Hacker News Reader

Comment by ctz | Hacker News Reader

Another reason why "web security" is the most immensely depressing topic in modern computing.

It turns out you can't actually achieve a simple, secure system by repeatedly rushing to fix problems as they arise.

Actually if we could all agree to go back to plain HTML, no CSS and especially no JavaScript and use solid client applications for client work; the web would be infinitely more secure. That isn't going to happen though, unfortunately.

Frankly I imagine at least I'd find it more pleasant. I'm actually really tired of the bundling of content and presentation. It'd be nice if HTML were more of a set of formatting hints, and we could theme our browsing experience for all sites. It sucks when a site has good content but is poorly designed. There's no particular reason those two functions need to be tied together, but people have distorted text formatting into web design in such a way that it breaks reflow and you're forced to view the content the way they've decided it should be viewed. Alas.

Why is your browser paying attention to the design suggestions of website operators? Surely it should only show their content using your preferred design?

Just one change will solve a whole pile of stuff and get rid of a ton of cruft at the same time:

Everything has to be same origin. Exceptions only to be allowed with case-by-case explicit consent of the user.

The only thing that should bridge one website to another is a link to the 'top' level document.

Reply on news.ycombinator.com