Hacker Newsnew | past | comments | ask | show | jobs | submit | more madeofpalk's commentslogin

> What if that person is on a slow link? If you've never had bad internet access, maybe think of this as plane wifi

Loads of people are on "a slow link" or iffy internet that would otherwise have a fast internet. Like... plane wifi! Or driving through less populated areas (or the UK outside of london) and have spotty phone reception.


Thank god we have Go! /s


I mean... yes?


It cannot be a standard until two browsers ship the API.


Technically, it’s not two browsers shipping it, it’s two independent implementations. Otherwise everything that Google ships as part of Blink would become a standard as soon as any one of the other Blink-based browsers (e.g. Edge) includes it.


lol. As long as a browser with Chrome's market share ships it, it will be used.

Whether it's an official standard by some criteria doesn't matter.


> The Chrome team has also asked for formal Standards Positions from both vendors, see the Related links section. The <permission> element is an ongoing topic of discussions with other browsers and we're hoping to standardize it.

I don’t understand this proposal enough to have an opinion yet, but that sure is an interesting way to say both Firefox and WebKit oppose it.

https://github.com/mozilla/standards-positions/issues/908#is...

https://github.com/WebKit/standards-positions/issues/270#iss...


This bit from the WebKit response hits hard for me:

> Security Complexity: Proposed security measures (styling constraints, timing, and position mitigation) add substantial complexity, indicating possible fundamental issues with the approach.

"Security complexity" is never something you want to see, because it will become yet another game of whack-a-mole between browser makers and hostile websites (i.e. between Chrome and Google Ads). Does anyone believe that a standard will hold up against the AdTech industry armed with the full power of HTML+CSS+JavaScript? These are the people who brought you the "Enable push notifications? Yes/Pester-me-later" pre-prompt.


Google probably wants to bring the "maybe later" anti-pattern to the browser permission system:

https://tildes.net/~tech/1d9u/im_thoroughly_done_with_my_cho...

It's a reminder that Google is not a friend, but an ad-versary, and that you aren't given a free browser to happily navigate the internet, but to be milked by the ad industry.


Considering that Chrome doesn't support getAutoplayPolicy() even though it's been 7 years since browsers decided to break autoplay for everyone, I'm pretty sure Google doesn't have any good intentions here.

If you have a website that relies on autoplay, because it is basically just one giant video element, then there is no way to detect that autoplay is blocked and fall back to a stopped video. You're forced to essentially not use autoplay at all. When autoplay is blocked you don't get an error, the autoplay events are simply disabled. You can't prove the absence of the event even with an invisible silent sound being played in the background. That's what getAutoplayPolicy() is for and guess who didn't implement it.


Maybe they don’t want to update this web page if the other vendors change their minds? They have links instead.


They never update web.dev pages, and often present not-even-close-to-being-standard as done deals


iOS 7's first beta design was worse than this. They walked back some pretty distinctive parts of the design - mainly the ultra thin fonts - during the betas and following releases.


Agree to disagree I guess - iOS 7’s initial preview wasn’t perfect but not incoherent and illegible to this degree.

If anyone wants to refresh their memory: https://youtu.be/6jBK3Dggkwg

Not to mention way more functionality added to the OS that year than this.


Javascript does. lodash is/was pretty common. Most of the stuff as been absorbed into the standard library now.

Lodash has had pad/padStart/padEnd since 2016, 3 months before left-pad incident. https://lodash.info/doc/pad


What is a way in which you could disprove this?

How could you disprove that the Ubuntu ISO doesn’t do the same thing?


Well apart from monitoring network traffic, with Ubuntu you can examine the source code for anything that you don't trust or dive into what system calls an application makes by using "strace".


How is this different for Windows? Can’t you monitor Windows network traffic as well?

Does Ubuntu provide reproducible builds? How do you disprove that the source code isn’t for the thing that you’re downloading?

