Hacker News Reader

Comment by RiverCrochet | Hacker News Reader

The thing I liked about Gemini and its self-imposed limitations is that it was very much impossible to create a misbehaving Gemini document. There is no way a Gemini browser will phone home, run malicious code on my side, grab/upload my browser history or send sensor or other data because I forgot to turn off various options, etc. To me the entire thing was much more trustworthy.

You can of course recreate this experience using HTTP and modern browsers, but both are so complicated that you don't know what's really happening without a lot of work.

View on HN

This should really be a more common feature in web browsers. Yes, it can be achieved by turning off JavaScript and so on but it should be a feature like Incognito mode where you have either a high visibility toggle button, or open tabs in this mode, where tabs with the same kind as the parent keeps being opened in this mode. That way, you’d have Gemini for the regular web just by making websites that don’t break when that kind of code is disabled.

HTTP has infinitesimal complexity compared to basically any other feature of a browser.

I liked that as well, but wouldn't remember it before reading your comment. I guess all in all it is a pretty nice protocol, the only real problem for me is that the content is too niche to appeal to me on a daily basis.

Instead of inventing a separate protocol, you can invent your own html meta tag that marks a website to be JavaScript-free.

This will let you create search engines that crawl and index these sites specifically.

With .gmi files or "gemini://" URLs and a compliant Gemini client, I don't need to even need to load the document beforehand to know if it intends to execute code on my device or not. It already won't by design, it won't in the future, and it doesn't require settings management, vendor whitelisting, popups, or caring who makes the browser for me to make it behave that way.

Whereas that .html document with it's noexec meta tag might be updated in the future to suddenly contain code.

You can create a browser plugin that detect such tag and automatically turns off JavaScript.

You can even configure the plugin to detect if a page contains JavaScript while claiming not to be.

With a dedicated Gemini client I simply have to trust/verify code provided the client developer.

With your solution now I have to trust/verify code provided by the browser developer(s), the apparatus the browser provides for extensions, and code provided by the extension developers.

If I'm super paranoid I can just look at a .gmi in Notepad or vi and understand it. I can't do that with all but the most basic HTML.

Ok I guess if you are that level of paranoid - even though both Chromium and Firefox are open source and under a heck of a lot of scrutiny for security vulnerabilities - then I understand why you prefer Gemini.

I just feel the fact that it cuts it self off from the wider clearnet completely kills your audience reach, if you’re ok writing to a very small insular community then sure, but most people want their writings to be read by as many people as possible.

Reply on news.ycombinator.com