Hacker News Reader

Comment by BizarreByte | Hacker News Reader

I don’t think I’ve ever seen HN react so negatively to a project, but I think that has to do with the image people have of what a “browser” is.

Kristall isn’t very useful for HTTP even though it supports the protocol. That said its goal is the “small internet” and very basic sites on HTTP will work, which is is inline with that goal. Some have complained even Google search doesn’t work, but Google search doesn’t fall under the umbrella of “small internet”.

When it comes to Gopher and Gemini it’s far more useful, but only a small community of people use either in 2023 so that’s not going to appeal to most people here, even though that’s the primary use case of the project.

View on HN

> I don’t think I’ve ever seen HN react so negatively to a project

I thought the title was all wrong. It created false expectations. Too many people thought this was an HTML browser. I first came across Kristall when I was looking at GeminiSpace ( https://en.wikipedia.org/wiki/Gemini_(protocol) ) - the gemini protocol (a replacement for http(s)) plus GemText (a replacement for html).

Kristall is a browser for GeminiSpace - first and foremost. GeminiSpace has embraced some aspects of the legacy small-web - specifically gopher and finger. Lots of the browsers in GeminiSpace support all three: GemText, Gopher and Finger.

Some of these GeminiSpace specific browsers also try to support other types of markup languages (html, markdown) but that's not their primary use case.

I can see that Kristall is trying to be more than a Gemini Browser. It can do well here if it was clear about the level of html it was going to support. I'd be very happy with HTML 3.2 ( https://www.w3.org/MarkUp/Wilbur/ ) for example (mid-90s).

Unfortunately, it doesn't even do 'turn of the century' HTML tables very well - something that the lightweight Dillo ( https://www.dillo.org/ ) does well.

As Kristall's level of html support increases; I'd love to be able to include it as a viable html browser (similar to Dillo and a bunch of other older browsers I have installed). As a GeminiSpace Browser, however, it is among the elite. This should have been its intro to HN.

I wonder if it's a time-zone thing with when the link was posted.

I think I remember reacting myself at least somewhat negatively to Gemini first time I heard about it, so on some level I understand how someone's initial reaction could be hostile -- but I also feel like "limited tools producing tight-knit communities and specific community-tailored content" is right up HN's alley, and I am also surprised to see so many people questioning why this should exist.

"It doesn't work for the majority of the web."

So? I assume the project isn't lying, it does actually support HTML. I just don't see how it's a bad thing to have a lightweight browser that handles static HTML; I don't think anyone is advocating that anybody uninstall Firefox over this.

----

I'll kind of go a step further here and give a mildly hot take: nobody should be doing normal browsing on an indie browser in the first place; I consider that a likely security/privacy risk. The vast majority of indie browsers do not have full-featured uBlock Origin support, they don't have the browser hardening features that something like Firefox ships with by default.

So on some level I feel like "can I use this to read CNN" is not necessarily a great metric to use for an indie project, because if you're reading CNN it should probably be in Firefox with uBlock Origin installed (or something comparable, but I typically advocate that Firefox and its derivatives have better tracking protection than other mainstream browsers).

In contrast, if something loads in this browser, what is your security risk? Limited MITM attacks and network analysis? I don't feel the same aversion I feel to most indie web browsers when I think about someone reading a limited number of indie web articles in this thing or building projects around it.

Peoples sense of the internet is just a corporate engulfed dystopia, they don't see a reason behind this because they haven't experienced what it could be otherwise.

Ehh, I don't think this would support the Internet Archive (hardly a corporate-engulfed dystopia), or even have supported the shitty Sailor Moon fansite I made in 1998.

I wonder if it's possible to start with one of these small-internet browser projects and expand it to the extent of adding CSS and adding some mechanism to handle something like HTMX provides (without including javascript capabilities).

I haven't fully thought this idea through, but it does seem like it would be a manageable way to start a non-corporate browser that could handle modern layouts and some degree of interactivity without the mess of privacy and security issues that javascript introduces.

