Hacker News Reader

I agree with the rest of your comment but using SOAP-with-GET and non-javascript delete links as examples is a terrible argument. They're both stupid stupid ideas and can lead to bad things precisely because they violate HTTP. Comet is also a horrible hack but sometimes horrible hacks are needed.

But yeah, "it violates HTTP!" is hardly the best argument against "frictionless sharing" :)

It's the engineer equivalent of designers who browse the entire web in View Source mode, looking for reasons to get angry about someone's HTML.

Agreed. I can't imagine that any meaningful percentage of Facebook users care about the HTTP spec.

JavaScript in modern web apps has made the distinction between GET and other HTTP methods irrelevant to users. Simply changing these "frictionless sharing" apps to use POST instead of GET doesn't address anyone's concerns.

Implementing "frictionless sharing" with POST doesn't look trivial to me, because browsers treat cross-domain POST requests more strictly than GET.

What makes you think that? CSRF vulnerabilities are possible precisely because cross-domain POST requests can be created without violating the cross-domain policy.

The javascript would just have to create a form and submit it. Not a big problem at all. Alternatively, create an iframe in which the form is autosubmitted via javascript.

Doesn't that break the back button, making it no longer "frictionless"?

Using POST would probably make non-geeks even more uneasy about this - i.e. if you try to reload an article you're reading and chrome gives you the ('are you sure you want to resend this content?') pop-up that you're used to seeing when you submit a form, I think any frequent web user would find that strange. Using GET instead (breaking HTTP protocol) lets them slip this by people unnoticed, and I agree with the OP that this is at least worth thinking about.

That said, at least FB requires you to approve this. Ads have been doing this kind of thing for a while now, and i'm not sure how I feel about it (I recently was browsing for pictures on art.com and didn't end up buying anything, but for the next month everywhere I went on the web was showing me the exact pictures I had been browsing).

What do you propose then?

The author points to something that we're going to loose (or perhaps that we already lost). Now, ads are the only nasty thing that break the guaranty of side-effect-free GET requests. And this is the only thing that matters for geeks and non geeks.

A human-oriented rant would say: "When you visit a page, you don't have to worry about other parties knowing it because it's guaranteed that way. This is about to change. Act now." As far as I'm concerned, it means the same thing. This is HN, not TechCrunch..

"When you visit a page, you don't have to worry about other parties knowing it because it's guaranteed that way. This is about to change. Act now."

I'm not sure if you only mean "your friends" when you say "other parties", but there are plenty of people that already know when you visit a site (ad-tracking).

Besides, "it violates http get" is still a horrible argument.

> Note, I'm just as much against the whole frictionless sharing thing as most people here. But the moment we allow geek nonsense like this to overtake the real arguments is the moment the world will stop taking it seriously. This is what happened to the net neutrality debate ("net neutrality"? who made up that term? how will i ever make my mom care about that?), let's not let it happen here.

Well said! I'm not against frictionless sharing myself (different can of worms, not for this thread) but I'm glad to see another person look at this objectively.

God forbid this guy figures out that Google changes their search results based on GET requests.