Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 85 cracks down on supercookies

blog.mozilla.org

Post reply on HN
Print view View original

761–770 of 786 posts

Re: Firefox 85 cracks down on supercookies

#761

Post by patates »

etripe wrote: post #756
egeozcan wrote: post #708

Earlier quoted context omitted.

JS is indeed what brought us all the speed in software development. People could prototype their ideas crazy fast, and they still can. Scripting in browser had an immense positive impact on software industry, and that DID come with many negatives, but you always have the option to completely turn it off if those bother you. A sandboxed environment was a huge idea and the browser has been the primary example of how gr…

Prototyping fast does not guarantee shipping robust software fast, which is in part why the JS ecosystem has been having problems. To apply the common construction analogy to JavaScript: no one would call a quick sketch on a napkin a valid blueprint for a building.

> (...) JS ecosystem has been having problems

what problems? Yeah, stuff like left-pad happened with NPM, but that has nothing to do with sandboxed scripting in browser. Also within my already-depressingly-long career, I had more problems with deploying "robust" .NET desktop apps (WPF & Forms) and even Qt based supposedly "cross-platform" apps than web apps. Web is the most robust platform I've ever worked with, and that's by a huge margin.

JS as a language has problems[1] but the idea behind it proved itself to be great.

[1]: and with the latest additions it's one of the better programming languages to work with, although the standard library sucks (or more like, nearly non-existent). But that's totally another topic.

Re: Firefox 85 cracks down on supercookies

#762

Post by GoblinSlayer »

windowojji wrote: post #667
nofunsir wrote: post #611

Earlier quoted context omitted.

I agree with simias. What does JS have to do with my VPN? What was wrong with Skype? Still beats the pants off others for quality. I cannot think of much good agressive whitespace, hamburger menus, infinite scrolling, HID hijacking, copy-paste preventing, trackers etc, etc etc, has brought us, besides into the world of Aggressive Ad Arbitrage. Need https://motherfuckingwebsite.com/ be mentioned? The real powerhouse w…

I like that the website you linked still has Google Analytics JS embedded.

It's states what it gets right: it's lightweight, accessible, compatible, responsive, legible and it works.

Re: Firefox 85 cracks down on supercookies

#763

Post by CogitoCogito »

Daho0n wrote: post #717
CogitoCogito wrote: post #604

Earlier quoted context omitted.

You are aware there are country-specific (or even more local) regulations covering companies today right? In fact essentially all regulations are. So why are you acting like my proposition is somehow unprecedented?

Because this is about websites, not companies. I'm not a company. Do my website use a different regulated subset of JavaScript than yours? If it is a company do they follow local rules or local for the hosting company? What about sites that incorporate sources from different locations? Do JavaScript library developers now have to create a version of their script for each countries regulation? Then the US regulation w…

I'm kind of confused here. Websites have to do everything you're saying today already. There are already different rules regarding data privacy, protected speech, etc. in different countries. How you choose to fulfill those obligations is up to you. But yes if your point is that it requires work to follow various different regulations, then of course you're correct. In fact, that's the whole point. The regulations are there to change your behavior in the market in question. We've had regulations across varying markets since pretty much time immemorial.

Re: Firefox 85 cracks down on supercookies

#764

Post by mikem170 »

nunez wrote: post #646
mikem170 wrote: post #588

Earlier quoted context omitted.

I browse in firefox with javascript turned off, in ublock, with a bunch of other restrictions [0], and temporary containers. I make exceptions for a couple dozen sites, like my bank, open street maps, etc. Youtube is my only soft spot here, the rest of google I keep blocked. I can make one-off exceptions to read a tab in front of me, but that's not routine, it's not hard to find sites that support this. [0] https://g…

How do you use the internet with JS turned off? Every time I try doing this, I undo it five seconds later because of so many sites breaking instantly. (I sometimes browse the web with w3m; sites blocking you because of no JS happens often)

I can usually find alternatives that works without javascript. Or I find sources outside of the big tracking companies, like openstreetmaps instead of google maps, etc.

I'm not a promiscuous browser, if I click on an interesting link and I get an empty page because it insists on javascript I close that tab and figure I saved myself from wasting my time on a crappy ad-tracking-infested website, so many of which are lame anyways.

That being said I do sometimes enable javascript temporarily on sites when I am desperately looking for some specific bit of info, then I reset back to my default-off when finished.

I've been doing this for a couple/few years, and it doesn't seem like a big deal to me. I'm happy to have that reminder that a site is irritating me insisting on javascript for no good reason, more often I go elsewhere and that suits me fine. It saves me from having to worry about so many nefarious things that go on in this space.

