Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Woob: Web Outside of Browsers

woob.tech

Post reply on HN
Print view View original

71–80 of 124 posts

Re: Woob: Web Outside of Browsers

#71

Post by Wowfunhappy »

anderspitman wrote: post #60

Something I've been thinking about lately is how browsers have essentially become a dependency for any sort of auth on the internet. Pretty much everything uses OAuth2, which requires you to be able to render HTML and CSS, and in many implementations JavaScript. That's ~20M (Firefox) to ~30M (Chromium) lines of code as a dependency for your application, just for auth. This applies even if you have a slick CLI app lik…

While I absolutely share the philosophical concern, I do wonder how large of an issue this is in practice. On an IOT device, or a retrocomputing/hobbyist platform, you'd likely want to display a QR code and have the user authenticate with their phone, similar to how you log into Netflix on a smart TV.

As an aside, to my knowledge OAuth2 still works in PaleMoon. I just downloaded the source and did a count with CLOC, and it looks like there's "only" ~13.5M lines of code. :)

Re: Woob: Web Outside of Browsers

#72

Post by tweetle_beetle »

dillondoyle wrote: post #69
dylan-m wrote: post #31

I like the idea of this. There's so much information on the web, but we still need a way to bring that information to other applications, without being tied to a particular source. That was really the dream of the semantic web, after all. This kind of idea would be really nicely paired with good Microformats[1] support, which continues to be a very good idea. That way we can find, say, a recipe or an address on a web…

Funnily, Google has pushed websites to add more structured data into their html for crawling.. Seems it's used for SEO hackinge. For instance on recipes why wouldn't a site give their recipe a super high rating. Those sites are awful SEO spam adservers basically. But business info that can be used to map seems pretty valuable to google. https://developers.google.com/search/docs/advanced/structure...

It's not as easy as faking metadata of 5* user ratings of your own content. If it ever was, that technique is no longer useful and likely to lead to losing rank.

Google uses a subset of schema.org, validates it according to its own stricter specification and extends it in other ways. It doesn't naively consume everything you provide. For example [1]

> If the Recipe structured data contains a single review, the reviewer's name must be a valid person or organization. For example, "50% off ingredients" is not a valid name for a reviewer.

> Warning: If your site violates one or more of these guidelines, then Google may take manual action against it. Once you have remedied the problem, you can submit your site for reconsideration.

[1] https://developers.google.com/search/docs/advanced/structure...

Re: Woob: Web Outside of Browsers

#73

Post by dmitriid »

anderspitman wrote: post #60

Something I've been thinking about lately is how browsers have essentially become a dependency for any sort of auth on the internet. Pretty much everything uses OAuth2, which requires you to be able to render HTML and CSS, and in many implementations JavaScript. That's ~20M (Firefox) to ~30M (Chromium) lines of code as a dependency for your application, just for auth. This applies even if you have a slick CLI app lik…

> All of this just so we have a safe, known location to stash auth cookies.

> It would be sweet if there was a lightweight protocol where you could lay out a basic consent UI

This also feels like it should be a part of the OS, since it's "select user, input password, and maybe 2fa, store auth". It doesn't need a full-blown web-browser.

It does, however, needs a properly defined protocol.

Re: Woob: Web Outside of Browsers

#74

Post by anderspitman »

Wowfunhappy wrote: post #71
anderspitman wrote: post #60

Something I've been thinking about lately is how browsers have essentially become a dependency for any sort of auth on the internet. Pretty much everything uses OAuth2, which requires you to be able to render HTML and CSS, and in many implementations JavaScript. That's ~20M (Firefox) to ~30M (Chromium) lines of code as a dependency for your application, just for auth. This applies even if you have a slick CLI app lik…

While I absolutely share the philosophical concern, I do wonder how large of an issue this is in practice. On an IOT device, or a retrocomputing/hobbyist platform, you'd likely want to display a QR code and have the user authenticate with their phone, similar to how you log into Netflix on a smart TV. As an aside, to my knowledge OAuth2 still works in PaleMoon. I just downloaded the source and did a count with CLOC,…

> On an IOT device, or a retrocomputing/hobbyist platform, you'd likely want to display a QR code and have the user authenticate with their phone, similar to how you log into Netflix on a smart TV.

It's a fair point, and there are specs[0] defined for these uses. Something like rclone could certainly do it this way if Google supports it on their end. But IMO the UX of browser-redirect OAuth is actually pretty dang good. I would like to have that available for CLI apps. What if you could literally import an ncurses library directly into your app and do the flow in-process? I'm not even sure if there's a way to do that securely but it would be sweet.

> As an aside, to my knowledge OAuth2 still works in PaleMoon.

That's going to depend completely on the OAuth2 implementation on the authorization server. It's completely up to the provider whether to require JavaScript or other features in order to render their consent page. Having a stronger specification of how to build those pages would offer more guarantees for interoperability.

[0]: https://datatracker.ietf.org/doc/html/rfc8628

Re: Woob: Web Outside of Browsers

#75

Post by anderspitman »

dmitriid wrote: post #73
anderspitman wrote: post #60

Something I've been thinking about lately is how browsers have essentially become a dependency for any sort of auth on the internet. Pretty much everything uses OAuth2, which requires you to be able to render HTML and CSS, and in many implementations JavaScript. That's ~20M (Firefox) to ~30M (Chromium) lines of code as a dependency for your application, just for auth. This applies even if you have a slick CLI app lik…

> All of this just so we have a safe, known location to stash auth cookies. > It would be sweet if there was a lightweight protocol where you could lay out a basic consent UI This also feels like it should be a part of the OS, since it's "select user, input password, and maybe 2fa, store auth". It doesn't need a full-blown web-browser. It does, however, needs a properly defined protocol.

