Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things you can do with a browser in 2020

github.com

Post reply on HN
Print view View original

291–300 of 387 posts

Re: Things you can do with a browser in 2020

#291

Post by Nursie »

modeless wrote: post #54
Arcsech wrote: post #46

Earlier quoted context omitted.

It's almost like we shouldn't have tortured a document transfer system until it was able to run full-on applications.

If operating systems had ever provided security strong enough to run untrusted code, we wouldn't have needed to. It's really a failing of operating system security. Even today no operating system provides an application sandbox as strong and versatile as the browser. Platforms have fallen back on walled gardens (app stores) with centralized control of all code execution to compensate for the deficiencies of their sec…

> If operating systems had ever provided security strong enough to run untrusted code

The browser hasn't either. See all the recent intel bugs and how many can be exploited from javascript.

Re: Things you can do with a browser in 2020

#292

Post by pjmlp »

hombre_fatal wrote: post #126
gowld wrote: post #111

Earlier quoted context omitted.

What's wrong with native app? You can delete it when you are done with it, just like you can close a browser tab when you are done with the "entire" web app you downloaded.

No uBlock, no dev console, no network tab. Completely opaque. An install step just to order a pizza. Shareable URLs/deeplinks. It's a freak of luck that we have the web, an app environment with a built-in dev console and actual customization. Just think how much it contrasts with the black box of native apps and with what large companies actually want. I'm in no rush to throw it away.

Sorry, for a minute I though you were describing mobile browsers.

Re: Things you can do with a browser in 2020

#293

Post by pjmlp »

ComputerGuru wrote: post #184
hobs wrote: post #174

Earlier quoted context omitted.

No need for ublock, the dev console is called your memory, your network tab is now something the entire os can understand, and you can even opportunistically block specific network calls. Obfuscated javascript running in the console is no better than random apps, and webasm is going to make that even more opaque. You are talking about features that are only needed for websites and why an app doesnt have those feature…

I think the point is that these features are masked from the user (especially on mobile) when performed in a native app vs a website.

Just like native mobile browsers.

Regular users aren't plugging their devices into a host computer to access dev tools into their mobile browser.

Re: Things you can do with a browser in 2020

#294

Post by jooize »

shp0ngle wrote: post #282

> Browsers can register push notifications Oh yes I didn't notice EVERY PAGE on the planet asking me for that. (After asking me for e-mail newsletter signup and cookie consent.)

Problem with Push Notifications is not the feature, but its implementation. Browsers decided to throw a popup instead of displaying an indicator of availability when a page supports Push Notifications. Possibly for discoverability. I disable the feature because there is no way to avoid the interruption and still easily accept for say a Discourse forum that I do want notifications from.

Blaming all web pages for their implementations is pointless. Give up the fight and redesign the browser. Don’t remove the feature because you believed web designers would hold back on informing the browser of its web page’s capability until the user interacts with some element every web designer would create, differently.

Re: Things you can do with a browser in 2020

#295

Post by jooize »

rkagerer wrote: post #28

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

Web Share makes share buttons within web pages more useful and coherent. Just wish more apps would place themselves in that OS-wide menu. Idea: app that can add custom Share menu entries, process with scripts.

I share the concerns regarding features with extra high risk of leaking sensitive data. The operating system should control access for those who wish to disable such features; it doesn’t necessarily have to ask for each capability just because the option exists. Those would of course still need to trust the app’s own isolation for web pages if they for app features require access to e.g. file system or Bluetooth.

Re: Things you can do with a browser in 2020

#296

Post by beagle3 »

saagarjha wrote: post #165
beagle3 wrote: post #161

Earlier quoted context omitted.

https://www.ft.com/content/4da1117e-756c-11e9-be7d-6d846537a... (and google "pegasus nso whatsapp" for more) tl;dr: The exploitation was indeed done through apps. The OS itself is harder to exploit, but most apps are not as secure and provide the first foot-in-the-door for the attacker.

I am responding specifically to the claim that once you've exploited an app, you have full access to the user's entire account (which is true to some extent on desktop platforms, but not on mobile OSes by default). I left a comment elsewhere about the kind of attack you're talking about: https://news.ycombinator.com/item?id=22632756

I see. Indeed, I agree it is not super easy to access everything on the mobile.

But I am still convinced that having a myriad of different apps, most of which are developed without real regards to security, makes the attack surface much larger -- e.g. you are likely to find a popular exploitable app that already has legitimate access to user data (such as "all the time" location data, contacts, calendar, ...) - as NSO did with whatsapp.

Re: Things you can do with a browser in 2020

#297

Post by 101404 »

rkagerer wrote: post #28

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

I think it's great that they exist. The problem is when they get used unnecessarily.

Push notifications are good when my Webmail tells me there's a new message or Gitlab tells me my tests passed.

Not so good when some crappy newspaper I visit for the first time asks me if I want be notified about all their clickbait articles all the time.

But with Brave it's pretty easy to disable JavaScript on a per-site basis, with "disabled" being the default. So all these things don't bother me anymore.

Re: Things you can do with a browser in 2020

#298

Post by beagle3 »

101404 wrote: post #297
rkagerer wrote: post #28

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

I think it's great that they exist. The problem is when they get used unnecessarily. Push notifications are good when my Webmail tells me there's a new message or Gitlab tells me my tests passed. Not so good when some crappy newspaper I visit for the first time asks me if I want be notified about all their clickbait articles all the time. But with Brave it's pretty easy to disable JavaScript on a per-site basis, with…

uMatrix does that and also takes that to the next level, at least on Firefox.

Re: Things you can do with a browser in 2020

#299

Post by innocenat »

hoseja wrote: post #278
jakub_g wrote: post #205

Earlier quoted context omitted.

FYI on Chrome/Brave Android, when you use 'share' button -> copy URL, it uses link rel=canonical meta tag if available (which generally doesn't have all FB tracking crap in the URL etc.) Much better than directly copying the URL.

Or you could just trim the URL yourself.

Which is a behaviour I observed in most power users, but none in the non-power user group.

I don't think most non-power user even want to try to trim that stuff, because they don't know what can be trimmed and what can't.

Re: Things you can do with a browser in 2020

#300

Post by OrgNet »

ryukafalz wrote: post #41
rkagerer wrote: post #28

As a user, so many of these I wish did NOT exist. E.g: Push Notifications, Banners, Web Share, Contacts, Page Visibility, Badging. Uncertain about USB, Bluetooth, Locks, Keyboard Lock, and Native File System. I don't want my browser doing those things.

I have mixed feelings on this. On one hand, websites that should be just documents are turning into resource-intensive applications, which is frustrating. Generally I do not want most websites using these features. On the other hand, the web as a runtime is one of the most universal platforms we have. If I run Slack in a browser, I sure do want it to be able to notify me! (Though I wish doing so felt more like the El…

"I have mixed feelings on this. On one hand, websites that should be just documents are turning into resource-intensive applications, which is frustrating."

I agree but I would be ok with them if they required explicit permission from the user before being allowed.

Post reply on HN