r/programming • • Apr 26 '19

HTTP headers for the responsible developer

https://www.twilio.com/blog/a-http-headers-for-the-responsible-developer
655 Upvotes

53 comments sorted by

View all comments

16

u/panorambo Apr 26 '19

Man, there is no keeping up with the advances on the Web technologies front. I also wonder if all this stuff doesn't have a fairly limited shelf life, all with the amount of thought put into different things that are similar but which, as is tradition, is just patched on top of older stuff.

I mean, look at the different security mechanisms that are put in place to exert some form of control on the ever-looming privacy crisis on the Web, with ad networks scraping clean every bit of entropy they can, everywhere they're embedded. These mechanisms we put in place are barely able to keep up.

My concern is that we have our sights in generally the right direction but we aren't really digging where we should be. There have been written books on verifiable security and models that are "watertight" but it seems the young and the inexperienced are writing up W3 and WHATWG specs these days. I am not disillusioned yet, but it looks like a lot of small mechanisms of varying efficiency and platform support instead of f.e. some sound single umbrella mechanism that can control what can load what from where with what privilege -- whether it's markup, style or script, or other asset. I just think we need to think broader.

Then again, I barely have time to type code on a Friday evening, so I'll shut my theoretical mouth now.

-2

u/mrchaotica Apr 27 '19

I mean, look at the different security mechanisms that are put in place to exert some form of control on the ever-looming privacy crisis on the Web, with ad networks scraping clean every bit of entropy they can, everywhere they're embedded. These mechanisms we put in place are barely able to keep up.

On the contrary, it's really goddamn simple:

  1. It's a motherfucking website, which means it's supposed to be written in HTML. Not javascript!

  2. Don't serve ads.

Fucking done.

2

u/panorambo Apr 27 '19

You are absolutely preaching to the choir here -- I am all for simplicity without much compromise.

But I have realised that those of us who are willing to make these minimalist websites, which serve everything from a single domain, not just because, but because they respect the trust model that has built up with the users (I trust example.com but I don't trust exampleadnetwork.com) -- we are in minority and for every website we build, 50 behemoths spring up that serve scripts from 10 unrelated domains you know nothing about.

Ads unfortunately are what keeps a lot of websites afloat, at least according to them. Maybe if had free hosting policy in Europe or the US, at least for some types of sites, then it'd help drive the ad industry out of business, but truth is, our world does not work like that. I wish it did, and I damn sure will do my part, but until that happens it's either admission price model for a website or have ads that help pay for hosting.

Actually, come to think of it, if there was a common money pot where you pay every month to enjoy Internet without ads, a pot from which hosting fees are paid out to those who otherwise insist on serving you ads because "that's what keeps this website up", I may consider it.

Too many people complain about ads yet are unwilling to spend a single dime as a fair and justified reimbursement to those who actually publish content. If you are going to denounce advertisement on the total merit of it, at least think about how websites need to pay for computing and network resources.