Comment by bshimmin | Hacker News Reader

Comment by bshimmin | Hacker News Reader

Parent Full thread

I had a freelance gig, a very long time ago, to create a full-screen ad takeover for one of the UK's better known "lads' mags" (now defunct, I think). I hate ads and I hate those sorts of magazines, and I hate ruining people's browsing experiences. Yuck.

When I was working as a permanent employee for an agency, I created two games for the UK's lottery operator. They both had quite intricate rules to snare and addict the people playing them (let's just say that these games are anything but a game of chance). I felt a constant sense of disgust as I was doing it, though it was a moderately interesting technical challenge.

However, I have had the opportunity as a consultant several times to do work for gambling companies (and also for Camelot again!), and I have turned all of these down and made it extremely clear I was doing so for ethical reasons.

I was once asked by a client if we could capture people's email addresses in a sign-up form even if they didn't hit submit, so we could email them later. I am still quite proud of my response, which was, "Yes, we absolutely can! No, we absolutely won't help you do that!"

> I was once asked by a client if we could capture people's email addresses in a sign-up form even if they didn't hit submit, so we could email them later. I am still quite proud of my response, which was, "Yes, we absolutely can! No, we absolutely won't help you do that!"

1) letting Javascript initiate network connections without explicit user interaction with a narrow set of elements (say, a submit button) was a mistake.

2) not having a browser-provided summary of the data a form is about to submit before it's transmitted was a mistake.

Basically letting Javascript escape from a little box of tightly-scoped input validation handling and maybe defining sort functions for tables was a mistake.

It's hard to even wrap my mind about the consequences of those limitations though. The web as we know today would not exist, hell the world would be a different place without facebook and all the other social networks.

And something would replace them, and the same problems would happen because the fundamental problem is not caused by some technological decisions, but stems from human nature.

HTML stagnated badly and this was exacerbated by the "we can just let Javascript and/or CSS handle it" effect. With a less-free Javascript it'd have been necessary to add things like sortable tables and better form elements to HTML itself. Frames might have been improved to fix the various known problems with them, rather than abandoned. Social networks could still exist just fine and, judging from how things like Basic HTML Gmail or Craigslist or HN compare to more "advanced" websites, would have performed a whole lot better.

That a cross-platform application distribution platform might have arisen anyway is beside the point. It'd have been nice to keep that separate from the locked-down hypertext platform that keeps the user in control. We've lost the latter in gaining the former, rather than having both.

[EDIT] I'm with you on humans being the problem over technology in general, but in this particular case I think there were technical reasons that Web 1.0 was destroyed in the creation of Web 2.0 and we were left with one crappy platform that constantly betrays and tricks its users rather than two, at least one of which isn't capable of betraying its users the way this one does. We're where we are because no-one treated Javascript (or anything else with its capabilities and liberties in the browser) as the fundamentally terrible idea and permanent trust-ruiner that it was. It's inherently and unavoidably a security disaster for the Web, not in terms of secure communication between client and server or whatever, but in terms of practical personal security for the users and their data.

> That a cross-platform application distribution platform might have arisen anyway is beside the point. It'd have been nice to keep that separate from the locked-down hypertext platform that keeps the user in control. We've lost the latter in gaining the former, rather than having both.

You assume that HTML would have survived in the same world as this hypothetical cross-platform app ecosystem. I think you are mistaken and you can ask Gopher fans how well it works out when your platform's capabilities are completely subsumed by a more powerful platform.

If the W3C and the major browser vendors had announced an intention to stagnate and never move beyond basic hypertext documents, either another set of people would have forked and moved on without them or a full replacement would have sprung up.

HTML did stagnate, in part because JS was available. How many sites expose the built-in file upload element these days? It's clearly terrible, yet hasn't improved in many, many years. Tables should have (optional) built-in sorting, obviously, but it's not there because you can just use Javascript. And so on. All they've done for, what, going on 20 years now, is prettify the tag names a bit. HTML is de-facto dead anyway, or at least on life support, just a supporting technology for a spying platform that's only there because no-one can be bothered to replace it with something better suited to that purpose. Meanwhile there's no safe-by-default way to browse hypertext. That's dead. Mixing it with app distribution already killed it. There's nothing there to lose.

HTML is the most popular language in the world. The core of HTML may have "stagnated" because of JS, but the alternative would probably have been extinction and replacement with something that didn't decline to include programmability.