Thats a cool new idea for sure, go for it!

You can't call it an internet browser if it doesn't work properly on 99.99% percent of existing pages. It's like calling telnet a browser, when it only accurately displays text/plain.

> internet browser

But it's not a small internet browser it's a small-internet browser. It is made to browse the "small-internet", which is not the same thing as the internet.

There is no definition of 'small internet', so is the UX of this browser dependent on pasting in URLs and see if they load?

The Internet is simply a collection of IP networks.

The World Wide Web is the collection of HTTP servers and "Web Browser" clients like Chrome, and, uh, Chrome. Also WebKit.

An "Internet browser" would be something like `dig`. Though, maybe that's better called a "DNS browser" in this boring world where every app that talks to one or more remote servers must be called a browser.

I use a text-only browser, i.e., an HTML reader than can make HTTP requests, with no support for CSS, JS, WASM, etc. and I access the entire web with it. For Gopher and Gemini I find I do not need a browser.

These projects do not have to appeal to large numbrs of people. The goal need not be large audiences for advertising.

I have no idea how many people use the same browser I do, that has not mattered IME and TBH I really do not care. Although I have seen on the project website that a number of companies made donations to sponsor certain features, and the company names and amounts are listed on the website. Those companies must have found the program useful.

Methinks there are just so many folks who have bet their entire livelihood and career on the asymmetry that the web has enabled, where its users are generally powerless and control nothing on their computers. Anything that could give control to users is perceived as a threat. This is highly dysfunctional, IMHO.

Even when such things have nothing to do with whatever commercial endeavors these folks are engaged in. I use HTTP every day via small programs I can edit and compile and therefore control. Everything works. I can do "industrial strength" web search without ever opening a browser. I find it hard to imagine these techniques would not be useful to others.

The internet needs need more projects like Gemini and Kristall.

Check out the arguments Google tries to make about its position as the "default browser" in this court filing from earlier this week. The company pays hundreds of millions of dollars to various parties in order to be the "default" search engine, its CEO himself was engaged in setting up such "payola" arrangements for Google prior to becoming CEO, but one would never guess that from the assertions Google is making here.

https://ia802501.us.archive.org/21/items/gov.uscourts.dcd.22...

What if these operatings systems were, by default, set to cycle through a list of search engine choices, randomly selecting one each time a search is submitted, until the user chooses one as the default. Over time, the user might become familiar with a variety of search engines. She could then make a more informed choice about which one to set as her "default". Instead, what we see in this motion is one "tech" company arguing that other "tech" companies think it is superior. Who cares what "tech" companies think. What do users think.

I think part of the problem is that the "small internet" isn't a concretely definable thing in the same way that "Gemini space" is. Gemini browsers are meant to browse Gemini space and the expectations and limitations of that are known ahead of time.

Meanwhile, this app is meant for browsing an unknown, undefined limited subset of the plain old HTTP web; and when you step out of that sandbox (and you most definitely will inadvertently do so) what you are left with is a broken experience. A web browser that goes out of its way to not support foundational basics is just a shitty web browser given that my normal web browser can hit the same sites.

> Some have complained even Google search doesn’t work, but Google search doesn’t fall under the umbrella of “small internet”.

Yet it works on links, lynx and probably few other text browsers.

Sometimes small is too small

Restricted functionality is a security benefit - could be interesting in some scenarios... Not mentioned by the project's presentation, but there has to be an audience there.

> Restricted functionality is a security benefit

This is a common trope I hear but I'm not sure it's true any longer.

One of the reasons Google login requires JavaScript to be enabled is to fix flaws in non-JS HTML that allow for hijacking passwords. It's why they took a much harder line on simple auth a few years back; too many instances of people being tricked into handing their Gmail account to scammers.

What flaws allow sites to hijack passwords if pages aren't programmable? Are you talking about phishing, and how would js help?

