Hacker News Reader

Comment by jahvo | Hacker News Reader

One thing I used to love about websites is that I knew once I closed the tab the site was gone forever and it was not allowed to execute any more code. That was heaven.

But now with web workers and service workers and god knows what else, I feel like I've lost that security, and that makes me uneasy. It's a security and a privacy issue.

I know I can disable all that stuff in about:config but how do I know they haven't invented some other new technology in the past months that I should be aware of?

View on HN

I'm not one to be super paranoid about security and privacy on websites, but the other day I was working on a PWA for the first time for a new client, and when I clicked "show service workers from other domains" in Chrome, I see community.aseprite.org, discourse.gohugo.io, vuejs.org, forums.dotnetfoundation.org, lodash.com, www.cnet.com, www.meetup.com, www.google.com/maps, www.pinterest.com, www.wired.com, and xhr.spec.whatwg.org. I get why half of these sites think they need it (the news websites and web 3.0 forums, so they can update themselves in the background maybe?) but service workers for the lodash, whatwg, vuejs sites? This seems just plain unnecessary.

Those other sites do it so that they're available offline. Service Workers give you control over network caching so you can return an cached/offline copy of the content.

I remember when this was actually a feature of web browsers. In the File menu you could just click "Offline mode" when you were offline, and it would return everything from cache. And then one day that menu option was just gone. Now the web has an opt-in way for sites to do this themselves. It feels pretty convoluted. Then again Web 3.0 feels pretty convoluted in general. It's as if the iPhone SDK came out and suddenly set the standard on how convoluted development ought to be, and every other platform followed suit.

It's like that functionality has just been forgotten and then this generation's hip coders thought it up again in their convoluted "everything is dynamic and JavaScript" mindset. Like with 200 other things regarding web browsers.

Firefox has it. Menu > More > Work Offline.

Safari has a similar ability called "Reading List". And even saving pages as a webarchive. The problem with both are that modern websites depend so heavily on XHR that caching the initial page assets is essentially absent of the content desired, and thats what service workers can help fix.

Exactly my same feeling. And what's worse, is that I don't really know what those entries (.js files) can do. Can they exec code whenever they want? Or every hour? Or every minute? Can they see what I do? Can they call home (and know my IP even if I'm not visiting those websites)? Why do I have to read a technical spec to learn about this?

To my knowledge they can only execute code in response to a network event. Usually this means you need to take some action to trigger an outgoing network request, like returning to the site that installed the service worker. Code execution can also be triggered by incoming network events such as push notifications but these would require you to have allowed push notifications from that site.

But surely this is an implicit assumption in having something work offline. It has to store something locally.

It does make sense to make it more obvious, like requesting access to store offline content or perhaps having an options tab similar to the addons in a browser or the add/remove programs in Windows that lists all the service workers that are installed.

I don't want websites to work offline.

Also, it bothers me that websites can install themselves like that without my permission or knowledge.

The way I see it, offline isn't primarily designed for websites, it's to replace apps that you'd install on you phone.

I agree on the installation confirmation - you have to agree before installing an app and the whole point of the blog post is that the line between a native app and a service worker site is getting smaller. So a similar level of permission should be requested before installing something locally.

In firefox (about:config):

  dom.serviceWorkers.enabled = false

I find that tge only way to use web securely is to disable JS alltogether except for a few hand-picked web pages. I use qurebrowser for that, and chromium for some nasty web apps I have to use.

I can eventually see the mechanisms for informing users changing. I would imagine that in the next few browser releases, granular control of JavaScript features will be more accessible, especially as they provide access to more native features.

Add to that things like cryptocurrency mining by ads and other scripts on websites.

Reply on news.ycombinator.com