Hacker News Reader

Comment by anoncake | Hacker News Reader

I think we need a way to disable features only for those developers that abuse them. Like uMatrix but built-in and with rules being supplied automatically as ad blocking lists are.

You autocomplete=off a password field? That attribute won't have an effect on your site anymore.

You auto-play videos when the user doesn't expect it? What videos? The web doesn't support videos – as far as you are concerned.

Scroll hijacking? I hope you used progressive enhancement because you just lost your Javascript privileges.

View on HN

This is actually a reasonable proposal. A moderate list could be an in-built feature, with some config options.

It would only work if a strict list is the default in browsers that developers are not willing not to support. The point is not to hack around user-hostile patterns. That frequently means entering an arms race you cannot win. Even in the best case, you're doing that site developers' job. Badly: You have to remove the bad stuff while avoiding overblocking. That's a lot harder than not adding it to start with.

I'm proposing to take away tools from developers that abuse them no matter how much that breaks. If you mine bitcoins or annoy the user using pop-ups we shouldn't spend time finding out what scripts are good and which are bad but just disable all of them, till you remove the user-hostile stuff. We just broke your SPA? That's your problem. Better start working then.

I asked if something similar was coming to Brave, and the answer was yes. Opera maintained what i believe was a somewhat community powered site patching repository back in the Presto days.

https://news.ycombinator.com/item?id=20831774

Can we have a reliable cross-browser way to say "this is a change password field, so don't autocomplete it" and "this is an email address field not a username field, so don't autocomplete it with the login username"?

The autocomplete="new-password" (or autocomplete="off" or even autocomplete="some-random-nonsense") method is supposed to be doing that according to the spec. It is ignored by browser developers probably due to abuse. Additionally, all of those also trigger the prompt to save the password. For a password change form, that is the right thing to do, for many others it is not.

I'd very much like to see a way to disable that save prompt too, especially in user management screens. When I create a new user, I want neither my own password to be autofilled, nor do I want to overwrite my saved password with theirs.

The web needs strong typing. Right now most input fields are variants of text boxes and there are no naming standards that can be enforced without breaking millions of sites.

I've seen/used autocomplete="new-password"

Developers can say that. What we need is a reliable way to know if they're lying.

I even found a name for such an extension: PunishIt.

Reply on news.ycombinator.com