31–40 of 99 posts
This can in cases where the names follow a known pattern be used to infer domains of other websites in the session and, in the case of YouTube, your Google id which can be used to identify your Google account.
The vulnerability doesn't leak all your browsing history. It leaks a small part of it
edit: title is changed now
What the web needs is fewer APIs.
What we need are companies working on browsers that actually care about the web. Apple have demonstrated time and time again that they don't, because they favor native applications on iOS and macOS over anything web, so we end up with subpar browsers who ship with the OSes. In some cases (iOS), we even end up with a browser-monopoly where no other browser is even welcome.
I genuinely can’t name a native application released for macOS built with AppKit or SwiftUI or whatever that didn’t come from Apple.
Earlier quoted context omitted.
It would seem I’m not alone in thinking that many web features are too implicit. “Dialog fatigue” or “ok-click syndrome” are real problems, but for many features I think the correct behavior is probably not a silent grant. Anything that consumes the user’s resources after navigating away from the page should probably require direct user consent in some form or another.
Yep... look at just the cookie prompts,.. they suck, the users just click "agree", and if they want to disagree, they have to invest sometimes literal minutes, to unheck all the cookie providers. The default should be always to delete everything after a website/tab is closed. Want to store a login? Set up a button next to the url bar to enable persistant storage for that specific webpage, and you're done.
It's very interesting seeing exploits like this from this organization. On one hand their service fingerprints users and offers extended metadata like whether the user is in incognito via sketchy web apis. On the other hand they report (and help close) some gnarly exploits like this via sketchy web apis. What do you all make of this? It's hard to not see it as some weird "were not doing a bad thing" gaslighting (perh…
What if clients use it for tracking and other shady purposes, would they do something about it?
Btw I tried with Tor Browser and it did not accurately fingerprint it between sessions which makes me wonder how effective it really is. Especially for fraudsters; intentional bad actors, I think it would be quite easy to bypass.
The IndexedDB API in Safari has been buggy and unstable for a very long time.
It pretty clear that Apple isn’t giving Safari/WebKit the focus it needs, but it’s also clear that developers just continue to push for more and more features in the browser. I’d much prefer that browsers started to cut back. While Google is excellent about updates, remember that critical bugs are found in Chrome constantly.
It's very interesting seeing exploits like this from this organization. On one hand their service fingerprints users and offers extended metadata like whether the user is in incognito via sketchy web apis. On the other hand they report (and help close) some gnarly exploits like this via sketchy web apis. What do you all make of this? It's hard to not see it as some weird "were not doing a bad thing" gaslighting (perh…
Or ones they are not planning to use anyway, but are possible to be used by competition?
Or for marketing purposes to be not known as 100% clearly evil?
Or for marketing purposes to be better known?
Earlier quoted context omitted.
What we need is the web to stop coalescing ever more tightly around Google. Apple's iOS browser monopoly is literally the only thing preventing Google from having a near total monopoly on web standards.
Microsoft has to have wrestled some power away with Edge. They have a seat at the table.
Safari 14 had this nasty IndexedDB bug last year: https://bugs.webkit.org/show_bug.cgi?id=226547 and I had to add https://github.com/jakearchibald/safari-14-idb-fix to all my sites using IndexedDB. Now this. Why the hell are they messing with IndexedDB? Last IDB shitstorm was discussed at https://news.ycombinator.com/item?id=27509206 .
Apple just doesn't care about IDB or the web.
Earlier quoted context omitted.
It would seem I’m not alone in thinking that many web features are too implicit. “Dialog fatigue” or “ok-click syndrome” are real problems, but for many features I think the correct behavior is probably not a silent grant. Anything that consumes the user’s resources after navigating away from the page should probably require direct user consent in some form or another.
Yep... look at just the cookie prompts,.. they suck, the users just click "agree", and if they want to disagree, they have to invest sometimes literal minutes, to unheck all the cookie providers. The default should be always to delete everything after a website/tab is closed. Want to store a login? Set up a button next to the url bar to enable persistant storage for that specific webpage, and you're done.
Is Apple’s culture of secrecy that strong? Is it a sense of superiority? Is it embarrassment? Are they just not here?
As a mid-career engineer with highly marketable skills and an inbox stuffed with job offers the only two companies I would never entertain an offer from are Facebook and Apple.
Facebook because their fundamental purpose for existence is harmful to society and Apple for their perceived (or actual?) engineering incompetence.
I don’t really have a sense for the kind of engineer that works for Apple. With other big tech orgs I have some sense, even if informed almost entirely by tech forums.