Hacker News Reader

Comment by dfabulich | Hacker News Reader

In this article, Mozilla refers to new HTTP headers, COOP and COEP, that can be used to opt-in to cross-origin isolation and thereby grant access to features that would be dangerous under Spectre side channel attacks.

IMO, this Google doc is a better explainer of COOP and COEP, how they work, and why they help.

https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zME...

> "We now assume any active code can read any data in the same address space. The plan going forward must be to keep sensitive cross-origin data out of address spaces that run untrustworthy code, rather than relying on in-process checks."

View on HN

I may sound like a grumpy old man, but I really really dislike this non-stop influx of complexity into every level of the stack. This is a clear case of an abstraction leaking. Microprocessor vulnerabilities should never lead to changes in a high level application protocol like that.

The work needed to implement an HTTP server is growing and growing and growing. There was some speculation a few days ago on why this is happening, and why big companies are benefiting from this. I don't think there's any conscious conspiracy anywhere, just a lot of people try to make a name for themselves. (There was a discussion on this a few days ago here: https://news.ycombinator.com/item?id=23833362)

But I just hate this growing complexity everywhere. HTTP can and should be much simpler than it's becoming.

None of these changes impact HTTP server code. Pages that run javascript might want to set some new headers, but setting headers is something that web servers always have to do. Changing a site config to send some new headers is work for a web page creator, not the HTTP server developer. And the changes are backwards compatible, so you don't actually need to do anything if you don't want to.

This new complexity is about javascript execution, and creating a browser that can run javascript has never been simple!

Can I one-up your rant? We're in an era where complexity has gotten so out of hand, our phones catch on fire under the computational burden of sending text messages!

> The work needed to implement an HTTP server is growing and growing and growing.

It's a header. We've all had 25 years to get those implemented :)

We need something better than the web.

Let’s start by making native apps as instantly accessible as websites — iOS App Clips are a step in that direction.

Next, let people share links into native apps.

> I don't think there's any conscious conspiracy anywhere

Nor is it required, see evolution. Completely non-directed, but the beneficiary still benefits which reinforces the change.

It feels like some kind of selection pressure where big companies pollute the world with complexity to remove competition. This can be intentional of course, but even if it's an accidental random mutation then the result is the same.

The following articles also go into more detail:

- https://web.dev/coop-coep/ - https://web.dev/why-coop-coep/

although I think the Mozilla article in the OP is a really nice, succinct high-level overview.

Reply on news.ycombinator.com