My mental model here is that the browser's password manager autofills a password that the user doesn't even know, and without scripting or dynamic resources, it's not possible to exfiltrate that data automatically. Without styling, form buttons would have a standard look so it's harder to trick the user into submitting something without knowing (c.f. the recently posted fake captcha that tricks users into revealing the visited state of links).

HTML and CSS alone allow you to concoct a webpage where a user's input appears to be going to one place but is in fact going somewhere else.

https://en.wikipedia.org/wiki/Framekiller

The OP link is a browser that doesn't support CSS. Not supporting frames seems like it'd also solve that problem.

Edit: also, in a modern browser, passwords are autofilled by the browser which knows where input is going and can't be tricked. You could make an argument about other sensitive information, but that sounds like it's the same as plain ol' phishing.

Agreed.

Unfortunately, there's no language for querying the client "Do you support CSS" / "Do you support frames" without CSS so Google is forced to err on the side of caution and reject browser that don't support JS (because they can query that).

Webdevs are aware of flaws in their browser so that they have to hack up a bunch of javascript in order to safely login instead of cooperating with the browser developers, which are their employees.

On the other side chromium devs need to develop quirks/hacks for specific sites in order to support their bloated javascript hacks (:

I find it bizzare.

It's not flaws in the browser; it's flaws in the design of HTML and CSS (i.e. "Oops nobody realized that a real right bastard could bend the static rendering tools to make this happen; well that's a problem"). I'm having difficulty sourcing the details right now, unfortunately; I believe the issue was that non-JavaScript HTML combined with CSS lets you frame-in the target site's login page but situated in such a way that the user thinks they're doing something else, and their clicks and keyboard input go into another page's content / security domain. Breaking this attack requires the framed-in site to be able to use JavaScript to detect that they were framed-in and break out.

https://en.wikipedia.org/wiki/Framekiller

It's one of those situations where "This was mis-designed with insufficient eye towards how right bastards could use it, but the cat is out of the bag. We can't change the spec because it'll break legitimate uses of this technology, so this is the best option we have." Similar to how images were naively scoped to be embeddable from any web domain and then people invented pixel bugs, but you can't change the security model around image loading without breaking vast swathes of the existing web.

My guess would be: using CSS to place the malicious site's input files exactly where the framed site's input fields are, but "on top" (on the z axis), so the user actually inputs data into the malicious site.

How is this “attack” any different than simply mirroring the site? The URL bar shows the malicious site either way. If you enter your password on the malicious site, you’re pwned. Don’t need frames for that.

> The URL bar shows the malicious site either way

That's never been sufficient to keep bad actors out because end-users don't grok the URL bar.

This attack is superior to a mirroring attack because it uses the target site's own UI resources, so it looks very legit (no need to pay someone to monitor the UI of the target site for changes and rework your exploit to attack them).

I think the problem is that they are trying to sell a radio as if it were a TV.

They're "selling" a TV as a TV when the world has switched to using full-blown mind-control shopping malls as TVs.

IMO the better comparison is selling a 9” black and white TV with only an OTA antenna as input as a TV in 2023: technically correct, wildly out of whack with customer expectations.

It's a project that offers support via IRC, the average internet customer/consumer is not the target user base.

I think they point here is, they make it obvious that they don't want to support JS,CSS, etc... The support for other protocols is the same thing - neither a finger page, nor a gophermap need css or JS.. So if you want to use it with the part of the web that requires those, this is not for you. It's a tool for those who use a different part of the web. Those who only need a TV and not a circus. One might see a commentary about the state of the web in the project, but not necessarily - it's just a tool for those who have a need for it, e.g to browse the intranet for a research institute.. if this browser is all you need for that you greatly reduce the attack vectors on your institute among other benefits.

Given that customer expectations of TVs now include being normalized to TVs getting slower with updates that cannot be avoided without jumping through hoops, sometimes even bricked, and occasionally even showing ads because the company you bought it from decided they needed to extract more wealth from you, that is pretty spot on. But perhaps not how many people think it is.

