undefined | Better HN

0 pointsmeaty13y ago0 comments

Yes I know but the sheer number of articles aggregated across all browsers point to the architecture of the web being completely flawed.

Consequentially, they're all as bad as each other.

"More secure" is subjective i.e. it's more secure to us public but who the hell knows there aren't 100 zero day's out there in the wild changing hands for thousands of dollars.

0 comments

5 comments · 1 top-level

cheald13y ago· 4 in thread

I think you're being needlessly dismissive of how hard a problem it is. There are legitimate use cases for capturing mouse position. You could certainly make a secure browser, but you're also going to strip it of much of the functionality that we enjoy today.

The problem doesn't exist because people just aren't paying attention to security, or because the entire architecture of the web is flawed. The problem exists because it's a damn hard problem to deliver arbitrary executable code to clients on demand and let them run it and do useful things with it without compromising security and privacy. The browser vendors have really stepped it up in the last few years, and it takes a very narrow view of the web to see otherwise.

meatyOP13y ago

Not really. It's not a hard problem to solve if you start at the right end of it rather than retrospectively apply it.

Capturing the mouse position is perhaps legitimate for an "application" but not necessarily a "document". The web conveniently has turned from an information medium into a catch all for pretty much every hack that is imaginable. That's where it's all fallen over. "documents" are now "applications". This has lead to all of the crocks of shit out there. Office VBA and programmable documents are in a similar state.

I firmly believe we need to make the distinction between a document and an application and have appropriate sandboxes and/or virtualization for each.

Documents deliver information.

Applications deliver means of interaction.

Yaggo13y ago

> I firmly believe we need to make the distinction between a document and an application and have appropriate sandboxes and/or virtualization for each.

You can go back to 1993 and turn your web application platform (a.k.a browser) into simple document reader by disabling javascript (+ plugins, whoever keeps them enabled anyway). Good luck with that.

1 more reply

ako13y ago

Apparently there is a need to deliver documents with interaction. A browser is an application that delivers information, which delivers interaction... It's a mess, real world is never clean. And it's always changing...

1 more reply

cheald13y ago