Comment on Chrome is worth around $50 billion, DuckDuckGo CEO guesstimates

• rottingleaf@lemmy.world ⁨13⁩ ⁨hours⁩ ago

  Not exactly what I said. I think these two were bad, but the idea of plugins was good.

  Especially the uncertainty of whether a user has a plugin for the specific kind of content.

  One could use different plugins, say, that plugin to show flash videos in mplayer under Unices.

  It’s worse when everyone uses Chrome or something with modern CSS, HTML5 etc support.

  The modularization was good. The idea that executable content can be different depending on plugins and is separated from the browser. I think we need that back.

  And in some sense it not being very safe was good too. Everyone knew you can’t trust your PC when it’s connected to the Interwebs, evil haxxors will pwn you, bad viruses will gangsettle it, everything confidential you had there will turn up for all to see. And one’s safety is not the real level of protection, but how it relates to perceived level of protection. That was better back then, people had realistic expectations. Now you still can be owned, even if that’s much harder, but people don’t understand in which situations the risk is more, in which less, and often have false feeling of safety.

  One thing that was definitely better is - those plugins being disabled by default, and there being a gray square on the page with an “allow content” or something button. And the Web being usable in Lynx.

  source

  • sugar_in_your_tea@sh.itjust.works ⁨13⁩ ⁨hours⁩ ago

    The modularization was good.

    The modularization was a security nightmare. These plugins needed elevated privileges, a d they all needed to handle security themselves, and as I hope you are aware, Flash was atrocious with security.

    Having a single “plugin” system means you only need to keep that one system secure. That’s hard enough as it is, but it’s at least tractible. And modern browsers have done a pretty good job securing the javascript sandbox.

    That was better back then, people had realistic expectations

    I don’t think that’s true. I think there just weren’t as many attacks because there weren’t as many internet users. Yet I also remember getting viruses all the time (at least once/year) because of some vulnerability or another, and that’s with being careful.

    You should take off those rose colored glasses.

    I appreciate that people not knowing as much about security is problematic, but that’s because the average person is far more secure than they were even 10 years ago. Getting a virus is pretty rare these days, Microsoft has really stepped up their game with Wndows and browsers have as well. I haven’t worried about getting a virus for many years now, and that’s thanks to the proactive security work in sandboxing and whatnot that limits exploits.

    A lot of the scams and whatnot these days either attack outdated systems (esp. insecure routers running default creds) or merely use social engineering because you can’t simply use an off-the-shelf flash exploit or something to get privilege escalation to install your malware. Attacks certainly exist, but they’re far less common than they were 10-20 years ago as people started being online constantly.

    those plugins being disabled by default

    Yes, I am annoyed at JavaScript being enabled constantly and not having fine-grained control over specific permissions (mostly just location, mic, camera, and storage).

    Unfortunately, that ship has sailed. But I still very much prefer the modern “everything uses JavaScript” to the old insecure Flash and Java applets.

    source

    • rottingleaf@lemmy.world ⁨5⁩ ⁨hours⁩ ago

      The modularization was a security nightmare. These plugins needed elevated privileges, a d they all needed to handle security themselves, and as I hope you are aware, Flash was atrocious with security.

      Those - yes. But generally something running on a page receiving keystrokes when selected and drawing in a square and interpreting something can be done securely.

      And modern browsers have done a pretty good job securing the javascript sandbox.

      One can have such a sandbox for some generic bytecode separated from everything else on the page. Would be “socially” same as then, technically better.

      source