Why not give it a try? Ublock lets you default disable all javascript and enable it on the page you are looking at with a couple clicks, and edit/revert your list of rules whenever you want. You might be pleasantly surprised at how few times you need to fiddle with it after you set it up for your important sites.

Re: Firefox 85 cracks down on supercookies

#765

Post by tremon »

scott_w wrote: post #750
simias wrote: post #422

Earlier quoted context omitted.

Note that the root of all evil here is Javascript being opt-out instead of opt-in (and effectively mandatory for a big chunk of the internet these days). Letting any website and their friends (and the friends of their friends) run turing complete code on the client PC probably sounded reasonable when the web was created but it seems incredibly naive in hindsight. It's not as bad as ActiveX and other plugins, but it's…

Firefox explicitly talks about abusing IMAGE caches and you’re waffling about JS. The two things are not related here so stop trying to conflate them.

The image caches offer no means to identify individual users unless you're able to re-parse the client side (cached) data. Guess what component is essential to perform that client-side parsing?

Re: Firefox 85 cracks down on supercookies

#766

Post by eeZah7Ux »

throwaway525142 wrote: post #632
eeZah7Ux wrote: post #624

Earlier quoted context omitted.

...and with zero accountability. Any website can push 10MB of obfuscated, debugger-resistant, code on your computer. Obfuscated to resist ad-blockers and anti-tracking features.

asm.js was a thing before WebAssembly, with the same downsides, except maybe a little less browser support for debugging, inspecting, etc. asm.js was able to exist without browser support in Chrome, so WebAssembly support doesn't really bring anything new to the table. At least that's how I understand it, care to give ideas why it's not a positive change? :)

> care to give ideas why it's not a positive change?

What I wrote above: it's going to encourages 10x more bloated and obfuscated websites.

Apart from the security and privacy issues, it will make the web even less accessible to users with slower Internet connections (some 2bln people) and visually-impaired users.

Re: Firefox 85 cracks down on supercookies

#767

Post by CydeWeys »

danielheath wrote: post #605
CydeWeys wrote: post #595

> In fact, there are many different caches trackers can abuse to build supercookies. Firefox 85 partitions all of the following caches by the top-level site being visited: HTTP cache, image cache, favicon cache, __HSTS cache__, OCSP cache, style sheet cache, font cache, DNS cache, HTTP Authentication cache, Alt-Svc cache, and TLS certificate cache. (emphasis mine) This has negative effects on security, as has been po…

Aren't most CDNs (at least, the ones likely to have popular resources on several sites) using the hsts preload list already?

Not all CDNs are HSTS preloaded, and this affects linking too. Pick any random popular site that is widely linked but not preloaded, and now it's more vulnerable.

Re: Firefox 85 cracks down on supercookies

#768

Post by scott_w »

dahfizz wrote: post #759
scott_w wrote: post #751

Earlier quoted context omitted.

Your language interpreter comes built-in with your computer

So "Download pycharm" is enough of a barrier that it creates a "universe of difference"? I find that hard to believe.

Yes, it is. You’re missing the step beforehand which is “know that you can download PyCharm.”

Re: Firefox 85 cracks down on supercookies

#769

Post by scott_w »

tremon wrote: post #765
scott_w wrote: post #750

Earlier quoted context omitted.

Firefox explicitly talks about abusing IMAGE caches and you’re waffling about JS. The two things are not related here so stop trying to conflate them.

The image caches offer no means to identify individual users unless you're able to re-parse the client side (cached) data. Guess what component is essential to perform that client-side parsing?

So tracking pixels in email clients aren’t a thing? Trust me, people will find ways around it without JS. Reinventing Flash, for a start.

Re: Firefox 85 cracks down on supercookies

#770

Post by scrollaway »

opensmtpd wrote: post #687
scrollaway wrote: post #586

Earlier quoted context omitted.

> it seems incredibly naive in hindsight Oh stop with the dramatics, please. JS has brought us an immense amount of innovation on the web. It has lowered the barrier of entry to programming and introduced tens of millions of people to the world of development. If you're on HN the odds are that directly or indirectly, JS is one of the reasons you have a job today, and that you can execute it remotely. And today specif…

JS brought both problems and benefits. The fact that it brought benefits doesn't prove that it didn't bring problems. I think we could have done better if we knew what we were doing.

This is just such a weird centrist point to make. Is there any substance to what you're saying other than "there's good and bad in everything"?
Post reply on HN