Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things you can do with a browser in 2020

github.com

Post reply on HN
Print view View original

271–280 of 387 posts

Re: Things you can do with a browser in 2020

#271

Post by chinesempire »

saagarjha wrote: post #239
Nicksil wrote: post #203

Earlier quoted context omitted.

>Citation needed. Browser-based attacks are difficult to come by, because it's just easier to attack an application instead. You require a citation then make an assertion with with no supporting source.

Browsers usually have fairly strong security models, since they are expected to constantly run untrusted code (which has nothing to do with web app security, FWIW). Apps rarely get this kind of scrutiny and often don't (Android) or can't (iOS) employ features that browsers can to do, such as multiple processes.

OS constantly execute untrusted code as well.

Many game engines do it as well, just think about DOOM mods

I think the point is that browsers are not as good as an OS as an application platform (given the limitations) but are as complex as an OS and have more bugs

The fact that mobile apps are terrible is not an excuse for having a terrible document protocol used for applications

Apple invented mobile apps as we know them today,but native apps in general have served people well for ages

We are at a point where a native app with some API is more maintainable than a browser app

Not even talking about the ecosystem and its fiascos, like npm corrupted libs used by millions without even looking at a single line of source code or the famous leftpad incident

It doesn't really matter where the weakness is, if it is exploitable

As Alan Kay once said "the web was made by amateurs at best"

Re: Things you can do with a browser in 2020

#272

Post by bryanrasmussen »

untog wrote: post #79
rkagerer wrote: post #28

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

Then you're out of step with what users want these days. Nothing wrong with that! But to take an example, when I hit a share button on a page I want to see the native share box, not some hideous iframed monstrosity that only works with Facebook. So I want Web Share. And I don't want to download an entire native app just so that I can receive a push alert when my food order is on the way, a web site works much better…

Ok, a lot of these features requires the site to ask the user for permission to use them. What is the percentage of users giving permission for the usage? In my experience not that great even when asking for something that will definitely improve the user experience in that context of the site they are on.

If users don't really give you permissions to use these things it implies to me that users don't really want them.

Re: Things you can do with a browser in 2020

#273

Post by franga2000 »

cosmotic wrote: post #112
untog wrote: post #79

Earlier quoted context omitted.

Then you're out of step with what users want these days. Nothing wrong with that! But to take an example, when I hit a share button on a page I want to see the native share box, not some hideous iframed monstrosity that only works with Facebook. So I want Web Share. And I don't want to download an entire native app just so that I can receive a push alert when my food order is on the way, a web site works much better…

Share API isn't needed for sharing content, copy and paste worked better than share api and it was around decades ago. About what percent of push notification requests do you accept? I think my percentage is 0, and the number of requests is high tens if not hundreds. I don't trust browser notifications at all. Here's some stats: https://www.businessofapps.com/marketplace/push-notification... Opt-in rates are around 6…

> Share API isn't needed for sharing content, copy and paste worked better than share api and it was around decades ago.

Most big websites have different URLs for the same content. When you're sharing a link, you want the canonical URL, which is neutral and universal, not the URL you're currently on, which might have a session ID, user preferences, scroll anchors, etc appended to it. The share button in your browser uses the canonical URL of the site (if provided), which looks nicer and works better.

Re: Things you can do with a browser in 2020

#274

Post by chinesempire »

TheCoelacanth wrote: post #185
jfkebwjsbx wrote: post #158

Earlier quoted context omitted.

False. For starters, browsers can only implement sandboxing thanks to the OS facilities, otherwise it would be impossible. And that is modern ones. 5 years ago some browsers were still a security nightmare with not even multiprocess separation.

There's a difference between what features OSes have and which ones they are effectively using. If you ran untrusted native apps with the same level of consideration that people run untrusted web sites, your identity would be stolen every 30 seconds. That is solid empirical evidence of a better security model.

This is a classic false sense of security

People identities are stolen constantly by web apps, they just don't know

An app like Excel could steal my data, yes, but it is my willingness to give away all my connections to Facebook and let them spy my interactions that gave away my identity and also the identity of people that do not use Facebook, but are mentioned by me or my other contacts (for example my parents)

That's the real danger

Re: Things you can do with a browser in 2020

#275

Post by oblio »

taeric wrote: post #181
untog wrote: post #79

Earlier quoted context omitted.

Then you're out of step with what users want these days. Nothing wrong with that! But to take an example, when I hit a share button on a page I want to see the native share box, not some hideous iframed monstrosity that only works with Facebook. So I want Web Share. And I don't want to download an entire native app just so that I can receive a push alert when my food order is on the way, a web site works much better…

I prefer copying the link to the page I'm on to share. No popups, native or otherwise. Similarly, I like not having an app running so that you could just send me a text. Sms is bad for security, but great see sending short notifications. Almost better, as it is so limited.

