Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kristall – a browser without support for CSS/JS/WASM or graphical websites

kristall.random-projects.net

Post reply on HN
Print view View original

181–190 of 198 posts

Re: Kristall – a browser without support for CSS/JS/WASM or graphical websites

#181

Post by meindnoch »

moring wrote: post #171
shadowgovt wrote: post #139

Earlier quoted context omitted.

It's not flaws in the browser; it's flaws in the design of HTML and CSS (i.e. "Oops nobody realized that a real right bastard could bend the static rendering tools to make this happen; well that's a problem"). I'm having difficulty sourcing the details right now, unfortunately; I believe the issue was that non-JavaScript HTML combined with CSS lets you frame-in the target site's login page but situated in such a way…

My guess would be: using CSS to place the malicious site's input files exactly where the framed site's input fields are, but "on top" (on the z axis), so the user actually inputs data into the malicious site.

How is this “attack” any different than simply mirroring the site? The URL bar shows the malicious site either way. If you enter your password on the malicious site, you’re pwned. Don’t need frames for that.

Re: Kristall – a browser without support for CSS/JS/WASM or graphical websites

#183

Post by throw10920 »

denton-scratch wrote: post #173
est wrote: post #113

I am ok with no CSS/JS/WASM, but no graphics? This is wrong on metaphysics level. Like Socrates believed, writing was not an effective means of communicating knowledge

It says that one of the features is "In-browser rendering of text, images and video". That seems to be at odds with the statement that it doesn't support "graphical websites". All I can think is that it doesn't support canvas - which would have surprised me anyway.

The "Hacker News on Kristal" screenshot from a sibling comment[1] shows HN rendered without the logo in the corner - I believe the browser won't render inline media (which is how many other Gemini viewers work), in which case the parent's complaint applies.

I think that it's kind of an anti-tool-for-thought - meant to be an art piece or a political statement, and not a tool for getting work done.

[1] https://news.ycombinator.com/item?id=34351337

Re: Kristall – a browser without support for CSS/JS/WASM or graphical websites

#184

Post by shadowgovt »

meindnoch wrote: post #181
moring wrote: post #171

Earlier quoted context omitted.

My guess would be: using CSS to place the malicious site's input files exactly where the framed site's input fields are, but "on top" (on the z axis), so the user actually inputs data into the malicious site.

How is this “attack” any different than simply mirroring the site? The URL bar shows the malicious site either way. If you enter your password on the malicious site, you’re pwned. Don’t need frames for that.

> The URL bar shows the malicious site either way

That's never been sufficient to keep bad actors out because end-users don't grok the URL bar.

This attack is superior to a mirroring attack because it uses the target site's own UI resources, so it looks very legit (no need to pay someone to monitor the UI of the target site for changes and rework your exploit to attack them).

Re: Kristall – a browser without support for CSS/JS/WASM or graphical websites

#185

Post by peoplefromibiza »

napolux wrote: post #55
marginalia_nu wrote: post #53

Earlier quoted context omitted.

Dunno, the gemini protocol and gemtext format is like the internet equivalent of a 6502. It's extremely approachable to anyone with a basic understanding of programming. Like you could slap together a working client or a server in an afternoon, most likely. Its built-in limitations also inspires quite a lot of creativity.

That's make it just a toy

what's wrong with toys?

Toys are way better than startups and growth and monetization and disruption and onlyfans to pay the bills.

Re: Kristall – a browser without support for CSS/JS/WASM or graphical websites

#186

Post by GnarfGnarf »

leidenfrost wrote: post #80
danShumway wrote: post #45

I have nitpicks and criticisms about Gemini, and it's not a protocol that I use very often (if at all), but I also don't see the harm in it. It seems to have a pretty strong grasp of what its goals are and (minor criticisms aside) it does a decent job of accomplishing those goals. Nowadays I tend to compare Gemini more to things like Pico-8 or Markdown rather than think of it as a web competitor -- and as a result I'…

I think of Gemini less like a competitor to the web but more as ham radio. Radio amateurs can communicate through the internet with their phones and it would be faster, simpler and easier. But radio gives them both the nostalgia feeling and a niche community to belong. Gemini is kinda like that.

Radio Amateurs will be indispensable when the next CME (Corona Mass Ejection) annihilates our grid and the Internet.

