Hacker News Reader

Comment by okasaki | Hacker News Reader

>Google is known for A/B testing changes to its various web services all the time, so this specific hiccup could resolve itself in time.

>“Couldn’t sign you in. This browser or app may not be secure. Try using a different browser. If you’re already using a supported browser, you can refresh your screen and try again to sign in.”

A/B testing security? Is this what peak A/B looks like?

Can we go back to giving users a consistent experience and develop software based on some other type of reasoning, rather than this A/B gaslighting?

View on HN

Its really bad outside of just Google. My wife was complaining about Instagram and certain features not working properly. Like sharing a story she was tagged in which she has done before but she was tagged in some new way. Then she saw a celebrity unable to do things my wife can do that she could do months ago like adding music to stories.

A/B testing is pretty much the gold standard. It took medicine a thousand years of bloodletting to get there.

Of course its’s not always possible, which is what economists and nutritionists and a few other sciences struggle with. But measuring security incidents and correlating them with browser use seems sensible.

There is still plenty of room for theory, such as coming up with what to test.

Some changes are slow-rolled so if they cause an unexpected regression, impacted users are minimized.

It's possible a change is causing an unexpected side-effect with blocking these browsers (maybe they have a specific known browser config that has a problem and they botched the UA identifier to be too broad?)

You get a consistent experience with a consistent user agent. Anything else is best effort, trusting developers to successfully implement standards correctly, and hoping they all made similar decisions in places the standard is open.

This amounts to a "best viewed in Chrome" philosophy. It's an argument against Open Standards draped in worry about security.

It's no different than Google's policies of restricting apps on Jailbroken phones, a practice that was ostensibly introduced for security, but quickly expanded to be used for DRM and to discourage users from taking control of their own devices.

The whole point of Open standards, the only reason we built these things in the first place, was so companies like Google couldn't decide which browsers worked with the web.

You might as well rephrase your first sentence to read, "you get a consistent experience with a current Chrome browser" -- and I have no doubt that there are people at Google who would be happy to have that policy if they thought they could get away with it.

After all, why should Google's security team trust that Mozilla's browser is secure, given that they don't get to pre-vet new versions? Even if a current version is implementing the standard correctly, there's no guarantee that a future Firefox version won't have problems. And Mozilla is already refusing to deprecate old APIs with Manifest V3, when according to Google that deprecation is super necessary to make extensions secure.

You also get a consistent user experience with a current Firefox browser; it might be slightly different than the one you get with a consistent Chrome browser. There's a reason a lot of companies standardize on a single browser for their internal web applications.

The purpose of avoiding browser monoculture was to avoid a world where a single company deploying a single closed-source browser owned the gateway to the World wide Web. The goal was never to make it easy for an arbitrary number of browsers to operate independently of each other; in fact, browsers are very complex software to get right and service providers have a responsibility to make it hard for users to get their accounts compromised even if they bring a browser with implementation errors into the loop.

I'd be more concerned if Google was blocking, say, Firefox, or if the block was harder to overcome than changing the UA. This block is inconsequential. Change the UA and be done with it.

> The purpose of avoiding browser monoculture was to avoid a world where a single company deploying a single closed-source browser owned the gateway to the World wide Web. The goal was never to make it easy for an arbitrary number of browsers to operate independently of each othe

Making it easier to build browsers is how we avoid a monoculture. If we were OK with there being 2 browser engines (Firefox and Chrome) we wouldn't need to make all of these standards. Mozilla and Google are perfectly capable of collaborating on their own in private, and it would be faster for them to do so -- its just everyone else that would be left out.

Open standards are why we can have interesting browser experiments like Beaker. It's important that there be multiple software projects pushing the web forward. Of course browsers are hard to build, just like Operating Systems are hard to build. It doesn't follow that there should only be two of them.

> Change the UA and be done with it.

To be honest, you're right on this point. This is a kind of pointless debate -- because what will actually happen here is all of the insecure browsers you're worried about are just going to take Vivaldi's route and by-default mock a different user agent for Google login screens. End users don't know or care what user agent is being sent to the remote server.

Let's be honest -- the Kmail devs are not going to throw their hands up in the air and say, "well I guess we just abandon the project now." They're going to push a change that invisibly mocks the user agent for all of their users.

Because, again, you can't trust an insecure browser. If you can't trust a browser-maker to implement the standard correctly, you also can't trust them to voluntarily go along with a scheme that will make a nontrivial portion of the web unusable for the majority of their current user-base.

While it doesn't follow that there should be only two browsers, it also doesn't make sense that Google should expose its end users to other people's lab projects if that increased the security risk of those end-users. Security is a balancing game and always in flux.

Reply on news.ycombinator.com