Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

I am still on team "why haven't these been deprecated by all major browsers yet".

I literally get calls from people who believe their computer has "malware", and it's just dozens of notification subscriptions in their browser spewing adult content ads onto their screen.

Of all the web APIs out there, this is the one most aggressively misused for spam ads, and most rarely actually useful. We literally spent a decade demanding people add a popup blocker into the web browser, and a decade later, injected a popup ad tool back into the browser.

View on HN

I disagree, I think it's a great feature that let's apps like ProtonMail not require a desktop app.

What it needs is a user-driven gesture restriction and a harsh penalty by Google for firing on first-load.

I agree that it's a great feature. It's just actively terrible for 99.9999% of websites.

There is a user-gesture restriction. So now there's an HTML pop-up on dozens of pages.

Imo the user-gesture + permission-modal design is fundamentally bad. We penalize sites by making them have to maim their cover with grotesque user-gesture cutouts, then, once the user clicks (makes a user gesture) they have to click again. Sites should just request push notifications, without user gestures. Something should show up in the awesome-bar, and users can enable it at their leasure. Rather than an active "pull" flow for permissions, we need a "push" flow where users can passively enable/disable some permissions freely, in a more chill way. Conversion rates would plummet, but the whole web would be a much more pleasant place & actually operate for-the-user, which is what the internet is for[1].

[1] https://datatracker.ietf.org/doc/html/rfc8890

> I think it's a great feature that let's apps like ProtonMail not require a desktop app.

For many users, being forced into web-only non-native cloud “apps” is not actually feature.

Especially for something like end-to-end ostensibly client-side encrypted e-mail.

Why would you be forced exactly? Developers can still make native apps.

Forced by developers that refuse to make the necessary investment in producing native applications, because — with features like web push notifications — the poor web UX is something these developers consider “good enough”.

This thread is about actively facilitating that kind of behavior by developers.

That’s not what forced means. Consider that there are developers who have apps with no notifications at all. For some, something is better than nothing.

Personally I like web notifications, if the site doesn’t implement them well then turn it off for that site.

“Forced” means to be compelled by force or necessity.

I’m forced to use crappy web apps for work.

How does it benefit Apple — or Apple’s users — for Apple to facilitate forcing users into crappy, non-native web apps?

Again, no one is being forced. This isn’t even opt out, it’s opt-in. So, yeah, no one is forcing anyone. It’s simply an option.

I don’t think you’ve read the thread you’re replying to, are replying without context, and are countering arguments nobody has made.

We’re discussing the idea that this feature is valuable because it facilitates developers dropping native applications in favor of fully web-based replacements.

The example given by the first poster was Protonmail, which performs client-side encryption, and which they argued would be better served by providing only a web application.

I noted that this would not actually be desirable for most users, especially when the application in question must be trusted to implement client-side encryption for which the server should not have access to the private keying materials, as is the case for protonmail.

There, hopefully you’re all caught up. I understand that you like the idea of this feature, but please read the threads you’re replying to.

I did read the thread - no one is being forced, still. If you or anyone else doesn’t want it then you don’t have to do anything as it’s opt-in only. Hope you’re caught up.

I’m sorry you still clearly don’t understand the thread, but given your response, it’s clear I’m ill-equipped to explain it to you, or you just don’t care to actually listen; perhaps someone else will assist.

Your anti-feature is not a feature. This works for a huge number of people & is great. You holding your own tastes as absolute is petty. Dont.

If a web standard only works if Google "penalizes" people, it's a bad web standard. I hate having to express this weekly, but Google is not the web.

I really don't think any mail client needs corner of screen popups to be useful: I respond to most emails within 5-10 minutes, have used web email since 2005, and I've never wanted or allowed push notifications on my desktop.

It is, at best, a solution looking for a problem, and at worst, an adtech popup spec maliciously impressed upon the web with a casual justification for building it.

Why not disable notifications if you don’t like them? This functionality is opt in. If you don’t toggle this feature flag you’d never even know. Lol

> Why not disable notifications if you don’t like them? Lol

The “Lol” at the end of your comment is misplaced, comes off as condescending.

Not everyone is the same as you, maybe they had considered turning them off and it’s possible that they believe that it may not be an option.

