231–240 of 254 posts
Earlier quoted context omitted.
Wow, thanks. Somehow I missed that. Things move so fast.
Google forked WebKit (itself a fork of KDE Konqueror's KHTML). Blink is from 2013. [1] I wonder how source incompatible these are? Is it difficult to backport? Because KHTML was LGPL the source must remain available. Or is it just that these are API incompatible? https://en.m.wikipedia.org/wiki/Blink_(browser_engine)
I only with that with the advent of all these different anti-tracking movements, that there was a clear, documented way for "good faith actors" that require technology like localstorage. We've worked really hard to implement a embedded experience via an iframe, but it's becoming increasingly difficult for our software to walk on egg shells as to not trigger it being labelled as a tracker (as it is definitely not, we…
Earlier quoted context omitted.
Also, a tracking service could just ask to be CNAMEd to a random subdomain and become everybody’s “first party”, couldn’t it?
It could, but access through these various CNAMEs would not give it stateful cross-site tracking ability, since each would be a different Origin. It would be providing a hosted first-party analytics/ads/whatever service within the storage space of the first party.
Earlier quoted context omitted.
Yes, competing with Google is still a main challenge. Still, Apple seems to be managing by providing the browser for free as a value-add when you buy their hardware, and by preventing other browser engines from running on iOS. Mozilla's financial dependence on Google is still a major challenge, which they'll hopefully be able to fix before push comes to shove. Microsoft unfortunately did not seem to be able to financ…
When MS prevented other browsers from working well in Windows it was slapped with antitrust. Why is it ok when Apple does it? Is it because macos and ios don't have the same level of os monopoly that MS had back then?
A first party is a website that a user is intentionally and knowingly visiting, as displayed by the URL field of the browser, and the set of resources on the web operated by the same organization. In practice, we consider resources to belong to the same party if they are part of the same registrable domain: a public suffix plus one additional label. Example: site.example, www.site.example, and s.u.b.site.example are…
One conversation-starter folks are discussing is https://github.com/mikewest/first-party-sets
Strange for a page espousing anti-tracking [0] to load media in from apple.com. Granted Mozilla's page [1] is even a worse offender with google-analytics and newrelic embeds. Really makes you think what really drives the underlying narrative for such initiatives at corporates if not sabotaging competitors? OpenDNS founder, u/davidu, pointed out that DNS over HTTPS, something that takes aim at trackers and advocates p…
#ThanksQt
Related to the way they classify between first party and third party (based on domain names, with its subdomain being the same party), the Public Suffix list [1] is a resource of great value. It allows to know when subdomains actually refers to different parties (e.g., xxx.github.io is neither the same party as yyy.github.io nor as github.io). [1] https://publicsuffix.org/
I found .co.de, (co|com).cc, and .pro.aw missing after a minute of searching. Going to try to find more after work. Instead of having a nice free lunch break now I have to email some people...
Earlier quoted context omitted.
What about the IP address and the other information that leaks at network levels that are lower in the stack than what the browser controls?
Many people are behind NATs and so share IPs. This can be millions of people; see Wikipedia's documentation on IP banning: https://en.wikipedia.org/wiki/Wikipedia:Blocking_IP_addresse... What are you thinking other than IPs? Everything else should be under the browser's control.
Also, there are also many people that are not behind a NAT. I've always had a public IP address at home, for example. Plus NAT may become less used because insert rant about NAT and IPv6.
Anyway, it's good that browsers make all they can to ensure privacy :).
Strange for a page espousing anti-tracking [0] to load media in from apple.com. Granted Mozilla's page [1] is even a worse offender with google-analytics and newrelic embeds. Really makes you think what really drives the underlying narrative for such initiatives at corporates if not sabotaging competitors? OpenDNS founder, u/davidu, pointed out that DNS over HTTPS, something that takes aim at trackers and advocates p…
Safari with ITP enabled blocks cookies on those font-related resources. But because of other browsers, it's not very nice to send cookies on those resources in the first place.
I'd wish Apple encouraged a secure plugin based ecosystem to flourish in the AppStore, so that folks could write content blockers that block apps from doing as they please [0]. I understand the security implications (for healthcare and financial apps, for instance) and the ability to get this right in face of spyware but in my own naïve way I feel this a decisive way to signal the intent that Apple is a privacy-first company.
[0] With VPNs a lot of content can be blocked already, but that's at the network level. It'd be great to have something at the runtime level, like WebKit here is trying to do.