71–80 of 191 posts
The message is OK, but personally I have an issue with websites playing sound without my consent.
This is such a typical HN comment. The sound and automatic start of disk filling (before the mods changed the link) was intentional and meant to be surprising.
Finally a good non-ideological reason to use Firefox :)
So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
There really isn't an easy way to avoid this problem even if you follow the standard fixed quota per domain and subdomains don't count policy. You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. In the end, the problem is that one page can itself infer to other domain / subdomains in its document and those can execute and utilize localstorage. They have to, though, so you ca…
Thankfully, in this case, domain registrations are expensive. Filling a 16 GB iPad with this technique would cost around $10,000 in registrar fees. A 128 GB SSD could be filled for under $100,000.
...So I wanted to come in here and say "cost prohibitive!" but... maybe not, given that most devices will be at least partially filled already.
FYI, if you're on IE10, hitting the Stop button seems to throw a local storage exception and doesn't clear the space.
Author here. It works for me. I test on IE10 on Windows 8.
[Edit: perf is very back and forth. Slow, then fast, then slow again. It does work though.]
So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
Beyond that, just provide a good (simple) UI for deleting stuff. Which could suggest candidates for deletion based on heuristics like you suggest. E.g. iframes shouldn't need so much. Hopefully less visited sites would be suggested for deletion too.
"Allow example.com to track your location?" [Yes] [No]
"Allow a1.example.com to store x MB of data locally?" [Yes] [No]
Also
> The HTML5 Web Storage standard was developed to allow sites to store larger amounts of data (like 5-10 MB) than was previously allowed by cookies (like 4KB).
Main difference is that cookies are uploaded to the server with each request, while localStorage is not.
So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
Limit the total local storage space at a browser level. E.g. 1GB. Just like you might limit the total size of temporary internet files/cache. Beyond that, just provide a good (simple) UI for deleting stuff. Which could suggest candidates for deletion based on heuristics like you suggest. E.g. iframes shouldn't need so much. Hopefully less visited sites would be suggested for deletion too.
I wouldn't mind Google Maps to fill some 100 GiB with map data so that I can have detailed maps while I am offline in some remote African town.
So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
There really isn't an easy way to avoid this problem even if you follow the standard fixed quota per domain and subdomains don't count policy. You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. In the end, the problem is that one page can itself infer to other domain / subdomains in its document and those can execute and utilize localstorage. They have to, though, so you ca…
Once they hit that point, show a prompt below the toolbar that shows how much data is being used by the whole domain, in real time and allow it to keep on filling up with data until the user says stop or always allow.
Earlier quoted context omitted.
There really isn't an easy way to avoid this problem even if you follow the standard fixed quota per domain and subdomains don't count policy. You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. In the end, the problem is that one page can itself infer to other domain / subdomains in its document and those can execute and utilize localstorage. They have to, though, so you ca…
> You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. Thankfully, in this case, domain registrations are expensive. Filling a 16 GB iPad with this technique would cost around $10,000 in registrar fees. A 128 GB SSD could be filled for under $100,000. ...So I wanted to come in here and say "cost prohibitive!" but... maybe not, given that most devices will be at least partiall…
Just ask the user if its okay, like with geo data, translate web site, etc. "Allow example.com to track your location?" [Yes] [No] "Allow a1.example.com to store x MB of data locally?" [Yes] [No] Also > The HTML5 Web Storage standard was developed to allow sites to store larger amounts of data (like 5-10 MB) than was previously allowed by cookies (like 4KB). Main difference is that cookies are uploaded to the server…
It would be better to have sane and safe defaults in the browser, rather than pester the user. Would cookies have worked if the browser asked for permission on every website?