Hacker News new | ask | show | jobs
by dpedu 989 days ago
That's why they want the Web Environment Integrity api.
3 comments

And that's why we leap to Firefox + UBO.

Until, of course, we get the modal of death: "For best and safest experience, must view on officially certified Google Chrome (tm) (r) (diaf)."

> And that's why we leap to Firefox + UBO.

> Until, of course, we get the modal of death: "For best and safest experience, must view on officially certified Google Chrome (tm) (r) (diaf)."

Which will probably happen super fast (unless antitrust regulators get involved) since Firefox's market share is in the toilet and continuing to drop.

Firefox also can't push too hard, since (IIRC) pretty much all their funding comes from Google.

I'm trying out Orion by Kagi: https://browser.kagi.com/

But I would also consider Waterfox: https://www.waterfox.net/

They're WebKit-based and for MacOS/iOS/iPadOS only, so they don't get max points for browser diversity, and I can't run it on my Linuxes. As far as I understand, they plan to target more operating systems, and to target the most popular add-ons for other browsers.

I'm not satisfied until it supports an OS-agnostic (non-sucky, no thank you 1Password) password sync and works on Linux.

I hope they'll grow into a worthy alternative to Firefox, because Firefox is going down.

One review of alternatives here scores Waterfox at the highest, but I think I prefer if a company is behind it:

https://www.youtube.com/watch?v=DgFS1Do_1As

That's ok, we split the internet then.
Subresource Integrity has been around for much longer & seems like a much more effective & targetted plan to combat extensions having control over embedded content.

If the fetched data doesn't match what the page says it should be, it won't work. Another pro-security feature that DNGAF about user agency.

judging by the flame fest they received on their github issues/comments section, I doubt they'll be proceeding. Then again, money talks and b.s. takes the walk every time and twice on sunday.
The standard playbook on this is: table it for 6 months, then try again as quietly as possible. Repeat until the outrage is tolerable. Works great for corporations and governments alike. Eventually people won't be outraged and will just quietly take whatever they're giving us.
I don’t think some angry comments on GitHub are going to stop them with the amount of money on the table here.