Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge Experimenting with a Super Duper Secure Mode

microsoftedge.github.io

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#21

Post by Vinnl »

vladvasiliu wrote: post #12
Retr0id wrote: post #10

Earlier quoted context omitted.

Assuming "trusted websites" is a user preference, why should it matter?

Because "defaults are forever" or something like that. Most people won't alter those settings, so whatever is "trusted by default" will run faster. The average user will just note that some sites are very fast, while others are very slow.

Basically what you see for instant messengers on Android: phones usually come with battery savings exceptions for WhatsApp, so when people install Signal, it looks bad for not delivering messages as reliably as WhatsApp.

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#23

Post by ho_schi »

I dare it - turn off JavaScript!?

Websites doesn't require JavaScript, what really needs JavaScript are Singe-Page-Web-Apps-Somethings with anti-patterns like infinite scrolling. You get two things in return, a "super duper" fast web and a more secure web-browser. For example Amazon supports usage without JavaScript very well. Another experience is Stackoverflow, things like the preview and highlighting doesn't work. The highlighting can be added with server-side code but this will cost some CPU-Time - and it is not your CPU-Time. It is their CPU-Time? There is tiny feature I would appreciate in HTML-Engines "copy link to location" instead of using JavaScript - but there is this usable hierarchical address-bar a the top (which Google tries to hide) which already serves this purpose.

I'm not against JavaScript. JavaScript is just a tool but I ask the question if good websites require it? Hackernews uses 134 lines of JavaScript, this is alredy nearly nothing. Can you imagine using Hackernews without JavaScript?

My webbrowser (WebKitGtk) provides a permission panel for every website:

* advertisements

* notifications

* password

* location

* microphone

* webcam

* media

A first step would be adding there JavaScript, too? Maybe some nasty Cookie-Dialogs will disappear as consequence. But that is not a loss?

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#25

Post by rocqua »

tester34 wrote: post #22

How about going further Disabling CPU's speculative execution on untrusted code (browser) too

If your javascript is no longer getting compiled down to bytecode any kind of speculative execution is going to be soooooooo much harder to do that I think disabling the JIT is probably the most effective spectre-like mitigation a browser could do.

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#26

Post by bob1029 »

ho_schi wrote: post #23

I dare it - turn off JavaScript!? Websites doesn't require JavaScript, what really needs JavaScript are Singe-Page-Web-Apps-Somethings with anti-patterns like infinite scrolling. You get two things in return, a "super duper" fast web and a more secure web-browser. For example Amazon supports usage without JavaScript very well. Another experience is Stackoverflow, things like the preview and highlighting doesn't work.…

I'm 100% on board with this line of thinking, but the edge case that the business keeps complaining about is being able to push async events to the client.

How would we accomplish this sort of UX without javascript?

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#27

Post by saurik »

bob1029 wrote: post #26
ho_schi wrote: post #23

I dare it - turn off JavaScript!? Websites doesn't require JavaScript, what really needs JavaScript are Singe-Page-Web-Apps-Somethings with anti-patterns like infinite scrolling. You get two things in return, a "super duper" fast web and a more secure web-browser. For example Amazon supports usage without JavaScript very well. Another experience is Stackoverflow, things like the preview and highlighting doesn't work.…

I'm 100% on board with this line of thinking, but the edge case that the business keeps complaining about is being able to push async events to the client. How would we accomplish this sort of UX without javascript?

I think the argument is that while a good amount of my daily web browser usage might like that feature (as I do in fact use it as an application sandbox), a vanishingly small number of the separate web sites I visit on any given day (which are all one-off pieces of content I am accessing) need that to functionality, and I can whitelist them by turning JS on for them, as they are also pretty much the same few websites every day.

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#28

Post by janfoeh »

vladvasiliu wrote: post #12
Retr0id wrote: post #10

Earlier quoted context omitted.

Assuming "trusted websites" is a user preference, why should it matter?

Because "defaults are forever" or something like that. Most people won't alter those settings, so whatever is "trusted by default" will run faster. The average user will just note that some sites are very fast, while others are very slow.

I don't think it's quite so dire. Remember that big sites like Facebook at least used to display warnings in the developer console, akin to "DO NOT PASTE THINGS IN HERE YOU RECEIVED FROM STRANGERS"?

There is a sizeable subset of people who are curious and do care, and who would be eager to try that "one weird trick that speeds up 200%" spreading through their Telegram group.

But for the most part, non-technologically inclined people seem to have a Hindu cow-like frustration tolerance when it comes to technology. If Windows takes twelve minutes to boot and your browsers viewport has shrunken to the size of a postage stamp due to toolbars, then that's just the way it is.

I would wager that for them, site Y running half as fast as site X matters a lot less than you think.

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#29

Post by roenxi »

bob1029 wrote: post #26
ho_schi wrote: post #23

I dare it - turn off JavaScript!? Websites doesn't require JavaScript, what really needs JavaScript are Singe-Page-Web-Apps-Somethings with anti-patterns like infinite scrolling. You get two things in return, a "super duper" fast web and a more secure web-browser. For example Amazon supports usage without JavaScript very well. Another experience is Stackoverflow, things like the preview and highlighting doesn't work.…

I'm 100% on board with this line of thinking, but the edge case that the business keeps complaining about is being able to push async events to the client. How would we accomplish this sort of UX without javascript?

That ... is an interesting question that is not really a problem for someone who wants to browse the web without JavaScript. Which is almost the only person whos choice really matters when it comes to user security.

Some sites I've accidentally browsed without NoScript makes me question how people access sites with JS enabled at all. There are some shockers out there.

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#30

Post by csande17 »

asiachick wrote: post #6
tinus_hn wrote: post #4

Interesting but I am not a fan of how they don’t mention disabling features like WebAssembly in the short description.

they did mention it in the long description. It's off for now but they are planning on turning it on. I'd guess it's safer than JIT because the translation to assembly is simple, or can be simple. It's not trying to do the complicated process of analyzing a dynamically typed language and applying different ways of optimizing.

I bet they'll end up using a pure bytecode interpreter for Web Assembly as well, that just runs the operations one by one instead of converting them to machine code. It'd be the same "slower but safer" trade-off that the mode uses for regular Javascript.
Post reply on HN