Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Spectre and Meltdown Mean for WebKit

webkit.org

Post reply on HN
Print view View original

181–190 of 294 posts

Re: What Spectre and Meltdown Mean for WebKit

#181

Post by littlestymaar »

duozerk wrote: post #172
littlestymaar wrote: post #152

Earlier quoted context omitted.

Indeed because auto-complete of recipient address from my contacts is useless, right ? Same could be said for retrieving new emails without reloading the page I guess … Had JavaScript not existed, the web would be dead a long time ago already.

Both good points (although the second one could be handled through a meta refresh I guess). But I'd like to point out we were discussing where javascript is absolutely needed, not where it's convenient.

It's absolutely needed in the sense that «without it the web wouldn't exist», something else would be there, with the same security issues or worse.

Remember when the web allowed no video playback ? Flash was everywhere ! And Flash was non-standard and closed-source, maintained by a single company without competition. The current state of the web is a massive improvement compared to what it was 10 years ago, especially on the security side.

If you want to create a webmail (or any other web platform) that needs no JavaScript, go ahead. I doubt you'll be successful competing against people using JavaScript, but if the demand for a JavaScript-free web experience is big enough, you could live happily in that niche.

Re: What Spectre and Meltdown Mean for WebKit

#182

Post by zero_shift »

UweSchmidt wrote: post #178
zero_shift wrote: post #168

Earlier quoted context omitted.

> An ecommerce, a newspaper or a blog should have no reason to execute client side code to render. The main reason is advertising, which is ultimately how this web content is paid for. But there could be alternatives. We could create static img elements that could securely and discretely record whether they were viewed by a human (to prevent ad fraud). We could support simple animations and interactivity in a secure,…

Static img elements with built-in surveillance and tracking, unblockable and intransparent, on a browser level? You have to be kidding. The ad-based web economy had produced the current publishing dystopia in the first place and prevents the development of a sane business model.

> The ad-based web economy had produced the current publishing dystopia in the first place and prevents the development of a sane business model.

Ah, the 'better business model' argument! A curious specimen, men often speak its name, but rarely agree how it looks or its habitat. Is it a donation model? Wait, no, that doesn't work. A paywall? Ah, but you want content for free. Philanthropist support? Oh, you don't like the conflict of interest. Micropayments? I suppose you have some cunning way of mitigating the transaction costs, without computationally expensive solutions like bitcoin.

Here's my proposition: post a model that is known to work, known to scale, for general purpose content, and you will have a startup on your hands. Otherwise - I ask you to withdraw your comment.

Re: What Spectre and Meltdown Mean for WebKit

#183

Post by zero_shift »

krapp wrote: post #180
zero_shift wrote: post #168

Earlier quoted context omitted.

> An ecommerce, a newspaper or a blog should have no reason to execute client side code to render. The main reason is advertising, which is ultimately how this web content is paid for. But there could be alternatives. We could create static img elements that could securely and discretely record whether they were viewed by a human (to prevent ad fraud). We could support simple animations and interactivity in a secure,…

>The danger to killing online advertising is that it creates a world where the only people who can afford to publish are those with other interests - plutocrats, politicians, churches - and who will inevitably bankroll news only to further political ends. You say that as if server space is super expensive, but it isn't, certainly not compared to other forms of media. It's entirely possible to publish to the web witho…

> people and businesses did it for years

The people were hobbyists and the businesses had other projects.

Relying on "interested members of the public" for news is how people like Alex Jones get started.

Re: What Spectre and Meltdown Mean for WebKit

#184

Post by osteele »

rickycook wrote: post #72
bradgessler wrote: post #36

One of the most brilliant features in the latest versions of Safari are per-website settings for ad blockers, notifications, location, etc. Between those two vulnerabilities and the general obnoxious useage of JS on websites, I’d love to see the addition of a per-website setting for JS. I would personally turn it off by default and only whitelist a handful of websites.

similar to noscript, there’s “JS Blocker” for Safari. it’s truly an excellent extension; significantly more powerful than noscript because it allows hugely customisable rules for loading only some scripts on some pages (eg https and *.cloudfront.com when loading console.aws.amazon.com), rules about canvas usage, XHR requests and a whole lot of other things. it’s the honestly the only reason i haven’t moved back to fi…

Don’t you need to audit the extension source, and verify it matches the build (or build it yourself), to make sure it’s not exfiltrating data from visited web sites?

I’ve been reluctant to install extensions, because I’d have to extend my trust set from the OS and Browser makers, to the extension author and the integrity of whatever system they use for their build.

Re: What Spectre and Meltdown Mean for WebKit

#185

Post by UweSchmidt »

zero_shift wrote: post #182
UweSchmidt wrote: post #178

Earlier quoted context omitted.

Static img elements with built-in surveillance and tracking, unblockable and intransparent, on a browser level? You have to be kidding. The ad-based web economy had produced the current publishing dystopia in the first place and prevents the development of a sane business model.