The (not so) revealing thing here is that this isn’t a technical problem, but that Microsoft has just completely lost the trust of people.


Well you can try monitoring Windows network connections, but Microsoft do seem to love obfuscating it with connections to multiple different domains that they own.

You can't even look at the Windows source code, so your question about reproducible builds seems to be moving the goalposts somewhat.

Also, is there something like "strace" on Windows?

Edit: just looked it up and Ubuntu doesn't enforce reproducible builds, although with their new "Monthly Snapshots", Canonical is moving towards reproducible build pipelines.


What is Ubuntu's source code worth for when you download precompiled binaries without checking if they were built with that source code?


That's your choice to do that and depending on your threat model, you may have some level of trust in Canonical to not screw over their customers.


I asked my original question very deliberately.

At the end of the day, it’s just about trust and reputation. I see no technical difference here for the ability to disprove random claims.


The necessary technical and UI/UX difference would be capability-based (https://en.wikipedia.org/wiki/Capability-based_security) microkernels like Sel4 or Genode combined with high level user interfaces that allow one to monitor and control the rights and actual resource access and usage of programs


However, it is possible to audit the Ubuntu software against the source code which is something that you cannot do with Windows. That is a technical difference even if you don't acknowledge it.

Also, Linux does make it much easier to determine your level of trust as the different components can be analysed/verified independently (although systemd is a bit of a monolith) whereas it's a lot trickier to isolate Windows components.


even without reproducible builds, you (or someone you hire or someone who's motivated) can get the source and create a drop-in replacement.

This is even more true on some other distros, eg Gentoo.

Without source and rights, Windows fails completely here.


> more and likely reports a lot of this back to ms

Isn’t this the literal definition of FUD? Fear, Uncertainty, and Doubt.

I would like to hope the orange site approaches this topic with more substance. Do the analysis of network traffic to see what gets sent home. Decompile the binary to check it out for these sorts of things. Don’t just write your anti-MS fanfic and pretend that it’s something meaningful.

People and object detection are pretty baseline features for a photo management app these days IMHO. I like that my photos app automatically finds all the photos of my dog.


Why would it need to be performing facial analysis and have over 120 tables of information in the first place?


Automatic albums of people is table stakes for a photo management app. Everyone has it - Apple Photos, Google Photos, Immich, etc.

That requires facial detection.


I disagree. I don’t want that feature. None of the photo apps I use by choice have it, and I’ve never once used it on iOS. It creates multiple albums for the same person anyway so it’s useless.


You not wanting it != table stakes for a photo app.

I use it, my family uses it, my friends use it. Anecdotal data to be sure. But I think if barely anyone used it you wouldn’t see it as a base feature in almost every photo sharing app.


That’s like saying an AI co-pilot is table stakes for an operating system. It isn’t.


It is how the default photos app for ios and android work and have worked for years. If you can't search by person or by the content of the photo you're falling behind.


I would argue such feature only exists on big tech photo apps as an excuse to do facial recognition and eventually extricate such data trough whatever means. The benefit to the user is just a minor side effect.


I would argue that’s another example of FUD. It’s a useful feature a lot of people like. Similarly I find geotagging of photos tremendously useful. I don’t believe that feature was added to phones to extend the surveillance state, I believe it was added because a camera was combined with a GPS and it made logical sense.


Lots of things aren’t done on purpose, but they are sure taken advantage of by other parties.


Sure. But that’s the opposite of OP’s assertion.


No, this actually provides utility


> I would like to hope the orange site approaches this topic with more substance.

You won't find that here if Microsoft/Windows is in the title. HN will default to FUD on anything from Redmond.

How many here complaining about analysis in the photos app on Windows also sync all their photos to iCloud or Google Photos, which does the exact same thing? I bet it's a lot.


I guess the question is whether e-commerce should be a core competency of a business with a significant e-commerce business.

I’m not sure what it’s like in the US, but grocery delivery is a reasonably big deal in the UK.


Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: