Hacker News Reader

Correct me if I'm wrong, but it seems that your personal philosophy places absoluely none of the onus for the internet being dangerous and unfriendly on the people who actually develop things for the internet. You instead blame the layman who has no power to control how websites are constructed.

The heck?

I'd disagree entirely. I'd argue that I'm aware of how much effort has gone into making the web much, Much, MUCH more convenient and less risky for the average, day to day user.

It's frankly stunning how much the ecosystem has changed just over the last 5-10 years. And I mean that as a developer who works in the security industry with a focus on browsers/extensions. It's ludicrous how much more secure the web of today is over the web of the past.

That said, it's not yet secure. There's always a risk/reward decision for using the web, especially around HOW you - the user - uses the web.

So to make an analogy: The infrastructure in place between root authorities, the IETF, browser vendors, ISRG (Let's Encrypt is just one), and website developers has done a DAMN good job in making the web less vulnerable than it was.

It's a nicely paved two lane road that goes nearly everywhere.

That said, you are interacting with the entity hosting the site you visit, NOT THOSE GROUPS, when you visit a site.

It's your responsibility to make sure you trust that entity, and do your due diligence.

Just like I wouldn't try to drive my crappy 1998 Mazda Protege offroad - It's dangerous and I would be unprepared.

Its your responsibility to make decisions for yourself (or at least I fucking hope it is... that's a fundamental aspect of a democratic society that I STRONGLY believe in). That means living with the consequences.

It can also mean choosing different service providers that are less convenient if you deem the easy ones too risky. If you're not willing to do that (aka: switch away from gmail if you want js disabled everywhere) and you still want to complain... I find it hard to treat you seriously.

> It's your responsibility to make sure you trust that entity, and do your due diligence.

What does this entail? I mean, ask the average person if they trust the New York Times, the London Stock Exchange, or Spotify. Those are well-known names - sure we trust them. We trust that, as an organization, they are not plotting to steal our identities.

But trusting them means trusting their business people, their IT people, and their advertising partners, not only to be moral but also to be competent. And whoops, all of them have served malvertising in the past.

Nobody has the time and expertise to evaluate every site's JavaScript every time they visit. The "due diligence" you describe would be a very specialized full-time job.

Whereas turning off JavaScript in the browser takes about 10 seconds.

> It's your responsibility to make sure you trust that entity, and do your due diligence.

> What does this entail?

My whole point is that that's up to you to decide. No one else can make that choice for you.

The VAST majority of people have decided that the risks they face today are worth it, and continue to use the web with js enabled.

If you're not one of them, I absolutely respect that decision, but it means you'll have to accept that companies are making financial and security based decisions based on the behaviors of normal people.

That means that when spotify (and lets be honest, every other streaming service) doesn't work without js, you go somewhere else, and use something different.

That's the whole point I'm making. You can make any decision you'd like with regards to your own security, you can make any decision you'd like with regards to the sites you visit. But that site is free to act in it's own interests, including adding features and services that target the majority of their uses.

Are you aware how many requests pages make simply by visiting them? Hae you ran a DNS server and seen how many third-party sites get hit simply by visiting one news page, for example?

I would rather have more control over what gets scraped from who-knows-where and ran on my machine than not.

You have that control.

You have not lost that control.

Why does this matter in the context of this discussion?

If you choose to visit that news site, you're trusting their web developers. You can always manually go and setup tools and systems to block those 3rd party requests (like I mentioned earlier, an ad blocker is a great first step, because it's easy and automatic). If you're not willing to take those steps...

Don't use the site.

> The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit.

This would be accurate, if watering hole attacks[1] weren't a thing.

[1]: https://en.wikipedia.org/wiki/Watering_hole_attack

Nope, it's still accurate. There are always risks. This is one (it's not a common one, but it's a risk).

To reframe - my statement is akin to saying: the single safest thing you can do while driving is to pay attention to the road.

And you responding with: "This would be accurate, if trees falling on you weren't a thing."

Sure it's a risk, it's not the primary risk.

> You're shifting the responsibility from yourself to a different entity for the choices you're making. The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit.

This seems like a fundamental misrepresentation of how malware is distributed, and how privacy is compromised. People are responsible for the sites they choose to visit. They're not responsible for what those sites serve them, because they can't evaluate it until it's already been served. I don't know what a page will serve me until I visit that page. I can't.

Holding people responsible for whatever content they're served on a page is the same sort of "suck it and see" logic we rightly rejected with "by opening this package, you have consented to the terms of this license". It's a concept that's fundamentally incompatible with informed agreement.

If you want to hold people responsible for clicking "crack DRM now!" ads on the Pirate Bay, fine. But malware doesn't necessarily require outbound clicks, and doesn't necessarily come from dubious sites. Forbes locked out adblockers and served malware through their ad network. Xfinity, the NYT, ebay, Youtube, the Atlantic, and a dozen others major sites have served malware. Newegg, British Airways, and probably Ticketmaster were hit by Magecart, which infected even users with adblockers running.

Why do I disable Javascript? It's not because I don't think I'm responsible for my safety online. Precisely the opposite - it's because I'm not relying on other parties! Magecart was running on major sites two months ago. Adblock, an up-to-date browser, and responsible surfing didn't keep people safe, but uBlock did. A framing where users are accepting any code that ever appears on any site they visit is a framing where we all ought to abandon the internet outright.

> Damn right you don't let random people drive your car! just like I expect you not to click every link you see!

The difference is that I can interact with any number of people, yet only trust a few to drive my car.

You seem to suggest that I should trust everyone I interact with to drive my car, and since that's risky, I should limit my interactions to a few people.

> You're shifting the responsibility from yourself to a different entity for the choices you're making.

Not trusting a site's code is taking responsibility for what it might do to me. Trusting their code is giving them the responsibility to do what's right.

> The single safest thing you can do while using the web is to simply be aware of what you're clicking on, and what sites you visit.

This is good, practical advice for non-tech people. But fundamentally there is no reason the web needs to be unsafe. Viewing a series of hypertext documents is safe, no matter who wrote them. The web is totally safe if you browse it using curl. It's only when we assume that "of course you're going to run that stranger's code" that things become dangerous.

It's great that we can have web applications. It's not great if every page is an application. There should be an explicit step from "I'm casually looking at your page" to "now I want to trust you and run your code".

> That said, modern browsers do a really, really good job at isolating the code running in that page from anything you care about.

That code can't wipe my hard drive, but it can track me everywhere if I let it.

The reason we need content security policies and cross-site request forgery tokens and cross-site scripting protection etc, etc is that our browsers are constantly eval'ing whatever code they're given.