Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is Stack Overflow trying to start audio?

meta.stackoverflow.com

Post reply on HN
Print view View original

381–390 of 416 posts

Re: Why is Stack Overflow trying to start audio?

#381

Post by cameronbrown »

z3t4 wrote: post #335
cameronbrown wrote: post #215

Earlier quoted context omitted.

> $1 per 100 page views Eh, that's like 10x average CPM nowadays. And advertisers usually are paying per click, not impression.

As an advertiser, yes, but on Google Ads you know that 90% of those will be fake ¹. And as a publisher on Google Ads you only get something like 1$ per 10000 impression ². Advertising directly on SO you know all views are not only legit, but also target at developers, so I think advertisers are willing to pay more. While most advertisers are paying per click, the whales only care about impressions, not clicks (TV com…

Is such a high fake impression rate common on the display network?

Re: Why is Stack Overflow trying to start audio?

#382

Post by [deleted] »

wlesieutre wrote: post #175
coldpie wrote: post #86

Earlier quoted context omitted.

Why are you allowing arbitrary javascript to be served to your users?

Not just arbitrary JavaScript, arbitrary JavaScript where they can’t easily even see where it came from! Sheesh. Could we require advertisers to sign their ad code to have a trail of where it came from, prevent tampering, and make it easier to pull the plug on bad actors? The people bearing the costs of the internet ad economy aren’t the people in any position to do anything about it. So there’s very little pressure…

[deleted]

Re: Why is Stack Overflow trying to start audio?

#383

Post by tinus_hn »

londons_explore wrote: post #373
dTal wrote: post #361

Earlier quoted context omitted.

>It's amazing to me that an advert can run arbitrary javascript at all. I'm not fully up to date with how these things are usually set up - is there anything in the web security model that prevents "ads" from exfiltrating arbitrary information from any page that they're on? Could an ad read my keystrokes, or scrape private messages?

Ads are iframed, and don't have permissions to do anything to the host page. Doesn't stop them fingerprinting the browser though

Typically ads are not in iframes, they are loaded by Javascript from the ad network and can do whatever they want.

Re: Why is Stack Overflow trying to start audio?

#384

Post by smilliken »

tinus_hn wrote: post #383
londons_explore wrote: post #373

Earlier quoted context omitted.

Ads are iframed, and don't have permissions to do anything to the host page. Doesn't stop them fingerprinting the browser though

Typically ads are not in iframes, they are loaded by Javascript from the ad network and can do whatever they want.

There's multiple nested iframes and scripts loaded at every level. All variations are possible.

Re: Why is Stack Overflow trying to start audio?

#385

Post by DCoder »

islon wrote: post #367
DCoder wrote: post #280

Earlier quoted context omitted.

When you say "it's not allowed", do you trust its own settings? Are you sure it's not doing something like [0]? How do you even protect against that? [0]: https://www.reddit.com/r/privacy/comments/bpr6xs/if_you_choo...

My wifi router has an interface that shows every connected device and I can blacklist them based on their physical address.

In the post I linked to, the TV in a similar situation was happily connecting to someone else's (open) WiFi network nearby. You can't really block those…

Re: Why is Stack Overflow trying to start audio?

#386

Post by tinus_hn »

smilliken wrote: post #384
tinus_hn wrote: post #383

Earlier quoted context omitted.

Typically ads are not in iframes, they are loaded by Javascript from the ad network and can do whatever they want.

There's multiple nested iframes and scripts loaded at every level. All variations are possible.

Sure, but obviously it’s more valuable if you give the ad access to your DOM so it can ‘optimize the ad placement’.

Re: Why is Stack Overflow trying to start audio?

#387

Post by yellowapple »

danShumway wrote: post #272
yellowapple wrote: post #208

Earlier quoted context omitted.

> You can't build apps without turing complete code. Sure you can. None of these things should require me to run your arbitrary Turing-complete code in my browser: * Reading an article * Writing an article * Shopping online * Searching for things online * Reading social media posts/comments * Submitting social media posts/comments * Browsing a code repo * Submitting issues / PRs / etc. to a code repo * Reading docume…

> Good. That's the direction the mobile world has already been going for a decade now. I genuinely don't understand this argument at all -- either you understand something about native platforms that I don't, or you're working under the assumption that all of your native apps: a) aren't already vacuuming your data at the same rate as web apps. b) wouldn't get considerably worse if they replaced the web ecosystem. On…

> There's some promising stuff happening (notably with MacOS and with Flatpak/Wayland) but it's all just playing catch-up to where the web was years ago.

And in the proposed 10 years being discussed here, there's no reason to believe locally-installed applications won't have exceeded browser sandboxing capabilities, let alone caught up.

Meanwhile, the web sandbox is actively deteriorating specifically because frontend developers want to do the things locally-installed applications can do.

> Nobody should be installing Facebook, Twitter, or Reddit on their phone.

Not at the current state of native app deployment, no, but that's improving rapidly and substantially, especially in the mobile space. Also: the vast majority of users are doing that anyway, so it's worth investing the time and energy into being able to sandbox apps without needing an entire HTML + CSS + JS engine/stack to do it (and indeed, both Google and Apple have made significant strides on that front in the last 10 years, though there's certainly still room for improvement).

> The unfortunate, horrible problem, is that running code we don't trust is gonna be necessary, no matter what world we move to.

Yes, but at least with a locally-installed app, I'm explicitly opting into that app existing and running on my device. This on its own will at least somewhat cut down on the amount of untrustworthy code running on my system.

