Comment by curveship | Hacker News Reader

Comment by curveship | Hacker News Reader

I'm betting this isn't a bug but isn't malicious either. Possible scenario:

Product: So Sue, how's the restore-session-after-crash feature going?

Dev: Great, just about done.

Product: So it's working for all sessions now? Fantastic!

Dev: Yep! Well, all sessions except private ones of course.

Product: ... so you haven't finished private sessions yet?

Dev: No, it's just that we don't store anything on disk for them, so there's nothing to restore.

Product: ...

Dev: ...

Product: Users don't know what "stored on disk" even means. They're going to be very upset if we lose their work after a crash, just because the session happened to be private. Maybe even more so.

Dev: But with nothing on disk, that would be impossible.

Product: You devs have such a fixed mindset. If I had a penny for every time I'd heard one tell me something was "impossible." So store what you need on disk, and ...

Dev: But history ...

Product ... and flag it so it doesn't show up in history or as a visited link. Wouldn't that work?

Dev: Well, kind of, but ...

Product: Great! So we have a solution. How long to get that coded up?

[Later] Product: "Impossible" laugh Hah!

I actually wouldn't be surprised that a similar scenario occurred during development. There are stupid decisions made constantly. Even the place I work, our Chief Security Officer in charge of security asked me to remove all authentication from all printers with email function so that it won't affect user's workflow... on top of that, I'm told to allow users to type in the "From" field as well.

I'm about to scan my butt to the CEO and type in the CSO's email address in the From field just to prove my point....

If you don't have some sort of card + short-pin access to the scanner (or something else that's minimally interrupting), auth is an incredibly annoying thing. I mean, what's the threat vector here? Scanned butts? I think people will survive.

Everyone's supposed to have some fancy alphanumeric-with-special-characters password and sit there in front of the machine copying it in slowly from their LastPass. No, thank you.

Considering we're in healthcare business... I can see problems. We are working towards implementing a badge-in option but wont begin testing until this summer.

>We are working towards implementing a badge-in option

Where else in a healthcare business can you implement those?

We already have the ability for staff to badge into any computer without typing their credentials.

This explanation made me giggle and cry a little. It also made me think of the quote from Scott Hanselman, "We're not nearly as organized as we'd need to be to be as evil as you might think we are."

http://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx

Microsoft is thought of as this hugely evil company, but I don't know, maybe they are just as disorganized as every other company I've worked with and the product owner doesn't understand their customers all the time. The key is some comapanies I've worked for pivot fast and fix things they see as a mistake. Others try to bury and hide it.

Are they going to kill my pappy this time? I don't think so, but we'll see.

This heuristic, generalized, is sometimes called Hanlon's Razor: "never attribute to malice that which is adequately explained by stupidity."

The razor also has a corollary in Clark's law, which states that "any sufficiently advanced incompetence is indistinguishable from malice".

I actually think that Hanlon's Razor goes too far. Allow me to present Kibwen's Corollary to Hanlon's Razor: "never attribute to stupidity that which is adequately explained by apathy".

Microsoft's evil was on display in open court.

https://en.wikipedia.org/wiki/Halloween_documents

Hanselman's point was that they weren't as evil as you might think

When you try to open closed tab back (ctrl+shift+T), Chrome does not open it. I thougt this is a good way of handling history in private mode, you close the tab and everything is gone. However when I tried same thing on Firefox, I saw that Firefox happily opens the closed tab back, which surprised me. So I think while trying to find a balance between usability and privacy, browser vendors choose different paths.

In Firefox you create a private window, not a private tab.

Inside the private window, you can have multiple tabs; closing them and restoring them. Once you close the private window everything is gone.

Chrome also uses a private window, not private tabs. You just can't restore closed private tabs, which is probably how it should be.

The thing is that chrome sandboxes every tab, but firefox doesn't and it's easier for firefox to restore tabs than for chrome is to do.

