Sephr

Protip: Make your web SDK APIs EventTargets instead of creating custom event subscription models wherever practical.

For some startups (mostly dealing with local and self-hosted software), it may be a better option to offer perpetual license grants to the product being worked on as opposed to equity in the startup itself. This encourages employees to make the best software if they know that they are also going to be the end user as well.

The new CEO isn't any better. According to their first CEO (Brendan Eich) "Mozilla is being looted now, mitchell taking $38M+ out over 9 years was just a start"

Android does not require this if the app developer instructs users to disable battery optimizations for the app so that it can poll for notifications itself.

I think the point the parent comment is making is that companies shouldn't be able to trademark common phrases with their usual spelling. 'Dev mode' is a common short form for 'developer mode' which has extensive use.

> does not monitor motion

This doesn't mean that they can't monitor motion (e.g. as compelled via NSL). This product sorely needs E2EE.

> “Fingerprinting has always been a concern in the privacy community, but until now, we had no hard proof that it was actually being used to track users,” said Dr. Nitesh Saxena, cybersecurity researcher, professor of computer science and engineering and associate director of the Global Cyber Research Institute at Texas A&M. “Our work helps close that gap.”

Maybe if you live in a bubble where documentation published outside of academia doesn't exist. Tracking vendors themselves have claimed to be fingerprinting users' browsers in their privacy policies for over a decade.

Can the creator /user/bill_yang explain this contradiction in the readme? It claims to support tracking unique users, but then immediately afterwards claims not to track users. Do you mean that you don't do any user tracking by default?

> Key Features

> - All key web analytics metrics including sessions, unique users, pageviews, bounce rate, session duration

> - No cookies or user tracking - GDPR & CCPA compliant

Awesome! I was making exactly this library 13 years ago but only made it as far as creating CSS and other asset inlining+normalization tools before I ran into a few major roadblocks.

The most significant roadblock was that drawing SVG <foreignObject> with inline subresources (data: and blob: URIs) tainted canvases in Chrome and Safari, and this was partially resolved in 2019[1].

Notably, some issues still remain but apparently it's now workable. As is apparent from snapDOM, completely accurate CSS normalization is still an unsolved problem.

While I'm excited to see the HTML-in-foreignObject use case mature, it is also important to point out that the Media Capture API now has the ability to capture individual elements natively in Chrome[2].

1. https://issues.chromium.org/issues/41054640#comment49

2. https://developer.mozilla.org/en-US/docs/Web/API/CropTarget/...

To achieve an ESM-only future, we can't have features that only work in non-ESM. Browsers don't support synchronous blocking loading and execution of ESM scripts.

If only Ladybird development had taken off sooner. The best balance of {respectful defaults, security, privacy, extensibility} out of the top 5 browsers seems to be Brave[1] for now, which isn't the most ideal situation.

1. https://eligrey.com/blog/choosing-a-browser/

I've substantially expanded and revised this article since the initial posting.

Also dang says that a small amount of reposts for stuff that hasn't taken off is okay: https://news.ycombinator.com/newsfaq.html#reposts

Location: San Francisco, CA, US

Remote: Yes

Willing to relocate: Maybe

Technologies: Web full-stack (deep -- cross-browser support, old & new environments, niche single-browser-formats, etc.), node.js, deno. Privacy and security expert: created the novel airgap.js privacy governance SDK, initiated many vulnerability disclosures.

Résumé/CV: https://hacker-news.addon.download/resume

Email: ~@eligrey.com

GitHub: https://github.com/eligrey

Website: https://dangerous.link/virus.exe

Hi, I'm Eli. I'm on a journey to build wealth in furtherance of my goal to fund brain scanning and simulation research.

Seeking: Generalist researcher and SWE, ≥40% time full-agency research work, $600k USD minimum salary + 3% equity OR $300k USD salary + 20% equity, at up to a 4-year vesting cliff. I have a preference for high-impact work that changes the world with minimal negative externalities.

Please do not reach out for jobs that pay under $300k/yr pre-equity!

Ah, thanks for the clarification

Both companies are known for highly invasive tracking.

This only comes up after searching for Google

> the scrolling probably isn't intentional

What makes you believe that? It's pretty clearly intentional even if it only applies to Chromium browsers.

I never said that it misleads people into thinking that they might be on Google.

The aspects that you're bringing up aren't particularly relevant since everything you're describing is auto scrolled away.

This behavior is clearly intended to confuse the user, with the effect of making inattentive users think that they aren't on Bing.

On mobile, you never see the Bing header due to the auto scrolling behavior.

If any other company tried to pull this, I imagine that they would be blocklisted by Google.

When you search for 'Google' on Bing, you are currently presented with a fake Google-esque search page that displays and auto-focuses a new empty search field.

Microsoft is misleading people into thinking that they are on another search engine by not propagating the original search query into this search field.

Note: I've heard that you may have to be signed out of Microsoft in order to see this behavior.

To be fair, Honey could easily bypass the blocklist redistribution legal issue by downloading filter lists at runtime from the official source. Then they aren't redistributing the resources.

Update: It looks like they're also using code from uBO without attribution or authorization. That's most likely illegal.

Privacy-first generally entails designing the service on a technical level to be unable to leak personal data. A promise not to store your data is not sufficient.

A hosted service for this is underwhelming, especially with Chrome shipping on-device AI models and APIs that can also handle summarization.

Mozilla doesn't seem to care much about creating linkrot. They've previously deleted a bunch of historical docs such as their JavaScript engine release notes with changelog information.

Well, no human blood. A Waymo has hit a dog in what seemed like an unavoidable accident.

> These days browsers may expose how many cores your device's CPU has to websites.

This information could be determined prior to the introduction of navigator.hardwareConcurrency.

I published a timing attack polyfill that derives this information and initially proposed the navigator.hardwareConcurrency API as a replacement for this timing attack polyfill.

In addition to the fundamental utility of this API, browser vendors also saw implementing this as a way to save battery life by making it no longer necessary for websites to benchmark user devices to determine this value.

Agreed that users need more baseline protections.

Separately, privacy signals are being required by law in some regions. If we're going to have browser level privacy signals in the first place, we might as well support and use them as intended.

GPC is also a narrower signal implying a smaller subset of privacy choices.

Removing this feature harms user agency. This will result in Firefox users having to deal with more annoying consent prompts.

Transcend Consent Management's default configuration opts users out of every unessential tracking purpose (and suppresses automatic consent prompts) whenever DNT is enabled, but only opts users out of "Sale/sharing of info" when only GPC is enabled.

Removing this centralized privacy signal means some users cannot express full opt outs to Transcend Consent Management by default without having to interact with annoying banners.

I believe this change was steamrolled without taking in proper consideration and feedback from the web community. Mozilla made this change so fast that barely anyone noticed the issue before it got closed[1]. To add insult to injury, they've configured their Bugzilla to disallow further comments from non-Mozilla employees after issues are closed.

I shared similar feedback with the Chrome team in 2023 when they were proposing to remove DNT[2]. They considered my feedback and currently DNT is still in Chrome, with its removal indefinitely postponed.

1. https://bugzilla.mozilla.org/show_bug.cgi?id=1928087

2. https://issues.chromium.org/issues/41440843#comment12

Does this mean better motion response times? The M-series MacBook Pro displays have notoriously smeary displays while displaying high-motion content, so this would be a welcome addition.