Comment by horsawlarway | Hacker News Reader

Comment by horsawlarway | Hacker News Reader

Parent Full thread

I'm having exactly the opposite thought.

As a developer, shit like "Automatic unpartitioning through heuristics" alone is enough that I won't touch this. Full stop.

Firefox is now breaking the contract I expected it to fulfill as the user's agent, and it's doing it fucking at random.

I happen to live in a space where I do need cross site support (both for cookies and requests) and frankly, between Google's push for SameSite, and now Firefox's selectively breaking the cookie jar, I'm pissed.

I'm a bit boggled that we haven't settled on a decent solution to let a site declare how it wants to interact with other sites.

This already fucking exists for mobile too, both Android and iOS support an opt-in manifest declared at a /.well-known/ path on the origin in question, why the fuck are the browser vendors so DEAD SET on removing control from the sites themselves in favor of these rushed, half assed, shoddy solutions.

Let me declare the sites I want to allow to share my resources. Let me do it at a known location, with a standard manifest, with finer grain control than "Random fucking heuristic" and "strict/lax/none".

I feel like the entire purpose of this is to take the control from the sites and give it to the users. The site owners obviously do want the cookies to be shared with trackers if they embed them.

I don't mind at all if Firefox wanted to propose a standard way to declare cross site sharing, and then allows the user to overrule my settings as a dev (or even if they pick more restrictive defaults, if user opt in is a problem).

There's a standard in place, so arbitrary exceptions and heuristics don't create incredible headaches, and there's a clear path to resolving the issue in support/triage with the customer if they create a rule that does actually break my site's functionality.

I do mind, quite a bit, when Firefox essentially goes "Fuck the standards", and starts playing fast and loose with the rules. And I mind for two reasons

1. I expect better from them. I'm old enough to remember how much steam Firefox picked up from IE by just treating a standard as a standard. It was novel, and transformed front-end development in a great way.

2. They are not the market leader, and non-standard, site breaking bullshit only does more to sink their ship, and I desperately want a competitor in the browser ecosystem that is not Google Chrome (or a rebranded chromium port).

Isn't that pretty much exactly what this accomplishes? It means sites first have to request your permission in a popup.

I thought the article made it pretty clear that the heuristics are only intended as a temporary stop-gap measure to prevent every current SSO service from breaking.

> I thought the article made it pretty clear that the heuristics are only intended as a temporary stop-gap measure to prevent every current SSO service from breaking.

That sentence alone is mind boggling - Hey, Mozilla is breaking every standard that previously allowed cross domain authentication, or 3rd party authentication services, but don't worry, it's only temporary... until what exactly?

Either every site under the sun is suddenly asking the user to accept unpartitioning because critical features are broken and a user literally has to click yes to continue, in which case all you're doing is training users to always click yes (EU cookie popups, take two, lovely...)

Or users move away from Firefox because sites are just broken.

They don't even have a long term solution for how SSO services are expected to work here, other than "use this other API that happens to cause the behavior as a side effect, and oh, btw, the global market leader (chrome) doesn't support it yet! Enjoy!"

Where the fuck is my RFC. Where is real planning I'd expect from a from the company that I only know the name of because they actually gave a shit about standards when IE was doing this kind of crap left and right?

I like Firefox precisely because they normally don't do this bullshit (and their standards based docs on MDN are literally some of the best around).

---

My take is that this is essentially security advertising and social signaling, and is another death blow to Firefox from Mozilla trying to push privacy focused paid services.

Reply on news.ycombinator.com