Maybe someone needs to pull a "WireGuard for auth" and make a slick stripped-down implementation and spec and get it included in the kernel.

Re: Woob: Web Outside of Browsers

#76

Post by mst »

onion2k wrote: post #64
Ajedi32 wrote: post #12

Wow! I actually love the idea of being able to interact with websites via a standard API rather being forced to use web-based UI they provide. It opens up a whole lot of possibles for things like alternate clients, standard UIs for interacting across multiple sites, etc. Also eliminates the possibility of sites engaging in annoying or abusive behavior by putting users in full control of the client rather than the sit…

I actually love the idea of being able to interact with websites via a standard API rather being forced to use web-based UI they provide. That's what HTTP is. You're free to write a client that isn't a browser that sends and receives the same API messages as any HTTP client app does. Most people use browsers, but there's also things like iOS and Android apps that consume the same APIs as browsers, or Postman that dir…

GraphQL schemas almost seem like the least worst current option and I'm not entirely happy to be saying that.

Re: Woob: Web Outside of Browsers

#77

Post by giantrobot »

clone1018 wrote: post #17
Ajedi32 wrote: post #12

Wow! I actually love the idea of being able to interact with websites via a standard API rather being forced to use web-based UI they provide. It opens up a whole lot of possibles for things like alternate clients, standard UIs for interacting across multiple sites, etc. Also eliminates the possibility of sites engaging in annoying or abusive behavior by putting users in full control of the client rather than the sit…

I've had two ideas related to this in the past that I've always wanted to prototype: - A social media website without a frontend. We just provide a fully exposed API and Oauth, and devs can create their own client to interact with the social network. This would give devs the freedom to create their own experiences without locking users into one specific way of using the social network. - "Cloud" content hosting as a…

You just invented Web 2.0!

Not being a jerk but this concept was one of the major ideas behind Web 2.0 but fizzled out. Services would provide data endpoints that your user agent (browser or whatever) would tie together. Even your identity was just a bunch of meta tags in the headers of your web page pointing to things like FOAF or OPML files that linked to people you knew or sites you liked.

Your User Generated Content would just be your blog posts that could be easily followed by someone with an RSS reader. Things like photos or videos would work the same way as someone would just follow your Flickr feed (which you could point to with a metatag on your homepage.

The key takeaway was that everyone would host their own data, deciding what to publish or make public, and then smarter clients (other sites or apps) would collect this information and do whatever graph analysis you wanted.

But normal people do t want to run their own servers and tying disparate services together is non-trivial. So we got UGC but it was/is hosted on social media sites. They made it easier to put together an online presence than self-hosting everything.

Re: Woob: Web Outside of Browsers

#78

Post by fallat »

anderspitman wrote: post #60

Something I've been thinking about lately is how browsers have essentially become a dependency for any sort of auth on the internet. Pretty much everything uses OAuth2, which requires you to be able to render HTML and CSS, and in many implementations JavaScript. That's ~20M (Firefox) to ~30M (Chromium) lines of code as a dependency for your application, just for auth. This applies even if you have a slick CLI app lik…

You don't need browsers for OAuth2. IIRC the 9front guys even have support for OAuth-based systems.

Re: Woob: Web Outside of Browsers

#79

Post by rakoo »

Wowfunhappy wrote: post #71
anderspitman wrote: post #60

Something I've been thinking about lately is how browsers have essentially become a dependency for any sort of auth on the internet. Pretty much everything uses OAuth2, which requires you to be able to render HTML and CSS, and in many implementations JavaScript. That's ~20M (Firefox) to ~30M (Chromium) lines of code as a dependency for your application, just for auth. This applies even if you have a slick CLI app lik…

While I absolutely share the philosophical concern, I do wonder how large of an issue this is in practice. On an IOT device, or a retrocomputing/hobbyist platform, you'd likely want to display a QR code and have the user authenticate with their phone, similar to how you log into Netflix on a smart TV. As an aside, to my knowledge OAuth2 still works in PaleMoon. I just downloaded the source and did a count with CLOC,…

It's an issue because browsers keep getting bigger and more bloated, which encourages buying faster machines, which encourages consumption, the related production, and all the waste and pollution that come with it.

Re: Woob: Web Outside of Browsers

#80

Post by temac »

littlestymaar wrote: post #68
userbinator wrote: post #38

Earlier quoted context omitted.

I remember weboob, and all the amusing names of the various pieces. Unfortunate that the (French) humour was killed by political correctness.

It's not “political correctness” which killed the humor, in fact the humor was there by accident and at the beginning the creator of the project found that funny, so it stuck for a while > When weboob was started in 2010, 11 years ago, the name was chosen, without a hidden agenda, since as a French speaker, "boob" wasn't part of my vocabulary. > Following its release and the ensuing reactions, during its first years,…

> since as a French speaker, "boob" wasn't part of my vocabulary.

I think this sentence has been carefully constructed to be kind of true. The original author certainly knew what "boob" mean at the time. And the name "weboob" was voluntarily chosen as a pun. Now if you ask him maybe he will deny (I have other memories, but who cares) or maybe he will simply say that we do not use "boob" on a day to day basis in french so the pun seemed completely inconsequential.

But frankly, that's not a big deal, and nobody gives a shit to begin with. Everybody has been young, and some big bosses of far bigger companies have way more annoying histories. As for his company "budget insight", IIRC they already had contracts with some banks when it was still called "weboob" with even more terrible module names available.

Post reply on HN