111–120 of 180 posts
Whose going to be first to make the 'I always browse the Web with CSS disabled' post?
Wouldn't something like this be enough? ::before, ::after { content: '' !important; }
This doesn’t mention my personally favorite css tracking trick, timing attacks that can be used to detect what sites you have loaded. This can be done by interweaving requests to a remote URL (say background-image) with requests to your server script, which times these differences.
The fanciest tracking trick is the HSTS supercookie. You use a bunch of subdomains -- a.example.com, b.example.com, etc. -- each configured so that a particular URL (call it the 'set' URL) sends an HSTS header. A different URL (the 'get' URL) doesn't. You generate an ID for the user, and encode it as a bit pattern using the subdomains to indicate positions of '1' digits. Say your ID is 101001 -- you serve a page whic…
I feel like this changes all the time; I was recently surprised to discover 'TLS Client Channel ID' (my nomenclature is a bit fuzzy - an RFC for automatic client certs "for security") and would love to learn more about the extent of its current implementation in Chrome.
https://news.ycombinator.com/item?id=15753648
>londons_explore: In Chrome, it also uses the TLS Client Channel ID, which is a persistent unique identifier established between a browser and a server which (on capable platforms) is derived from a key stored in a hardware security module, making it hard to steal. Ie. if you clone the hard drive of a computer, when you use the clone, Google will know you are a suspicious person, even though you have all the right cookies.
https://en.wikipedia.org/wiki/Transport_Layer_Security_Chann...
Earlier quoted context omitted.
> * Media query - So what, user agent gives this away mostly anyways I was earnestly surprised how much data macOS and Android devices tend to put into the user agent. Not only the exact patch level of the browser, but also the OS patch level and Android devices even tend to broadcast the precise device model as well -- more accurately than just looking at the device! Some examples: Mozilla/5.0 (iPad; CPU OS 10_3_3 l…
The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.
Alright lads, let's all go back to RSS feeds and scrap that whole "browser" experiment.
I seriously think we need an alternative to HTML that axes styling and scripting and concentrates solely on the markup / content description. Websites would use a certain set of elements/descriptors to describe the content they contain. The user’s website reader would parse the markup / content description and display a page how it thinks it should be displayed (according to the user’s preferences). All websites woul…
#oneofus https://hn.algolia.com/?query=13226170&type=comment (click a 'comments' link on the search results, then 'parent')
I've connected similar sentiment here for about a year now; I've appreciated mention of several helpful tools in this thread.
Earlier quoted context omitted.
Wouldn't something like this be enough? ::before, ::after { content: '' !important; }
You have no idea how many websites you would break:) I've seen UI strings in "before" and "after" pseudoelements...
Earlier quoted context omitted.
> If you're concerned as a user of a malicious site Or if you're concerned as a user of a regular "safe" site... Google Analytics does all of these things: link tracking, hover tracking, media query tracking. GA or something like it is being used by vast swaths of the web. I don't claim it's the majority, because I don't know, but that's what I assume, that all sites are tracking (whether or not the site even knows i…
Right, which is why GA is not allowed to load in my browsers. This is a different avenue for disclosure of a similar bundle of info.
In other words: Do you not want a third party (like Google) to have that data or the second party (web administrators)?
Earlier quoted context omitted.
Using lynx, the only thing that makes reading Hacker News somewhat inconvenient is the lack of indentation to show the nesting hierarchy, but otherwise it works quite well. Some other sites are so messed up that it's actually more comfortable to read them in a text-only browser that completely ignores CSS and replaces images by their alt-tags. Of course I frequently do want to look at images, so my main browser remai…
You can see the indentation if you use w3m. HN uses tables to structure the comment hierarchy, and the w3m browser does a pretty great job rendering tables.
Earlier quoted context omitted.
Using lynx, the only thing that makes reading Hacker News somewhat inconvenient is the lack of indentation to show the nesting hierarchy, but otherwise it works quite well. Some other sites are so messed up that it's actually more comfortable to read them in a text-only browser that completely ignores CSS and replaces images by their alt-tags. Of course I frequently do want to look at images, so my main browser remai…
Firefox's "reader view" is quite good for that (and to avoid bloggers terrible choice of fonts/font color/font size)
I can't stand reading articles with <18px font size. Some pages (like HN) I simply zoom in to something like 150%, but if it's just an article, hitting that button is easier to me than zooming in.
Earlier quoted context omitted.
> why should any website know all that? As a developer: Without user agent: How would I easily detect which browser breaks a certain feature on my project? If I deploy a new feature and see through logging that a browser X is not able to do Y then I can install X on my machine and test and fix it. If I don't have a user agent then I can just detect that after deploy there are more cases where Y fails but I don't know…
As a developer: If we actually pushed browsers to fix things, you wouldn't need to worry about that. Why should the job fall to you to work around their shitty implimentation of the spec?
Earlier quoted context omitted.
The user agent is such a mess, why should any website know all that? Why should a website know anything about the visiting guest, they should be using feature detection instead. Lets get rid of the user agent or just put "Mobile/phone", "Desktop" or similar in it. Maybe OS and a short browser name and main version number for statistics.
I've always thought this. Just code to the standard, and if the browser doesn't render it correctly, then tell the user to fuck off and fix their browser. I don't know why we ever thought sending all this data to the server was a good idea
Remember: incentives. The goal of a web developer is to make sites people use.