Hacker News Reader

Comment by fevangelou | Hacker News Reader

For personal sites? Sure, why not.

For anything commercial though, especially in media publishing, this is just insane.

I'm beginning to think the old generation of "celebrity" web devs (the ones that became famous in the 2000s - now around in their 50s) has really lost touch with the modern web for some time now. And this comes from someone who's actually bought all of Jeremy's books.

The fact that Google is switching away from third party cookies is surely not a matter of "resisting the tide" as Jeremy writes. It's actually about more control. Whoever controls the web platform (=the browser) can now control the ad landscape [1]. See how Google used AMP to promote a supposedly "faster" web (and it's now being sued for for preferencial ad placement) [2].

[1] https://www.reuters.com/technology/googles-browser-cookies-p...

[2] https://www.theregister.com/2021/10/26/google_deliberately_t...

View on HN

I spent a good chunk of my career working in software security.

I'm fairly damn well convinced at this point that a WHOLE LOT of modern security practices are actually technical run-arounds on missing legislation.

Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course.

We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!)

It turns out small sites can make a pretty compelling web experience when they can coordinate and work together (links to each other, shared preferences, decentralized identity) and it's absolutely NOT a mistake that many large orgs are now using every technical lever than can to prevent that sort of organization.

I see "Security" as filling the same space as union busting right now - make it impossible for those smaller than you to become threatening by banding together. When you keep them divided you can eat them at your leisure.

> Modern security practices intentionally silo users into a single domain - Usually a large tech firm (Facebook, Google, Apple, etc) and then try as DAMN HARD as they can to lock users there - all in the name of security, of course.

> We can't let the user LEAVE our site! How can we know for sure they'll do what we want if they go somewhere else (oh, and also - that thing they do that we don't approve of? It might be DANGEROUS! - think of the children!)

I don't think I've ever seen a walled garden justified in the name of security. Generally, it seems to be more about keeping the user within your ecosystem, so you can capture the value of their attention (i.e. show them ads).

Apple requires all apps to be installed through the App Store. Google requires all in-app payments to go through Google Play. The obvious reason for these requirements is that it's profitable for them. But how do they justify it to their users? More convenience? A unified experience? No, their most prominent argument is that it's safer that way.

Those examples are not applicable. The context of the article, and the comment I was quoting from, clearly indicate a web environment.

Well, you wrote “a walled garden”, which could reasonably be interpreted as any walled garden in software generally.

But if we are charitable and limit ourselves to web site “walled gardens”, how do YouTube and Facebook, etc. justify their “oops, you clicked on an external link! If might lead anywhere! Are you really, really sure you want to continue?”, if security is not their argument?

Ads. They want to introduce friction into the process of leaving their site so they can keep showing you ads.

Ad revenue is obviously the motive. Nobody is denying that. The argument they actually present to the user, though, is about security. Both in politics and in online business, security is an extremely convenient excuse for forcing people to do what you want and hiding your true motives. That's the whole point of the current thread.

Citation needed.

I don't know what industries you've been working in but in any sensitive business third-party javascripts are under the same tight controls as any other code, and changes in javascripts are going through the same change management controls as any other code before entering production.

Even Google have had issues with malware being distributed via adsense: https://www.businessinsider.com/google-has-shut-down-a-malic...

Not to speak of the Megacart hacks: https://www.riskiq.com/blog/external-threat-management/magec...

You can't put third party javascript through change management. Unless you download and host it yourself, in which case it's not really third party.

Well we can absolutely talk semantics. Code written by a third-party is third-party code however it is hosted. Your conclusion is right however. If you are serious with your security and change management you host all scripts yourself. Or use sub-source integrity:

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Of course it's third party code. I meant that it's not really third party in the context of this article advocating for a same origin policy for javascript.

I only came across SRI while dealing with CSP, and I didn't quite understand why anyone would subject themselves to that until just now. Thanks for pointing it out.

Your reaction is in line with this speculation about reactions from the article: "On today’s modern web it sounds like advice from a tinfoil-hat wearing conspiracy nut."

Your post doesn't address any details from the article; it reads like a gut reaction.

He seems to have addressed your point already (I think. "just insane" is a little vague, so it is hard to tell what your objection is).

> Easier said than done, right? Especially if you’re working on a site that currently relies on third-party tracking for its business model. But that exploitative business model won’t change unless people like us are willing to engage in a campaign of passive resistance.

> I know, I know. If you refuse to add that third-party script, your boss will probably say, “Fine, I’ll get someone else to do it. Also, you’re fired.”

> This tactic will only work if everyone agrees to do what’s right. We need to have one another’s backs. We need to support one another. The way people support one another in the workplace is through a union.

True though this may be, I don't see unions gaining any real mindshare among developers. Whenever the subject comes up, you get the standard straw man arguments against unions, and that either ends the discussion, or turns it into some extended shit show that ultimately goes nowhere.

While you might be able to easily "vote with your feet" in this industry, not everybody can afford to stand up for a principle like this on penalty of getting fired.

I don't know what the real solution here is. I'd like to see unions make gains among software engineers, but there's a lot of animosity from people who think they'll be "held back" if they have to join a union. I don't see that kind of attitude going away anytime soon.

The IEEE code of ethics and the ACM code of ethics both have language in them about privacy, so I think those software engineers are not living up to the standards of their professional societies.

Reply on news.ycombinator.com