Chrome fires up a separate thread for each tab. So any information about that tab is lost once the tab, (and thus sandbox) closes. No information specific to the tabs is stored in the window unless explicitly done (like bookmarking). Thus, the session history is stored inside that sandbox, so it's gone once it's closed.

Firefox is maintaining a window with tabs within it. So it can still keep your session info for each tab stored at the window level and restore it even after a tab is close.

I was talking about how tabs is handled in private window.

> In Firefox you create a private window, not a private tab.

This isn't true either. Log in to a site in one private window and then open another one. You'll be logged in in that one too.

While Chrome does forget about the history of the closed tab, cookies are shared across incognito tabs/windows and aren't wiped until all incognito tabs are closed. You can still be tracked and associated with anything you visited in that closed tab if you have other tabs open.

This post gave me PTSD.

Exceeeeept, Edge doesn't restore those sessions or evidently do anything with this data, suggesting a regression on how the tab history is handled.

I mean, good story. 6 years ago it might have even been realistic for ms. These days, the middle level product manager who did that would rapidly find themselves on a high speed track to a new employer.

The Edge team isn't a bunch of faceless goons. Heck, a lot of them are really active in the browser development community and you can see they're trying really hard.

As much fun as it is to carry on the Slashdot tradition and make fun of every bug at MS as indicative of a toxic and stupid culture, maybe that's not entirely appropriate anymore.

I mean, it's not like Firefox and chrome haven't had bugs in this vein before. Hell, neither can fully protect repeatedly visited private urls on Android either.

> As much fun as it is to carry on the Slashdot tradition and make fun of every bug at MS as indicative of a toxic and stupid culture, maybe that's not entirely appropriate anymore.

But betanews wouldn't have very much to write about....

I don't know if this is the case, but I definitely understand how it could happen.

Chrome's Incognito mode has the exact behavior of not supporting things like session restore and closed tab reopening. It's kind of annoying for those of us who occasionally use Incognito windows like a convenient transient separate profile (specifically "give me a different cookie jar because some site's login is broken"), but I think the loss of functionality is worth it given what the mode is actually /for/.

It makes me wonder though if it'd be worthwhile having a mode that gives you a separate cookie jar but keeps the browser settings otherwise identical (bookmarks, suggest, etc). I suspect the distinction is too subtle for most people however.

I used to use it for that but now with chrome profiles I've setup a new person for that called Mr Debug. It's good in that I can enable different extensions, ones that I wouldn't have enabled normally and disable the ones that interfere with dom inspections (looking at you Evernote).

You can run both at once.

This is too real. shudder

Microsoft makes a huge amount of money from enterprise sales. I would see how large companies would be worked up if employees could use private mode browsing to circumvent monitoring. I fear (without any evidence) that private browsing mode would be a tough feature to push in the enterprise space.

Monitoring in an enterprise environment (for browsing) works on a network level; even SSL sites are monitored by on-the-fly certificates that are trusted by the users machine. There's no need to persist history to disk for an IT team to capture that information.

My favorite days are the one where central IT screws up the system, and we get certificate errors everywhere we go. Uh, do you think they're tracking us and snooping all supposedly secure communication? Naaaaaah. Luckily, I avoid most of those days working from home and NOT using the VPN. I SHOULD make sure I never log into something I care about (like iCloud) while on their network. The problem is that I can't get reception on my cell phone inside the building.

If you don't want your employer to see it, do it on your phone. Everyone should realise that by now.

I disagree with this, primarily because most enterprise solutions can track your traffic independently of the browser.

Sounds like something that would be much better controlled (i.e. "disabled") at the organizational level with a group policy setting.

thats looking at it from the best possible way. The way windows 10 has gone so far I really doubt which is which. Maybe they knew and didn't want people to find out. They also don't seem to give a shit about what people actually want.

This sounds like a very likely scenario... sad but true.

I'm pretty sure you are right [or some similar scenario].

However, its disingenuous at best that they didn't mention it anywhere.

Reply on news.ycombinator.com