Hacker News Reader

Comment by matthuggins | Hacker News Reader

I don't understand the problem. Why doesn't the author just upgrade his browser? He doesn't explain why that's not an option.

View on HN

This is what they added in the release after the one he's using. http://www.opera.com/docs/changelogs/windows/1100/

Not only is he choosing a less stable browser, he's also choosing a non-HTML5 compliant one.

Reminds me of this Swift on Security tweet: https://twitter.com/SwiftOnSecurity/status/69547522814777753...

So what? What if he were to use curl or wget? What then?

I don't believe anyone seriously uses curl or wget to browse the internet outside of edge cases.

If he really wants to read YouTube comments, why not open a separate browser for YouTube? Why not make your own CLI interface that pretends to be the "extraload"ing code?

I think it's perfectly fine that people have to actively exert effort to stay on a previous browser. Because those people are the reason IE8 and IE7 and IE6 were issues for the longest time.

If you don't like the everchanging web and the fact that it's built on crappy standards, then build your own thing. (This is a point I fully agree with: the web is an awful application platform as it is now.) But why would you make the experience more difficult for everyone else?

Edge cases like Richard Stallman (https://stallman.org/stallman-computing.html):

> I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and then mails them back to me.

Even wget can (and does) have critical vulnerabilities:

https://community.rapid7.com/community/metasploit/blog/2014/...

Some users will always cling to older tech. Some users like the simpler interfaces. Some hate UI design changes (like Australis in Firefox). I don't understand it myself. Especially when a user makes a decision to put themselves at risk security-wise as this user is by using an unmaintained browser that isn't tracking security issues any longer.

If they didn't change the user-facing parts and just fixed the security issues, I think a lot more users would upgrade.

What's the actual risk though? I have a feeling these users are also the more experienced and cautious ones, the ones with JS off by default, the ones who aren't going to be as easily tricked by social engineering, and that already removes 99% of the attack area.

Someone finds a zero day html parser vulnerability and takes over your computer by putting the malicious markup in a banner ad.

More experienced users are not safer in any way if they're using unpatched and unsupported software.

An example of a vulnerability of an even older version of Opera for Windows, that let an attacker totally own the client computer: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-13...

"Large values in the HTTP Content-Length header can cause Opera to crash. Certain specific values can cause a memory corruption, which in some cases can allow arbitrary code to be injected and executed. In most cases Opera will just crash. To inject code, additional techniques will have to be employed."

More details in the pages linked to the URL I provided.

And overflows in the image handlers which crop up every now and then. Anyone that thinks they are secure using an outdated and insecure browser by disabling JavaScript doesn't understand security's complexities when dealing with something like a browser.

My dad hates upgrading software because they mess with the UI and remove features he likes. He is not security conscious and is subject to attack.

The vendors take shortcuts, and force UX on usera because they don't want to bother back porting security fixes or making security code separable from UX feature code

>I know, Opera 10.63 is really old, but it's the last desirable browser in the world…

Personal preference I guess.

Perhaps the user doesn't want his/her web browsing experience to be the awful, bloated, slow, tracking-laden experience that javascript has made it into for the rest of us.

I for one applaud this individual.

He's using Opera 10. The one with a built in IRC client, mail client, bittorrent client, Web server, widget system, and loads more. He's using, by far, the most bloated and slow browser ever created. He's not choosing a lighter experience, he's choosing a slower and more broken one (as evidenced by the fact that it can't even load one of the most popular websites in the world correctly).

It had all those things, and you can call that bloat if you wish, but at the time it was decently fast.

http://lifehacker.com/5352195/browser-speed-tests-chrome-40-... for example, or https://ktetch.wordpress.com/2010/07/05/benchmarking-browser...

Get back to us when you can load 100 (one hundred) tabs in under 2.5GB of ram and maintain snappy experience on 7 year old 2core/3GHz computer.

If you hadn't used Opera before it became yet-another-WebKit-shell, you wouldn't understand. Going to a higher version number would be more of a downgrade.

Don't know for sure, but IIRC, opera 10 was one of the last good versions of opera before their new management started ruining stuff and eventually sold out and became a chromium skin.

I'd jump back to opera in an instant if they had all the features of the old versions, but with a modern html and JavaScript engine.

that would be ~12.14. 12.17 build was after crucial devs departure and is full of critical bugs (constant crashing due to linking broken openssl, 64bit build unusable, etc).

Reply on news.ycombinator.com