have sane accessibility features would do well with better standards. I view that as a separate problem.

Re: Online tracking: A 1-million-site measurement and analysis

#236

Post by kbenson » Thu, May 19, 2016, 8:54 PM UTC

dredmorbius wrote: post #228

kbenson wrote: post #226

Earlier quoted context omitted.

As I see it, the web is the most vibrant medium of expression and innovation we have today. While I don't doubt there would be gains in security to limiting it in many aspects, I question whether the specific level of security gain would be worth the loss of innovation and expression. I think there are many areas we could focus on instead that would increase security without the same level of negative consequences, s…

As cm3 notes, usability is as much if not more a concern than privacy and security . Though I'd not dislodge any of these three from a position of high primacy. There's a risk / frequency trade off with all of these. Privacy can be quite possibly costly or fatal, though slightly more rare. Not so rare though that 20% of all Web users in a US Department of Commerce survey (see my recent comments history) report known…

> My most common response when landing on a website is to sigh, roll my eyes, and dump it to something more readable. Firefox's Reader Mode. Pocket. Straight ASCII text. w3m.

> My half-serious response to this is to create a new web browser embodying these and a few other principles.

In all seriousness, I wonder if spoofing a mobile client (easily done through most browser developer console's or an extension) might immediately result in a more useful experience for you on the majority of sites. Given the viewing constraints of most mobile platforms, and the focus on mobile accessibility (it's supposed to account for over 50% of traffic now), I imagine many sites try to but some minimum level of effort in to at least make it usable.

Re: Online tracking: A 1-million-site measurement and analysis

#237

Post by cm3 » Thu, May 19, 2016, 8:54 PM UTC

kbenson wrote: post #235

cm3 wrote: post #227

Earlier quoted context omitted.

It's not just security, the other half is usability. The way popular web sites work is that they change stuff around regularly only to make it look different but change the behavior as well. This breaks stuff like existing functionality, key+mouse sequences to get stuff done, places you've learned to look at and navigate to quickly. Computers and modern appliances (including cars) are strangely affected by this const…

Consider the implications of what this means though. If sites are not free to innovate, things like Github and Gmail wouldn't exist . They only reason we aren't stuck with a Hotmail interface circa 2002 is because people were able to innovate on the web. To lock down CSS (or Javascript, there's no reason I can think of you would lock CSS and not Javascript) to a specific set of capabilities is both a statement that i…

But that's not what I'm suggesting.

We can begin by actually reviving browser user style sheets and having a well known and respected sets of names will allow for appropriate styling on the client.

Re: Online tracking: A 1-million-site measurement and analysis

#238

Post by carlesfe » Thu, May 19, 2016, 9:00 PM UTC

rdancer wrote: post #203

carlesfe wrote: post #164

Earlier quoted context omitted.

What do you mean with "The stupidity is 100% with the web devs and customers"? The law requires user consent, in form of a click on a banner or scrolling the page, before setting any cookie.

Which law? The 2002/58/EC doesn't.

Not that one.

http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:320...

Complete law: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...

Paragraph 66 talks about cookies.

A later exception was made by the EU for session cookies.

Guidelines for webmasters:

http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...

It has a sample banner which is similar to those which most users display.

Spanish official directives (with further protection because of a local law called LSSI): https://www.agpd.es/portalwebAGPD/canaldocumentacion/publica..., page 17. Also comes with a sample banner

Did you really think that everyone else was wrong or didn't read the law and is programming these banners as some sort of fad?

Re: Online tracking: A 1-million-site measurement and analysis

#239

Post by dredmorbius » Thu, May 19, 2016, 9:02 PM UTC

kbenson wrote: post #235

cm3 wrote: post #227

Earlier quoted context omitted.

It's not just security, the other half is usability. The way popular web sites work is that they change stuff around regularly only to make it look different but change the behavior as well. This breaks stuff like existing functionality, key+mouse sequences to get stuff done, places you've learned to look at and navigate to quickly. Computers and modern appliances (including cars) are strangely affected by this const…

Consider the implications of what this means though. If sites are not free to innovate, things like Github and Gmail wouldn't exist . They only reason we aren't stuck with a Hotmail interface circa 2002 is because people were able to innovate on the web. To lock down CSS (or Javascript, there's no reason I can think of you would lock CSS and not Javascript) to a specific set of capabilities is both a statement that i…

The fact of standard templates needn't prevent the possibility of novel templates. But it ought make the prospect slightly more user-controllable. Design-by-committee isn't the alternative to design-by-fuckwits, the present mode.

Github and Gmail are both tools which now face the dilemma of gratuitous changes -- many of the recent innovations haven't done much for usability, for numerous reasons (familiarity itself is a key factor, GUI offers limited capacity for improved functionality, jwz has commented on this from his Mozilla experiences).

But most changes to default styles are pants.

Hell, much the problem is that default styles are pants. If browsers had a set of presentation styles that did work well (see the "readability" modes offered by Safari, Firefox, Readability, Pocket, Instapaper, etc.), then we'd have slightly less a problem.

Github, Gmail, Google Maps, etc., are largely the exception to long-form informational content pages. I'm OK with an explicit "app mode" for such sites. But 99.999999% of what I read would do vastly better with uniform presentation.

More attention to content and semantic construction. Less to layout frippery.

Something tells me you'll not be convinced.

Re: Online tracking: A 1-million-site measurement and analysis

#240

Post by metasean » Thu, May 19, 2016, 9:11 PM UTC

dceddia wrote: post #70

metasean wrote: post #30

Earlier quoted context omitted.

> Web apps are definitely getting better, ... but they have a long way to go before they can replace dedicated clients entirely. And yet, just yesterday there was a great discussion on Virtual Desktop Infrastructures, where entire operating systems are accessed and operated virtually through just the browser [0]. The current top comment indicates that while there are some setup hoops to jump through to use a specific…

That doesn't sound too far from Desktop Computing as a Service. It will be a sad day when I have to pay $9/month to be able to log into my desktop.

I mostly agree.

Ideally I'd like to have a minimal OS and file set on my local machine (for offline and poor connectivity scenarios), that automatically syncs with my own, encrypted cloud system, such that I can (at my own discretion) update the OS from controlled sources (e.g. git). But I don't think there is enough interest from others for such a system, and I'm occupied with enough other projects that I won't be able to set up such a system.