For people outside of tech who do not mess with the settings of their devices, ironically the same people who are likely to be abused by this feature, then having a toggle is not very useful overall anyway.

But, I’m not happy with your tone as it brings down the whole conversation to the same tired old flame war/shit slinging that inevitably happens when someone starts it with mild condescension on the internet.

Given that the feature in question is explicitly opt in, there’s no problem then.

Notifications is enabled by default on every major browser that supports them. I turn them off, and at work, push a policy to disable them across the org, but it's still something I see and hear a lot afflicting non-technical users, especially seniors.

It's useful for "native" web-based apps, both on mobile devices and things like Electron. But for regular browsers: yeah nah. Although, for some things like Telegram web or email it could be useful; the problem here is (as always): how do you allow the useful uses without the twats moving in to engage in their twattery?

I never heard of this before though, but turns out it's been in Firefox since 2016. I did set "always deny" for notifications a few years ago as I got so tired of all the sites whining about it, so I guess that includes these push things too(?) Sites still whine about it with in-site popups of course if they see that permission is denied... Sigh...

When looking it up a bit for this comment I found this description that I found somewhat amusing:

"Web push notifications allow users to opt-in to timely updates from sites they love and allow you to effectively re-engage them with customized, relevant content."

Lotsa words for "allows you to spam them ads".

Yeah I was glad Apple was holding out on this. We've had years now to realize that this API is basically only going to be used to trick users into getting spammed with garbage they don't want. I don't know why Apple chose now to implement them.

The best use of this feature is 'Chrome apps' or "Edge apps" where a web version of an app (like facebook messenger or whatsapp) can live inside the process of the browser instead of their own whole separate process, drastically reducing memory usage and energy consumption. Though it's kind of a workaround for the electron app anti-pattern.

> I literally get calls from people who believe their computer has "malware", and it's just dozens of notification subscriptions in their browser spewing adult content ads onto their screen.

That is most definitely malware.

I agree, Google Chrome is malware. As in these cases it is actually just notification API subscriptions, a feature browsers chose to implement.

I'm under the impression that Chrome requires approval for each origin to deliver notifications.

It does. But that is not adequate. Unfortunately Google does not understand users at all, and hence, unfortunately does not understand practical security.

The first thing you have to understand is that users click everything, especially when it isn't doing what they want. So websites throw these prompts up endlessly, hoping users will inadvertently click it. Worse, some sites will abuse alert() and essentially demand the user accept installing an extension or enabling notifications to proceed. (Particularly guilty here is search ads and the garbage ads Edge puts on their new tab page.)

Then the doubly problematic design here is that websites can prompt people to accept these, but users have to find an obscure setting to either remove those approvals or deny new requests. Users by and large don't even know that exists.

I disable notification requests in every browser I put my hands on, but unfortunately I can't put my hands on every browser on Earth. It's really up to web standards bodies and browser vendors to realize the API is doing drastically more harm than good.

I agree that software (especially "platform-y" software like web browsers) vendors have responsibility to provide informative and unobtrusive UI, in order to (among other reasons) protect users from malware. I also agree that Chrome doesn't do a great job here, and that web notifications need a lot of re-thinking across the board. But I don't agree with the leap to "Google Chrome is malware." Chrome isn't doing enough to protect their users from notifications from malicious websites, but I reject the sensationalist conclusion that Google Chrome itself is malware.

We have a number of technical protections to limit abuse potential and will be monitoring the situation. Websites like Twitter, Facebook, Protonmail, Slack, etc seem like they could benefit from push notifications for the same reason their native apps do. It’s true that other websites ask for low value / spammy uses.

I've seen so much abuse in this on desktop I really think it should be intentionally hard to turn this on. Like registry-editing-level hard.

No one would care about web push if sideloading worked.

True. Although it is nice to have an app be truly cross-platform.

If MS released Windows with pre-installed WSA we would be half way there. The truth is we are still perhaps a decade away from this and everyone running M1's happening so until then PWAs fill the gap

I use browser notifications for google calendar every day.

It is slightly annoying that the notification chime plays for each calendar tab I have open and forgot to close though.

Reply on news.ycombinator.com