> The ad-based web economy had produced the current publishing dystopia in the first place and prevents the development of a sane business model. Ah, the 'better business model' argument! A curious specimen, men often speak its name, but rarely agree how it looks or its habitat. Is it a donation model? Wait, no, that doesn't work. A paywall? Ah, but you want content for free. Philanthropist support? Oh, you don't lik…

See Netflix, spotify. Those or others will come for content when ads are gone.

Re: What Spectre and Meltdown Mean for WebKit

#186

Post by krapp »

zero_shift wrote: post #183
krapp wrote: post #180

Earlier quoted context omitted.

>The danger to killing online advertising is that it creates a world where the only people who can afford to publish are those with other interests - plutocrats, politicians, churches - and who will inevitably bankroll news only to further political ends. You say that as if server space is super expensive, but it isn't, certainly not compared to other forms of media. It's entirely possible to publish to the web witho…

> people and businesses did it for years The people were hobbyists and the businesses had other projects. Relying on "interested members of the public" for news is how people like Alex Jones get started.

>The people were hobbyists and the businesses had other projects.

Yes, but my point is that publishing to the web doesn't require advertising on the web. Nor does advertising on the web require javascript.

>Relying on "interested members of the public" for news is how people like Alex Jones get started.

It's how a lot of people got started. You seem to be implying some relationship between the presence of political extremism and the absence of advertising, but I don't see any evidence the two are correlated.

Re: What Spectre and Meltdown Mean for WebKit

#187

Post by thanatropism »

cabalamat wrote: post #119
iovrthoughtthis wrote: post #105

Earlier quoted context omitted.

running untrusted code is a fundamental part of our daily experience. If you kill the webs ability to do that, people will build something else. The we have to go through the rigmarole of securing this whole new platform with the same bugs but in different ways. Instead of neutering the web, let's build secure cpus.

> Instead of neutering the web If you took JSW off of most websites, it wouldn't be neutering the web it'd be making it better.

MathJax though.

Re: What Spectre and Meltdown Mean for WebKit

#188

Post by zero_shift »

UweSchmidt wrote: post #185
zero_shift wrote: post #182

Earlier quoted context omitted.

> The ad-based web economy had produced the current publishing dystopia in the first place and prevents the development of a sane business model. Ah, the 'better business model' argument! A curious specimen, men often speak its name, but rarely agree how it looks or its habitat. Is it a donation model? Wait, no, that doesn't work. A paywall? Ah, but you want content for free. Philanthropist support? Oh, you don't lik…

See Netflix, spotify. Those or others will come for content when ads are gone.

But then why haven't "Spotify for Journalism" projects ever worked? How does a business go from $2 per paper to 0.2c per article? Why are so many artists so unhappy with their meagre Spotify royalties? I think this falls under my "proven to scale" condition.

[In reply to the below - as we have reached the thread limit: there will _always_ be free competition. The problem is: without advertising, the only players left will be those with deep pockets, and deep interests to protect - the state, churches, oligarchs and political groups]

Re: What Spectre and Meltdown Mean for WebKit

#189

Post by madez »

TeMPOraL wrote: post #166
madez wrote: post #163

Earlier quoted context omitted.

Money doesn't win every fight. And not every fight is about money. For example, Mozilla is a non-profit organization. It's not about making everybody stop doing the wrong thing, it's about doing the right thing. Having one modern browser ditch JavaScript would already be a huge win, and people who care could use it. If Mozilla pushed the open web, it would already be much better, because all those open projects could…

This fight is about money, because you're going against the entire industry, asking some players in it to self-sacrifice. > Having one modern browser ditch JavaScript would already be a huge win, and people who care could use it. For a short while, maybe, but as people making websites don't care about minority browsers, the amount of important websites you wouldn't be able to use through that browser would only grow,…

It is not about making everybody stop doing user-hostile activites. That is my main point here, it is not about that.

There are people who have a website and don't want to monetize the visitors. I want a standardized web for them. Not everbody has to belong to that group for it to have merit.

I don't expect Microsoft or Google to stop making their online office stuff. Honestly, I couldn't care less what they are doing. I want solutions for those that serve the users, and nobody else.

Re: What Spectre and Meltdown Mean for WebKit

#190

Post by zero_shift »

krapp wrote: post #186
zero_shift wrote: post #183

Earlier quoted context omitted.

> people and businesses did it for years The people were hobbyists and the businesses had other projects. Relying on "interested members of the public" for news is how people like Alex Jones get started.

>The people were hobbyists and the businesses had other projects. Yes, but my point is that publishing to the web doesn't require advertising on the web. Nor does advertising on the web require javascript. >Relying on "interested members of the public" for news is how people like Alex Jones get started. It's how a lot of people got started. You seem to be implying some relationship between the presence of political e…

The point is: large businesses have reputations. They are knowable and generally accountable. They can also protect themselves legally.

Semi-anonymous writers posting blogs are none of those.

Post reply on HN