Comment by takluyver | Hacker News Reader

Comment by takluyver | Hacker News Reader

Parent Full thread

Ironically, that decision to run Javascript without a prompt was probably a huge step forward for the security of most users. The 'do you trust this' model of security doesn't work well in practice once you can download programs from the internet - there's too much stuff you need to or want to trust to get on with things, and even if it's not actively malicious, it may be vulnerable.

Because Javascript can run in the browser without the assumption that you completely trust it, browser developers have put a load of work into restricting what it can do, even within the browser. Of course, sometimes there are holes in the sandbox - nothing is perfect - but I think it's vastly better than giving any program you decide to run complete access to your computer.

(Better for the majority, that is. If you're truly paranoid and have enough time, explicitly deciding what to trust can be better. But I think that's <1% of people - certainly not including me.)

This argument makes sense for the security angle. At least as it pertains to getting malware on your local machine.

But what about all of the "not security" but bad things that happen because we allow people to run code we have no choice over on our computer. The attention tracking features marked as tools to understand user intents are exfiltrating information from you perhaps when you don't expect.

Are you happy for example for someone to be logging where on a screen you are sitting and reading within a book or video. Do you not find it problematic for example that you could purchase a subscription to medium, but medium finds out you pause your computer to read descriptions of guns? Would you mind if they then sold this knowledge to Glock who then showed these ads on your work computer?

I get what you are saying for security. But "knowing" if and when something is happening is important. I may be worse or better at evaluating applications to run on my machine than the chrome team. But at least I know when I am entering into a risky situation.

That makes sense. But I think that's a money problem, not a technology problem - if the money was sloshing around desktop applications, I think we'd get a lot of locked down desktop applications tracking us. We kind of have that on mobile, indeed. Sometimes there are nice community built alternatives, but not that often.

Reply on news.ycombinator.com