Except, of course, that they're not selling anything.

He means sell as in persuade people to use

Which they're also not trying to do. It's just a cool project, shared for those that want to use it.

Exactly this, someone shared a project they thought was cool and that they thought others might find cool as well.

The hostility displayed towards an open source project in this submission is completely excessive just because it doesn't meet the requirements of many/most users. I'd feel awful if I were the creator of it and read the comments here, which are being extremely harsh about what is otherwise a very nice little project.

Personally I find it very useful, but I'm the type of person who would.

I mean, that's the source of the complaint though.

It's 2023. If it doesn't work on google.com, it's not a browser that works on "The Internet" (due to conflation of terms over the years, people assume that "The Internet" means "The Web," especially when the term "browser" is mixed in there).

To be clear though, a much better user interface for retrieving and displaying small documents through gopher, gemini, and finger in addition to HTTP is pretty cool.

What a sad mindset to believe google = internet ...that's just sad, especially for HN

"Opening a browser and going immediately to a search engine" is how most users use the Internet (proxy statistic; google.com is the most visited web page by a country mile, followed immediately by YouTube, Facebook, and Twitter). A browser that doesn't work with the most popular web pages is not a "browser" for practical purposes of most people.

... which is fine, but I suspect the headline is throwing readers here off because they're equating "browser" to "web browser" and then the actual tool flips their bozo bit when it can't even properly render popular sites in a degraded mode. Perhaps the tool can use better branding: "A general-protocol Internet document browser that can also do some HTML," for example?

It's not a browser for "most users", and with your logic there are just two "computers" Apple and Windows.

I also have a File-browser on my system and it has nothing todo with html or google.

>they're equating "browser" to "web browser"

Yes they also also say Cloud = Google-Drive, do you really want to go that route?

Well, Apple, Windows, and various GNU/Linux distros (as they can also run Chrome and Firefox, i.e. two of the most popular apps, plug in a mouse and keyboard, do 99% of the "computer stuff," so they're fine). Chromebook is probably on the fence since you really have to beat it with a hammer to run Excel on it (depending on how you turn your head and squint, that's maybe true for Linux also, but you can get Excel running on there if you really shoulder into getting your compatibility layers working).

... but nobody considers the Arduino a "computer" in the same sense they consider a Raspberry Pi a "computer" because it can't run general-purpose apps.

Yeah let's stop here, you say people think Linux can run "general-purpose apps" but a raspi cant. Just stop try to prove your right...by moving the goalposts.

Arduino is a Micro-controller, Raspberrypi is a SBC -> Single board computer.

>>and user community that designs and manufactures single-board microcontrollers

https://en.wikipedia.org/wiki/Arduino

>>Raspberry Pi (/paɪ/) is a series of small single-board computers (SBCs)

https://en.wikipedia.org/wiki/Raspberry_Pi

And no, don't start with your "but normal people blabla"...because "normal" people go to wikipedia to learn something ;)

No, a RasPi is a GNU/Linux platform and can run general-purpose apps. You misunderstood my comparison; RasPi is a computer.

I'm saying nobody considers an Arduino a "computer" in the same category as a Raspberry Pi is a computer (and similarly, nobody should consider Kristall a web browser, though it is something else, which is cool).

> a raspi is a GNU/Linux platform

I run BSD/BSD on it and it's not a platform but a Computer.

>nobody considers an Arduino a "computer"

True, because it's a f*** Microcontroller understood?

Yes, we're saying the same thing.

And by analogy, Kristall is a "microbrowser" and I think HN had a bad reaction to it because the top-level description was "a browser."

It's the Arduino of browsers.

That doesn't make it bad, but this site is full of pedants and when you call a tool by a slightly-different name, you get "um-actually'd" to death.

(Sometimes, you even get someone swearing at you because they think you don't know the difference between a general-purpose small computer and a microcontroller ;) ).

Reply on news.ycombinator.com