Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I miss the programmable web (2021)

matt-rickard.com

Post reply on HN
Print view View original

41–50 of 180 posts

Re: I miss the programmable web (2021)

#41

Post by juliendorra »

anonyfox wrote: post #27
ozten wrote: post #3

I thought this would be about the glory days of “Mash-ups” using web APIs. Flickr + Twitter + Delicious tags to create a new experience. 2007 ? What a period to be a hacker!

If we could *force* all the walled gardens to have an open API again, like some of them had back in the day, that would solve soooo many issues. Make all the data free to use for everyone, while ML techniques get even more accessible, and let people build products with that - where they also have to provide APIs for their enriched data.

We can, via policy and regulations! EU would be your best bet for lobbying, as Open Data is already mandatory for public data, and an extension to some privately produced data is not out of the question (it was discussed for transport data for example, ie. Uber data)

Re: I miss the programmable web (2021)

#42

Post by meesterdude »

Theodores wrote: post #18

I miss the 3D web. In the late 90's Silicon Graphics machines came with an out of the box experience delivered by Netscape Navigator. The page was rendered in frames, so you only downloaded the navigation frames once, not with every click. Some of this navigation and some of this content was in VRML that you could interact with. The full product tour could be explored in a 3D world. The UI UX did not seem OTT. It fel…

    We aren't even thinking along those lines these days.
Some of us are. My side project is in many ways a 3D web; and i know I'm not alone in exploring the domain.

Re: I miss the programmable web (2021)

#43

Post by phil294 »

saurik wrote: post #29
pjerem wrote: post #20

Earlier quoted context omitted.

They aren’t dead but with more and more build systems that obfuscate everything in the page, including CSS classes and IDs, it’s sometimes hard to do something really useful.

Would you mind giving me an example of something you've wanted to do that is really hard (or even nearly impossible) due to the these issues (so I have a standing concrete challenge case)?

I have another fun challenge, try to completely disable the auto-zoom-feature on Google Maps. Last time I tried, I stepped through 20 stacks of obfuscated nonsense before eventually giving up.

But tbh I can't really imagine any scenario that is near impossible - except for WASM driven web pages which will break just about anything :(

Re: I miss the programmable web (2021)

#44

Post by pbhjpbhj »

tannhaeuser wrote: post #24

On a related note, Chrome has removed its user stylesheet feature years ago. I've often asked myself why we then still need this "cascading" of style sheets. It seems to have degenerated into a feature for web developers who can't make up their minds, and pushing conflicting styles to every browser for late evaluation, negatively impacting energy consumption. Or maybe they want component-like behaviors from their thi…

Isn't this just how technology progresses? Things start off as amateur pursuits but once a field becomes profiting making then professionals move in and industrialise things.

Re: I miss the programmable web (2021)

#46

Post by matkoniecz »

progval wrote: post #33
Ayesh wrote: post #11

Earlier quoted context omitted.

Sites can impose a Content Security Policy, that (among other things) can disable inline JavaScript. This makes it a real PITA to modify web sites with user CSS/JS. I am personally aligned with pro-CSP because it can greatly reduce the attack surface of web sites I host, and is quite effective and precise. Browser extensions can, and do, play around CSP. Bookmarklets has no overhead in the browser, because they are j…

Why do browsers enforce CSP against bookmarklets and user scripts, though?

Naive users can be convinced to run random code.

Go to discord.com (no need for account) and open browser console.

You will see

> Hold Up!

> If someone told you to copy/paste something here you have an 11/10 chance you're being scammed.

> Pasting anything in here could give attackers access to your Discord account.

presumably they added it after it kept happening. And likely the same things happens when random user can somehow run code they got from scammer :(

Re: I miss the programmable web (2021)

#47

Post by ptx »

progval wrote: post #33
Ayesh wrote: post #11

Earlier quoted context omitted.

Sites can impose a Content Security Policy, that (among other things) can disable inline JavaScript. This makes it a real PITA to modify web sites with user CSS/JS. I am personally aligned with pro-CSP because it can greatly reduce the attack surface of web sites I host, and is quite effective and precise. Browser extensions can, and do, play around CSP. Bookmarklets has no overhead in the browser, because they are j…

Why do browsers enforce CSP against bookmarklets and user scripts, though?

It looks like Mozilla fixed it for bookmarklets[1] three years ago in Firefox 69.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1478037

Re: I miss the programmable web (2021)

#48

Post by tannhaeuser »

pbhjpbhj wrote: post #44
tannhaeuser wrote: post #24

On a related note, Chrome has removed its user stylesheet feature years ago. I've often asked myself why we then still need this "cascading" of style sheets. It seems to have degenerated into a feature for web developers who can't make up their minds, and pushing conflicting styles to every browser for late evaluation, negatively impacting energy consumption. Or maybe they want component-like behaviors from their thi…

Isn't this just how technology progresses? Things start off as amateur pursuits but once a field becomes profiting making then professionals move in and industrialise things.

Maybe, but somehow Microsoft Office with its VBA macros has managed to remain sane in comparison ;)

Re: I miss the programmable web (2021)

#49

Post by debesyla »

saurik wrote: post #29
pjerem wrote: post #20

Earlier quoted context omitted.

They aren’t dead but with more and more build systems that obfuscate everything in the page, including CSS classes and IDs, it’s sometimes hard to do something really useful.

Would you mind giving me an example of something you've wanted to do that is really hard (or even nearly impossible) due to the these issues (so I have a standing concrete challenge case)?

Facebook and Instagram ads. Impossible to block through CSS now as the CSS classes are dynamically generated + it's even hard to pick out sponsored posts using .js too.

Re: I miss the programmable web (2021)

#50

Post by rektide »

progval wrote: post #33
Ayesh wrote: post #11

Earlier quoted context omitted.

Sites can impose a Content Security Policy, that (among other things) can disable inline JavaScript. This makes it a real PITA to modify web sites with user CSS/JS. I am personally aligned with pro-CSP because it can greatly reduce the attack surface of web sites I host, and is quite effective and precise. Browser extensions can, and do, play around CSP. Bookmarklets has no overhead in the browser, because they are j…

Why do browsers enforce CSP against bookmarklets and user scripts, though?

Bookmarklets & user scripts evaluate in the page's context.

CSP literally says, only talks to these specific domains. https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#exampl...

The browser doesnt block thr bookmarklet from running (iirc). But most bookmarklets immediately try to download & run some libraries to do their thing. Or they try to send data somewhere. And CSP is blocking those connections.

Its hard form me to guess how much of this is intentional anti-user lock out, and how much is just oversight or technical diffifulty. I could see not wanting to drill backdoors through your own security policy, which is more or less what it woild take, but it sure feels lile a loss. Users can turn off csp for the browser with a flag if they want, but we can only do that to the whole browser, not site by site. Also worth pointing out that just disabling csp for thr browser/site (rather than carving exceptions for userscripts/bookmarklets) is something sites can detect (by succeeding in a request that ought not go through) & could potentially decide not to serve you content or what not if they wanted to be petty. That said, extensions exist & arent readily detectable so there's options... they are just nowhere near as direct to author & use.

Post reply on HN