Hacker News Reader

Comment by paulddraper | Hacker News Reader

> Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on the net.

But that is literally what web users want.

Everything you named is a fine opinion, but runs contrary to the wishes of the vast majority of millions and millions and millions and millions of web users.

EDIT: That said, browsers have features for users such as yourself to disable JavaScript, and there are third party extensions for finer-grained control. Again, adding these limitations is unpopular among web users.

View on HN

> But that is literally what web users want.

No it absolutely does not.

Just because a user doesn't understand what Javascript is or how to diagnose why their computer is slow (is it an app, website, update, virus etc) does not imply consent.

Pretty sure that most people just want to be able to visit a website without it causing problems to their computer or to others.

But a “website” isn’t an HTML page any more. It’s a network-deployed application. Most people want to run these applications.

To reiterate threeseed’s point: the user wants the website to work well and work efficiently. They don’t care if it’s HTML or an interactive app. In a lot of cases, the web works better when pages are served as plain static HTML.

Sure, a simple marketing site for a local restaurant can work with only HTML and CSS, but practically all of the top 20 most popular sites would cease to function without JS.

Websites also work better, IMO, when every page doesn't use remote resources on 10 different domain names hosted by 3rd-party vendors. This is one of the reasons I use Vultr instead of Digital Ocean: instead of locally hosting their own JS pages, DO uses 3rd-party services. (Maybe they don't have a choice if the 3rd party requires it.) Whereas with Vultr, I only had to enable one or 2 domain names and the whole site worked. It's a much better experience for the user IMO.

I think you'll need some evidence for that. Silence is not consent, and it's certainly not enthusiastic consent.

And even if you do want to take silence for consent, the fact that the vast majority of millions of millions of web users do not install an extension to route around Google AMP indicates that they do not want the operators of the web page to do whatever they want, they want to run a restricted subset of what the web designer might imagine. AMP is extremely popular among web users; approximately 100% of Google users use it. (The more defensible argument, of course, is that users don't really want AMP, at which point the question of what users really do want gets back on the table.)

Also, users did vote with their feet against downloading EXEs from the internet - which can actually do whatever the developer wants - and using JS on the web platform, which can make unrestricted GET requests (even if it can't see the responses), sure, but can't do anything near "whatever." It stands to reason that users would gladly accept even more restrictions on the execution platform.

> they want to run a restricted subset of what the web designer might imagine

For the kinds of places that AMP is used, I would suspect so.

> Also, users did vote with their feet against downloading EXEs from the internet

So....this CAN happen???

> users would gladly accept even more restrictions on the execution platform.

The recent popularity of clipboard permissions, geolocation permissions, notification permissions, etc. would suggest otherwise.

What makes you so sure that web users care so much about the uptime of lihkg.com ?

> The recent popularity of clipboard permissions, geolocation permissions, notification permissions, etc. would suggest otherwise.

What popularity? Do you have data that users tend to click "yes" on such permission prompts?

> What makes you so sure that web users care so much about the uptime of lihkg.com ?

I'm not sure I understand what you're asking or what you're responding to.

> I'm not sure I understand what you're asking or what you're responding to.

lihkg.com being down is the negative consequence of this code running, right?

That's one of the negative consequences. If you phrase it as "In order for you to use the web as you're used to it, lihkg.com will go down, do you care" then sure, users may say "no." But if you phrase it as "When you visit this website, a portion of your bandwidth and battery life will be used to suppress dissident communications in Hong Kong, would you like to use your bandwidth and battery life on it," do you expect users to say yes?

No, that is not what web users want. No one asked them and they probably don't even have an opinion on that. It's what web developers and browser makers want.

It's certainly not what browser makers want, since the browser makers dropped native extensions and Flash and Java, and it's not what many web developers want, given the popularity of Content-Security-Policy.

Reply on news.ycombinator.com