Yes, I can do the same thing for a website's JS code (and indeed do so), but it's asinine that I need Javascript enabled to read a blog post or post to social media or do the myriad number of other things that are theoretically and practically possible with server-side processing exclusively.

> Of course integration and app performance suffers on the web. But frankly, neither of those are more important than sandboxing.

No, but sandboxing - again - is a problem that can (and almost certainly will) be solved within the next decade, at which point integration and performance benefits will make local app installation even more attractive than it already is.

Re: Why is Stack Overflow trying to start audio?

#388

Post by bongobongo »

scarface74 wrote: post #377
bongobongo wrote: post #329

Earlier quoted context omitted.

The unique combination of arrogance and ignorance on HN grates on me, too. And a lot of it is motivated by what you suggest, which is the high compensation of techies relative to other knowledge workers—it makes them think they are inherently special rather than just temporarily overvalued. That being said, techies—unlike admen—are still builders and the people who build the shit will always ultimately have the clout…

Software developers have been paid better than the average “knowledge worker” for at least the two plus decades that I’ve been doing it. I don’t just mean Silicon Valley/West Coast.

I’m not sure that’s true. Devs do well but not necessarily better than nurses, doctors, and engineers.

The big gap is in licensure and education. You can get a high paying job in tech starting with a GED if you play your cards right. That is because demand is so high, and the field has zero professional standards (in the sense of an actual profession with an actual organizing body, like nursing or medicine or engineering, etc.). The latter part is important. There may be lots of demand for nursing, etc., but real professional organizations do not lower their standards in order to accommodate demand.

Two things will happen this century. First, there will be many, many more people who know how to build basic systems (Web applications, etc.). Second, people will have a much better understanding of the risks involved in software development, which are now still mostly abstract to the public (but this is already changing). Once those risks become apparent, there will be an attendant demand for actual professionalization (standards bodies, licenses, codes of ethics, etc.). There will be greater regulation and classification of software development as a profession (i.e., you might not need a license for some kinds of work, but for other kinds, you will have strict licensing). This will drive up the compensation of (credentialed) developers to the level of doctors and engineers, but will also create many more barriers to entry in the process.

Re: Why is Stack Overflow trying to start audio?

#389

Post by laughinghan »

danShumway wrote: post #272
yellowapple wrote: post #208

Earlier quoted context omitted.

> You can't build apps without turing complete code. Sure you can. None of these things should require me to run your arbitrary Turing-complete code in my browser: * Reading an article * Writing an article * Shopping online * Searching for things online * Reading social media posts/comments * Submitting social media posts/comments * Browsing a code repo * Submitting issues / PRs / etc. to a code repo * Reading docume…

> Good. That's the direction the mobile world has already been going for a decade now. I genuinely don't understand this argument at all -- either you understand something about native platforms that I don't, or you're working under the assumption that all of your native apps: a) aren't already vacuuming your data at the same rate as web apps. b) wouldn't get considerably worse if they replaced the web ecosystem. On…

I think there's a bigger point you're missing.

> almost universally, the web version is safer to use. Nobody should be installing Facebook, Twitter, or Reddit on their phone.

Not only is this true, this would be even more true without JavaScript—if those sites were still usable, which they definitely could be, they just choose not to be. (Well, maybe except Facebook Live, but that could be an optional standalone app.)

> you can already do that on the web today. You can already turn off Javascript.

Of course, this isn't really true, precisely because so many websites that could function fine without JS (including things like news sites that should just be static content!) instead choose not to.

Which of course is the real problem with yellowapple's idea. Lots of services cripple their mobile website and push you to install their app instead; if we removed JS from the Web, everyone who could would just start doing the same on desktop too, right? Upstarts trying to maximize growth probably will work great on the Web, but as they get more established they'll start pushing people more and more towards their native apps, and existing established players will do that from Day 1 (of the new, JS-less world), including everyone mentioned so far—Facebook, Twitter, Reddit, GitHub, major news sites, because people will deal with the one-time friction of installing the app in order to access the network or content.

Re: Why is Stack Overflow trying to start audio?

#390

Post by laughinghan »

yellowapple wrote: post #387
danShumway wrote: post #272

Earlier quoted context omitted.

> Good. That's the direction the mobile world has already been going for a decade now. I genuinely don't understand this argument at all -- either you understand something about native platforms that I don't, or you're working under the assumption that all of your native apps: a) aren't already vacuuming your data at the same rate as web apps. b) wouldn't get considerably worse if they replaced the web ecosystem. On…

> There's some promising stuff happening (notably with MacOS and with Flatpak/Wayland) but it's all just playing catch-up to where the web was years ago. And in the proposed 10 years being discussed here, there's no reason to believe locally-installed applications won't have exceeded browser sandboxing capabilities, let alone caught up. Meanwhile, the web sandbox is actively deteriorating specifically because fronten…

> there's no reason to believe locally-installed applications won't have exceeded browser sandboxing capabilities

What? Sure there is!

1. The reason to believe native apps' sandboxing won't exceed the browser is that any sandboxing that works on native apps would also work on the browser app itself.

2. There's also 2 reasons to believe native apps' sandboxing may always be inferior to the browser:

(a) The Web has wider reach, and people are already more confident/careless visiting strange websites than downloading and running strange apps, so exploits targeting the Web are more valuable and therefore more resources are spent battle-testing it.

(b) Native apps currently have deeper access to the device which makes it easier for them to do bad things, and (similar to reason 1) will never have less access to the device than the browser app which is also an app.

(I'm aware there's arguably a slight exception here about Mobile Safari and W^X, but I don't think that disproves the overarching reasoning.)

Post reply on HN