Look up "Carrington Event".

Re: Kristall – a browser without support for CSS/JS/WASM or graphical websites

#187

Post by Karunamon »

BizarreByte wrote: post #99

I don’t think I’ve ever seen HN react so negatively to a project, but I think that has to do with the image people have of what a “browser” is. Kristall isn’t very useful for HTTP even though it supports the protocol. That said its goal is the “small internet” and very basic sites on HTTP will work, which is is inline with that goal. Some have complained even Google search doesn’t work, but Google search doesn’t fall…

I think part of the problem is that the "small internet" isn't a concretely definable thing in the same way that "Gemini space" is. Gemini browsers are meant to browse Gemini space and the expectations and limitations of that are known ahead of time.

Meanwhile, this app is meant for browsing an unknown, undefined limited subset of the plain old HTTP web; and when you step out of that sandbox (and you most definitely will inadvertently do so) what you are left with is a broken experience. A web browser that goes out of its way to not support foundational basics is just a shitty web browser given that my normal web browser can hit the same sites.

Re: Kristall – a browser without support for CSS/JS/WASM or graphical websites

#188

Post by johnfernow »

pipo234 wrote: post #166
mprime1 wrote: post #102

Earlier quoted context omitted.

Not GP but heres what I think they meant. In the old days you could look at at raw non-rendered HTML and it would be so simple that you can render it in your head. With the advent of more sophisticated web frameworks like the one mentioned, that’s no longer the case. The site consists of MBs of scripts and templates that take a gigawatt to render.

+1 on the bloat, though i would primarily blame sloppy code and cheap fast pipes. On complicated scripts taking a gigawatt to render, I would like to point out that in the good old days that was all happening too — just not in your browser. Inefficient PHP and CGI scripts, massive Java frameworks. Today, still the majority of complexity and heavy lifting is kept away from our browsers. It's sobering to think that mos…

I think that for most businesses, their sites could be statically generated, with iframes and embed tags for interactive parts like forms, and the web would become much faster, more pleasant to use, and have a notably lower carbon footprint. Making images smaller by default would help too.

For interactive sites, if videos were limited to 480p on mobile and 720p on desktop unless manually changed, I imagine the carbon impact of data centers would drop considerably. For content viewed on TVs (where you usually sit quite a bit farther back than a monitor), such as Netflix or Hulu, I think they could set it to 480p by default and a lot of people would never bother to change it.

Unfortunately actually calculating the carbon footprint of a bloated web (compared to a lite version) would be very difficult. As you mention, a lot of that bloat is on the backend. New Reddit may transfer 6x more resources over the network than Old Reddit, but both of them have to process on the back-end what links should even be shown for a given user, so I doubt switching to Old Reddit would result in 6x fewer emissions. But even if it only resulted in 2x fewer emissions, that'd still be a considerable improvement. Part of the investigation would require seeing how much energy is used by the data centers processing what to send, versus how much energy is used by ISPs transferring that data across networks to the end-users.

In any case, if sites were more like Hacker News, Craigslist, and Wikipedia, versus New Reddit, Amazon, and most news sites, I feel confident that the carbon footprint of the Internet would go down notably. HN and Craigslist's designs are going to be hard sell for most businesses, but something like Wikipedia proves you can have an attractive design with low page sizes. And in the case for newspapers, it'd be nice if their web versions were more similar to their paper versions. That is tough with a free + ads model, but honestly I'm more likely to see an ad if the whole site is just text and there's a text ad in the middle of it (hopefully properly identified as such, though.)

Re: Kristall – a browser without support for CSS/JS/WASM or graphical websites

#189

Post by mdaniel »

phpnode wrote: post #147
kgbcia wrote: post #91

I'm a fan of Lynx. React and angular have destroyed the semantic web.

There has never been a semantic web

"Never" is a tiny bit harsh, IMHO; arguably, there have been several of them they just (evidently?) don't offer content producers as much value as it offers to consumers (which includes search engines), and thus the incentives play out in exactly that way

* JSON-LD markup exists in plenty of modern sites

* schema.org markup exists in some

* microformats.org briefly raised its head

The BBC website is the biggest example I know of which has a lot of semantic markup/annotations. IIRC they used to actually have RDF attributes in a lot of the BBC Radio listings

Post reply on HN