Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

211–220 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#211

For me, I would go with: - Typed javascript should be built-in in browsers. (Typescript) TypeScript is great, but all the configurations and transpiling is a pain.

Why exactly typescript?

Typescript should be compileable into WebAssembly bytecodes and that's it.

If you want it to be transparently compileable, like foo.ts to be sent as WA bytecodes then something like mod-typescript (on the fly typescript compiler) can be designed that will send (compiled and cached) bytecodes.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#212
post #204

Earlier quoted context omitted.

You can kind of do this with incognito mode. It would be a bit frustrating because once you close the tabs everything is lost. However I am not sure how different browsers "incognito mode" handle multiple tabs. I do like your idea though.

Firefox has an experimental (opt-in) feature called "Containers" for this: https://testpilot.firefox.com/experiments/containers You can create a container for each compartmentalized context (work, social media, whatever) and then create tabs assigned to diffent containers. They're visually distinguished as to which tab is "in" which container, but otherwise you can manipulate and mingle them freely with the rest of y…

oh wow that is awesome. I've not used firefox in years but something like that could be reason enough to give it another try.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#213
post #191

First party isolation. Social media buttons and other trackers should not get a global identity for free. Explicit opt-in to store persistent state at all. An exception should be a cryptographic identity that is only revealed when you click a login button. No sound without opt-in. No big data transfers without opt-in. If a site wants to shove 10MB of crap in their article, then they should have to show a page asking…

I like this idea, but because websites have the content, they can simply throw up a button that requests showing your identity to view the content and most people would blindly click it leading to the same situation we have now. The HTTPS push is important and works because the search engines can leverage their importance and the browsers can (effectively) scare people without any user input.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#214
post #204

I'm ignorant of a lot but, segregation of cookies by browser tab. If I log into Xsocialmedia in Tab 1, and go to news site in Tab 2 using Xsocialmedia plugin, it doesn't know that tab A logged in, or that it came from same browser. Basically, I want my tabs to be isolated and treated as completely separate, isolated browsing histories, caches, and cookies. ...This is my gmail tab. All that tab ever sees is gmail. Thi…

You can kind of do this with incognito mode. It would be a bit frustrating because once you close the tabs everything is lost. However I am not sure how different browsers "incognito mode" handle multiple tabs. I do like your idea though.

As a UI dev working in security, I can tell you that other security devs largely don't know what Incognito mode is or how the cookies are sandboxed inside/outside of Incognito mode.

Some think cookies are segregated in each Incognito tab/window. Some don't know that the Incognito cookiejar is reused if you open another Incognito tab/window without first closing all other Incognito windows+tabs.

This applies to LocalStorage as well.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#215

Registration forms should be standardized. I want to have my "real" details, and my "fake" details ready to be entered into websites that want yet another registration. Why does every single website implement their own registration form with exactly the same details?! Why does every single web site re-implement the registration page slightly differently?! Ideally, I'd enter the registration page, the browser would li…

> Why does every single web site re-implement the registration page slightly differently?! Because registration pages are the top of most sites' conversion funnels, and as such they produce metrics that reflect on not just IT teams but also UX/design and marketing. The amount of tinkering and customization in registration pages is a political/organizational problem, not a UI/tech problem. And besides that, no busines…

> And besides that, no business has an incentive to make it easier for you to free-ride their service with fake credentials

Ah, but they do have an incentive to make it easier for you to sign up with legit registration credentials.

If the OS was able to store the common fields that describe a person / account and the browser could prompt the user to inject those, HTML5 would only need a few more supported valid input type attributes and only populate them after the user has opted in.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#218
post #213
post #191

First party isolation. Social media buttons and other trackers should not get a global identity for free. Explicit opt-in to store persistent state at all. An exception should be a cryptographic identity that is only revealed when you click a login button. No sound without opt-in. No big data transfers without opt-in. If a site wants to shove 10MB of crap in their article, then they should have to show a page asking…

I like this idea, but because websites have the content, they can simply throw up a button that requests showing your identity to view the content and most people would blindly click it leading to the same situation we have now. The HTTPS push is important and works because the search engines can leverage their importance and the browsers can (effectively) scare people without any user input.

I should clarify what I mean: if you have a login page (form element of type login, perhaps), you get a real login button with trusted chrome (i.e. you can't restyle it to look like a kitten). If you push it, the website gets your TLS Channel ID or similar. This isn't a global identification -- it just lets the site match you up to the last time you went there. But the browser could give you an alternative that gives you a fresh transient identity.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#219
post #164

Ajax without JavaScript. Ability to send a response from server updating only part of DOM. Basically, react with virtual DOM on the server pushing diffs to user with http2 awesomness. There will be no need for JS on most sites, can be adapted to current frameworks, and with preload/prefetch it might be very fast. * U can prefetch progress bar / loading state for example, and redirect to partial url of a real content

already does something like that, although admittedly in a clunky fashion

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#220
post #75

Hard deprecation of the long tail of Javascript browser capabilities and incompatibilities. So much code and so many libraries are littered with "if (old version browser) do x, else if IE, do y, else, ..."

As far as I recall, IE, since reaching adulthood some few years ago, has identified itself as Mozilla when asked. It's a very pragmatic solution to the problem of a lot of websites having code to check for IE and apply all kinds of hacks to make stuff work anyway. It's also a tacit concession that .. yeah .. our track record wan't too good.

I'm old enough to remember the days when IE was a dominant force and they could pretty much thrash around and invent their own quirks and standards, forcing everyone else to play to their tune. So I find great joy in seeing IE disguising itself as Mozilla in order to not be treated as a rotten egg.

Post reply on HN