I also don't think HTML has actually stagnated, though. HTML+CSS+JS is a solution, and it's changed a lot over the years. The HTML piece has experienced the smallest set of core changes, but that's because it already does what it needs to. Adding a modern file upload element might be nice, but it's not necessary. (Also the behavior of upload on the client side is really a browser choice. Browsers could make this a lot prettier without changing HTML at all.)

> HTML is the most popular language in the world.

Like x86 assembly is, sure. Though way less well-suited to its modern purpose than that is. It's alive by accident and momentum, purely.

If it did what we needed it to do we wouldn't have burned who knows how many (tens of?) thousands of person-hours creating half-complete solutions to its various plain-as-day shortcomings. Input wrappers, table sorters, sequential image viewers, and so on. We did finally get video but it's still usually wrapped in custom UI driven by JS. It's not complete and featureful enough to exist as a good rich document format without JS (due to its long stagnation) but is also really far from being a good choice for laying out and describing applications (because it was never meant to be).

Agree that browser vendors are the ones who'd have to fix all this. The time for that passed a long time ago, of course. I just think it'd be nice to have a hypertext document network that doesn't have on-client spying as a first-class, built-in feature that you have to go way out of your way to even partially avoid. Creating Javascript and giving it such wide access was what killed any hope of that. I consider that the original sin of the modern web, that the platform itself is fundamentally and irreparably insecure (from the end user's perspective).

Exactly this. Network connections won't fire without a visible link? Fine. Save up user data for when they navigate around the site and send it as a batched query.

Heck, even if browsers always showed you the data they were about to send, split out by field, just base64 encode what you don't want them to know you know and give it an innocuous field name like, "session_id". Even better, piggyback off of legitimate fields with zero-width-character encoded data. Where there is any signal at all, there is a way to hide extra information.

Yeah, you'd have to prevent JS from catching a broad set of user events at all, and disallow modification of most of the DOM by it. Again, basically restrict it to tightly-context-constrained functions to do stuff like custom sorting. There'd still be security issues with it from time to time, but they'd be bugs rather than baked-in insecurity that's part of its feature set.

Not sure I get your point about Facebook. I quite liked the internet before Facebook (been working on web since 95). What exactly did Facebook contribute that was positive that helped the world as a whole?

Facebook imo has contributed more positive than negative. It's easy to quickly judge FB as an evil company because of the media recently, but, just for starters, here are a few things FB has done well:

  - Connected people from all around the world
  - Empowered small businesses
  - Is very pro-charity (e.g. "birthday" charity donations)
  - Allowed people to organize themselves online (groups)

Sorry about the late reply. I did not intend to imply that Facebook was an overall positive for the world, or a negative one for that matter, it's just not something I've thought about too deeply.

I just think the world would be very different without Facebook and the other social networks.

“If I didn’t do it, someone else would”, “I was just following orders”.

This is unfair and unreasonable. You pivoted a discussion about JS capabilities into a Nuremberg defense metaphor. We're talking about JS-triggered network activity, not murdering civilians. And inevitability, not a lack of responsibility.

Moreover, he's right. JS would have to be fundamentally crippled (no network activity at all) to enforce this. And if you did that, someone would have built equivalent functionality because people wanted it. In fact someone did build an equivalent, actually multiple: ActiveX, Flash, Java Applets.

We can design to constrain the worst parts of human nature and thereby make us better humans.

For example, excise taxes on cigarettes?

If JavaScript or actually the DOM didn’t allow for that we would now be running Flash.

Eh, I think that's a bit much. If anything I think consumers/users would expect that when you visit a website, you are only doing business with that website/entity. Unfortunately, most adtech precludes this.

I think a hypertext browser that, by default, lets any document you load also spy on your session as clearly as if there were a camera over your shoulder is nuts, but inevitable without harshly crippling any document-accessible scripting language available. Which is what should have happened. Most of the best things that JS provides from a user perspective could have been added to HTML and browsers themselves, e.g. better file/image upload, better tables, frames that don't suck, field validation. Mixing "apps" indiscriminately with hypertext browsing has left both in a pretty bad state.

So you have to click to load you emails ?

Near the beginning of my career (~15 years ago) I was working at an agency for a lottery operator that was allowed to start online gaming and buying tickets for the physical lottery online.

They had a really great public mission about “responsible gaming” but during one meeting with some execs they let slip that it was all just a joke for them and they didn’t care as long as they got the ticket sales.

It made me feel sick, and I started being a bit uncoorporative on the project until my manager switched me into another project.