The most used feature in Microsoft Office is the Paste button in the toolbar:

> What we didn't know until we analyzed the data was that even though so many people do use CTRL+V and do use "Paste" on the context menu, the toolbar button for Paste still gets clicked more than any other button. The command is so incredibly popular that even though there are more efficient ways of using it, many people do prefer to click the toolbar button.

https://docs.microsoft.com/en-us/archive/blogs/jensenh/no-di...

You and I use Ctrl-V, but the vast majority of users want something a lot more visual.

Re: Things you can do with a browser in 2020

#276

Post by franga2000 »

rkagerer wrote: post #28

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

Push notifications are good for messaging apps (including chat support, etc.). They're 100% opt-in and harmless.

Web Share is barely a thing. It's literally just a call to an already existing browser function and deprecates all the vendor-specific embeds in most sites (each FB, Twitter, etc. share button you see either uses this single-function API, or loads their huge blob of JavaScript on every page that has it - which do you prefer?).

As a user of Web messaging apps, I also like the Visibility API, because it allows the apps I use to stop rendering while in background and just queue up messages to render when I look at them. This allows the process running those tabs to basically go to sleep (even swapping sometimes) which increases battery life and performance.

The rest of the ones you listed, I agree, really shouldn't be in Web browsers.

Re: Things you can do with a browser in 2020

#277

Post by onion2k »

pjmorris wrote: post #269
onion2k wrote: post #265

Earlier quoted context omitted.

The evidence is that the end users use these things when they're implemented in browsers and web developers adopt them in their apps.

I promise that I have never asked for a notification or a pop-up. They 'work' from the point of view of web sites and browser vendors, maybe more so than from the perspective of users.

I promise that I have never asked for a notification or a pop-up.

Very few people ask for a specific implementation of a feature unless they want you to clone something they've seen elsewhere. People don't do that.

In user focus groups I've been in though users have told me that they find it hard to know when they need to pay attention to something, or when they've been tagged in to something, or to know when a server side task has completed, or when a long-running webworker process has completed. All of those things are obvious use cases for some sort of notification, and when the feature has been implemented users both enable them and click on them.

Heck, I got a Google Calendar notification pop-up while I was writing this comment.

The problem is that you don't want notifications so you want them to be removed from browsers and then no one gets notifications even if they want them. That's not reasonable. The answer is that you need to be able to block them easily; to turn that feature off for yourself. This exists (in Chrome) - chrome://settings/content/notifications You can disable them for all sites. And yet you'd rather complain that they exist instead.

Re: Things you can do with a browser in 2020

#278

Post by hoseja »

jakub_g wrote: post #205
taeric wrote: post #181

Earlier quoted context omitted.

I prefer copying the link to the page I'm on to share. No popups, native or otherwise. Similarly, I like not having an app running so that you could just send me a text. Sms is bad for security, but great see sending short notifications. Almost better, as it is so limited.

FYI on Chrome/Brave Android, when you use 'share' button -> copy URL, it uses link rel=canonical meta tag if available (which generally doesn't have all FB tracking crap in the URL etc.) Much better than directly copying the URL.

Or you could just trim the URL yourself.

Re: Things you can do with a browser in 2020

#279

Post by raxxorrax »

untog wrote: post #79
rkagerer wrote: post #28

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

Then you're out of step with what users want these days. Nothing wrong with that! But to take an example, when I hit a share button on a page I want to see the native share box, not some hideous iframed monstrosity that only works with Facebook. So I want Web Share. And I don't want to download an entire native app just so that I can receive a push alert when my food order is on the way, a web site works much better…

> Then you're out of step with what users want these days.

We hear this pretty often without any evidence. He is a user, you are a user, that makes two opinions.

I think the reality that companies set the rules and people just swallow what they get because alternatives require huge efforts.

We also heard that users want large tiles that are all over their desktop with zero functionality.

Re: Things you can do with a browser in 2020

#280

Post by radarsat1 »

rkagerer wrote: post #28

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

I don't mind the idea of notifications when I have a web page open in a tab. Like, sure if I receive a message while I'm looking at another tab, let me know!

But I was a bit shocked to discover that I was getting notifications from sites that I did not have open, then I realized that when I register for notifications the browser will continuously poll that site in the background, no matter whether I've browsed to that site in this session or not. That was when I decided I didn't want any notifications.

It's not even the interruption, but more the knowledge that my computer is casually making HTTP requests in the background, continuously, on a site I haven't even browsed to, that I don't feel comfortable with..

Post reply on HN