Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I miss the programmable web (2021)

matt-rickard.com

Post reply on HN
Print view View original

31–40 of 180 posts

Re: I miss the programmable web (2021)

#31

Post by simonh »

beebeepka wrote: post #12

I don't miss them very much. The whole thing was a security nightmare and I am glad Mozilla dropped XUL. I think they truly had to. I get the utility but I suspect writing greasemonkey scripts for SPAs might not be a great experience.

That’s not a knock against Greasemonkey…

Re: I miss the programmable web (2021)

#32

Post by switch007 »

saurik wrote: post #29
pjerem wrote: post #20

Earlier quoted context omitted.

They aren’t dead but with more and more build systems that obfuscate everything in the page, including CSS classes and IDs, it’s sometimes hard to do something really useful.

Would you mind giving me an example of something you've wanted to do that is really hard (or even nearly impossible) due to the these issues (so I have a standing concrete challenge case)?

Trying to block Google’s “people also search for” div (when you navigate back to the search results page) is not easy IIRC

Re: I miss the programmable web (2021)

#33

Post by progval »

Ayesh wrote: post #11
LAC-Tech wrote: post #2

How did these user scripts work? I don't get how they could be "blocked" now. I've made my own snippets of JS to run on certain sites before.

Sites can impose a Content Security Policy, that (among other things) can disable inline JavaScript. This makes it a real PITA to modify web sites with user CSS/JS. I am personally aligned with pro-CSP because it can greatly reduce the attack surface of web sites I host, and is quite effective and precise. Browser extensions can, and do, play around CSP. Bookmarklets has no overhead in the browser, because they are j…

Why do browsers enforce CSP against bookmarklets and user scripts, though?

Re: I miss the programmable web (2021)

#34

Post by bmn__ »

drran wrote: post #9

IMHO, we need a browser optimized for power or professional user experience (PPUX), instead of browsers optimized for dumb users (DUX).

That was Opera browser up to version 12 and its spiritual successors, notably Otter browser.

• https://news.ycombinator.com/item?id=27695463 (2021-07, 96 comments)

• https://news.ycombinator.com/item?id=18830430 (2019-01, 47 comments)

Re: I miss the programmable web (2021)

#35

Post by system2 »

Maybe because we have an extension for almost everything. If not enough, tempermonkey still works for nearly everything I am doing. I also use stylebot here and there for visuals and block elements with adblock. I am not sure if I understood the author's problem.

Re: I miss the programmable web (2021)

#36

Post by FrozenVoid »

Writing userscripts and CSS filters becomes more tedious each few years, especially mucking with dynamic DOM and complex frameworks websites tend to use now. WASM and obfuscated/minified javascript made "programmable web" impossible in practice.

Re: I miss the programmable web (2021)

#37

Post by hiram112 »

Ayesh wrote: post #11
LAC-Tech wrote: post #2

How did these user scripts work? I don't get how they could be "blocked" now. I've made my own snippets of JS to run on certain sites before.

Sites can impose a Content Security Policy, that (among other things) can disable inline JavaScript. This makes it a real PITA to modify web sites with user CSS/JS. I am personally aligned with pro-CSP because it can greatly reduce the attack surface of web sites I host, and is quite effective and precise. Browser extensions can, and do, play around CSP. Bookmarklets has no overhead in the browser, because they are j…

I don't see how this could be truly secure if it's JS running on the client. There is nothing stopping a user from running a custom version of Chromium or otherwise that ignores CSPs... Maybe I'm not fully understanding what is being restricted here and where the code is being run.

Re: I miss the programmable web (2021)

#38

Post by TBurette »

progval wrote: post #33
Ayesh wrote: post #11

Earlier quoted context omitted.

Sites can impose a Content Security Policy, that (among other things) can disable inline JavaScript. This makes it a real PITA to modify web sites with user CSS/JS. I am personally aligned with pro-CSP because it can greatly reduce the attack surface of web sites I host, and is quite effective and precise. Browser extensions can, and do, play around CSP. Bookmarklets has no overhead in the browser, because they are j…

Why do browsers enforce CSP against bookmarklets and user scripts, though?

The goal is to prevent any way for attackers to inject code.

Bookmarklets and user scripts are collateral damage.

Re: I miss the programmable web (2021)

#39

Post by quickthrower2 »

saurik wrote: post #29
pjerem wrote: post #20

Earlier quoted context omitted.

They aren’t dead but with more and more build systems that obfuscate everything in the page, including CSS classes and IDs, it’s sometimes hard to do something really useful.

Would you mind giving me an example of something you've wanted to do that is really hard (or even nearly impossible) due to the these issues (so I have a standing concrete challenge case)?

Try it on a Tailwind & React based site. Lucky for a site like that it used NextJS so it has a lot of JSON state dumped in plaintext.
Post reply on HN