So I regret the time I worked in that, and also for being a bit of an asshole on the project instead of just telling my manager I had a problem with that client.

There may be moral reasons in favor of accepting a job that requires unethical behavior so that you can perform it poorly, so as to sabotage the progress.

An actual example is of Oskar Schindler (if I recall correctly) whose munition factories in Germany produced faulty munitions during World War II.

there’s very strong circumstantial evidence that heisenberg pulled a similar trick and slow-rolled the nazis into not developing a nuclear program. https://www.nybooks.com/articles/2016/12/22/private-heisenbe...

Alas - "This is exclusive content for subscribers only – subscribe at this low introductory rate for immediate access!"

whoops. Try https://web.archive.org/web/20170212064533/https://www.nyboo...

These letters potentially cast the standard history of the German bomb in a very different light, suggesting that Heisenberg and his colleagues found a silent way to make a moral decision, not that they were spared one.5

In the thirty years that remained to him, whenever Heisenberg was asked to explain the German “failure” to build a bomb, his answer was what he had written to Elisabeth in letters before, during, and just after the war—that he had stayed in Germany because it needed him, and he had been spared the difficult moral decision of whether to build a bomb by the impossible immensity of the task—exactly what you might expect to hear from a man who didn’t want to do it, and found a way to say no.

Parent comment is likely referring to some findings from Operation Epsilon in the Farm Hall transcripts. Googling those terms will get you the underlying details.

I for one tend to agree with the conclusion that Heisenberg could have initiated a German Manhattan project had he desired.

What are you upset about? Journalists shouldn't be expected to work for free.

Oskar Schindler was a Nazi party member who owned an ammunitions factory and saved 1200 Jewish people in Nazi Germany (the movie Schindler's List was based on his life story), but I couldn't find any mention of him sabotaging his own wares. I would imagine this would've led to more suspicion on his factory, where he secretly employed many Jewish workers illegally.

>> sabotaging his own wares

The movie implies that he did so:

"Stern, if this factory ever produces a shell that can actually be fired... I'll be very unhappy."

https://www.imsdb.com/scripts/Schindler's-List.html

It's a great movie, but I wouldn't depend on it alone for a fact like that.

The Lives of Others, another serious and moving film, shows the protagonist solo-monitoring a dissident in order to not report the latter's dissidence. The Stasi required its spies to work in pairs to plug that specific vulnerability. This was crucial to the plot and gave people a false idea of what resistance to a then-modern tyranny is like. (Disclaimer: actual East German dissidents have approved of the movie, while I'm just a guy with an opinion.)

Oskar Schindler, from the movie The List of Schindler? He’s my idol, the guy rescues 1200 jews from the Holocaust, and still cries at the end (of the movie) because he could have sold his shoes and bribed one more assistant.

Reminds me of ads I see when I watch Formula1 on UK Sky television, where a company uses the oxymoronic slogan "We bet responsibly, at Bet365!".

It's amazing to see the length these companies will go through to present their product as just an innocent entertainment community where responsibility and morals are held in high esteem, and at the same time using every possible psychological trick in the book to hook their users.

Bet365 owner Denise Coates was in the news just today[1] (although technically it's old news), for earning £265m only last year. That's a lot of "responsibility".

[1] https://www.theguardian.com/business/2018/nov/21/bet365-deni...

Good on you for putting your foot down! You not only learned from your past experience, but you also are setting a good example for other software engineers who may not be thinking about their ethical duties.

People entering the industry need to be thinking about the consequences of the products we make, and I feel like that's something that can be led in part by the visible example of experienced engineers like yourself - ones who have experienced being used for a harmful end and now are willing to both speak up and stand against it happening to them again. I know I needed this very same wake up call when I was a much younger engineer. I feel shame every time I speak about my involvement in harmful products and my cowardice in the moment, but that shame also reminds me of how important it is to talk about it, to try and make sure other engineers think about these duties that are so easily overlooked. And to remind myself that I don't ever want to be in that situation again.

>They both had quite intricate rules to snare and addict the people playing them (let's just say that these games are anything but a game of chance).

I'm from Quebec and here it's Loto-Québec that operate the lottery. They have games on their online platform too, I had some fun on there a few time, but once I read the actual rule and learned that the dice doesn't follow the real probability... that's just freaking wrong. It's a thing to hide probabilities, it's a whole other ballgame to fake them.

Reply on news.ycombinator.com