Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites have a new way to spy on visitors: analyzing their SSD activity

arstechnica.com

Post reply on HN
Print view View original

81–90 of 97 posts

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#81

Post by cinntaile »

runako wrote: post #65
cinntaile wrote: post #42

Earlier quoted context omitted.

There's a whole trend with websites not uploading anything to their servers due to privacy and whatnot, where do you suppose the data is being saved for repeat visits...

What your'e describing I would expect to be measured in kilobytes, not tens of gigabytes. There is no reason for any person to think that a website needs to store data sized in the "full Ubuntu install" range to facilitate repeat visits.

You make a reasonable point, while kilobytes might be too little it probably shouldn't be 30gb. 5gb might be ok. In the settings it should be possible for the user to set their own limit. I am not familiar with browser storage but there is hopefully a mechanism to inform the user that their limit might not be enough.

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#82

Post by MisterTea »

VMG wrote: post #64
rayiner wrote: post #61

Earlier quoted context omitted.

Now that we have AI, can we go back to real apps and native tech stacks? And revert the browser to a text-display interface?

Unfortunately, real apps and native tech stacks can not only write data to your SSD, they can usually write data to the user directory however they want and they can read it as well! Browsers are at least somewhat sandboxed

Why not sandbox the process then?

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#84

Post by rayiner »

freedomben wrote: post #69
rayiner wrote: post #61

Earlier quoted context omitted.

Now that we have AI, can we go back to real apps and native tech stacks? And revert the browser to a text-display interface?

> can we go back to real apps and native tech stacks Please God, no. If you're worried about the invasiveness of browser-based apps, native is out of the frying pan and into the fire

Except you’re not going to install native apps for the vast majority of things you use a browser for. You’re going to use the browser for content consumption and native apps for a few things that need system access.

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#85

Post by VMG »

MisterTea wrote: post #82
VMG wrote: post #64

Earlier quoted context omitted.

Unfortunately, real apps and native tech stacks can not only write data to your SSD, they can usually write data to the user directory however they want and they can read it as well! Browsers are at least somewhat sandboxed

Why not sandbox the process then?

I don't know, maybe something about backwards compatibility, maybe nobody can agree on how to do it correctly. It hasn't happened for decades, so I'm not going to hold my breath.

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#87

Post by runako »

Rohansi wrote: post #70
runako wrote: post #65

Earlier quoted context omitted.

What your'e describing I would expect to be measured in kilobytes, not tens of gigabytes. There is no reason for any person to think that a website needs to store data sized in the "full Ubuntu install" range to facilitate repeat visits.

> There is no reason for any person to think that a website needs to store data sized in the "full Ubuntu install" range to facilitate repeat visits. Do you think people expect that for apps they've installed? Should those also be limited to a few MB?

I think that when I install an app, typically it will tell me up front how much disk space is required. For example, in the Mac App Store, the size of the app is at the top of the page.

> Should those also be limited to a few MB?

I also want to highlight that many/most websites that think of themselves as apps are at odds with their users in that perception. As an engineer, I know full well that e.g. the URL https://homedepot.com is powered by a sophisticated set of apps. But most users think it's a website.

This is important because people do & should have a different relationship with software they have chosen to install on their machines and websites. Yes, I know e.g. Figma.com does complex client-side stuff. Every Figma user would click a dialog to grant permission for it to do what it needs to do.

The problem is the current state of the art is that literally any website can spam up your disk and you don't even know. If I visit the website for a local radio station, or an e-commerce site, or university, or a site that will tell me what time it is now in a different time zone...I do not expect that it will download tons of data and store it on my disk in case I come back. That some engineers think that is reasonable is why the browser sandboxes need reinforcement.

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#88

Post by Rohansi »

runako wrote: post #87
Rohansi wrote: post #70

Earlier quoted context omitted.

> There is no reason for any person to think that a website needs to store data sized in the "full Ubuntu install" range to facilitate repeat visits. Do you think people expect that for apps they've installed? Should those also be limited to a few MB?

I think that when I install an app, typically it will tell me up front how much disk space is required. For example, in the Mac App Store, the size of the app is at the top of the page. > Should those also be limited to a few MB? I also want to highlight that many/most websites that think of themselves as apps are at odds with their users in that perception. As an engineer, I know full well that e.g. the URL https://…

> But most users think it's a website.

I'd be willing to bet most (younger?) users don't know what the difference between an app and a website is. Can't really blame them when the line between them has been blurring more and more over time. I think a growing number of users wouldn't even mention installing as a differentiator because you install PWAs (except on iOS).

Anyway, I think an important bit of information that was lost here is that browsers automatically purge data so that your disk doesn't fill up. If you're running low on space it will clean it up for you to make room.

> I do not expect that it will download tons of data and store it on my disk in case I come back. That some engineers think that is reasonable is why the browser sandboxes need reinforcement.

It's a reasonable thing to do for an app, so why not a website/PWA? Video games are a pretty good example where some stream assets while you are playing so that you don't have long install/update times. Getting in game faster is more important.

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#89

Post by lxgr »

rayiner wrote: post #61
noirscape wrote: post #45

Earlier quoted context omitted.

Browsers have an absolute insane level of relatively unchecked permissions to do whatever they want on a client. There's a lot of effort by browser developers to scope creep the browser into essentially being an OS-agnostic tech stack (one where, conveniently, code can be shipped across the network "as necessary", removing a lot of user agency for the software being ran); Chrome being the biggest driver of this, whil…

Now that we have AI, can we go back to real apps and native tech stacks? And revert the browser to a text-display interface?

Sure, once we have equivalent strong sandboxing for third-party apps I'm down to install random ones rather than visiting a website.

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#90

Post by lxgr »

MisterTea wrote: post #82
VMG wrote: post #64

Earlier quoted context omitted.

Unfortunately, real apps and native tech stacks can not only write data to your SSD, they can usually write data to the user directory however they want and they can read it as well! Browsers are at least somewhat sandboxed

Why not sandbox the process then?

Sure, can you propose an equally mature and battle-tested sandbox, ideally one with multiple implementations on a wide variety of OSes?
Post reply on HN