I wonder why you say that. I concede that web has evolved from no-security in the 90s, when random applets and ActiveX controls were 1-click away from rooting your machine, through faulty security in 2000s, where stack smashing IE was a hobby of mine, and up to the current era of sandboxes. Which do work, sandbox evasion zero days have become very rare and remote execution has largely ceased to be an infection vector against the masses.
The problem with 3rd party tracking is not technological, the web was deliberately engineered to work in this manner. The browsers work exactly as specified, and that specification is the problem. It's compounded then as a political problem, where major browser investment are controlled by advertising companies that have a massive conflict of interest regarding the users privacy, and are likely to promote bandaids like "Do not track" instead of the fundamental privacy re-engineering the web urgently requires.
> The world has gone mad. I'm going to get a "gopher should've won" tatoo and live in as an hermit on some nearby mountain.
When I'm thinking like this is usually a sign of age. Hang in there buddy, we'll be fine. There is a promised land just around the corner with rich, secure web applications and strong privacy. If only everybody agreed we want it.
I consider that the widespread fingerprinting and user tracking is a form of sandbox evasion but I agree that it goes way beyond JS. The only identifying info that ought to be sent to some website by default is your IP address since it's necessary to actually send you back the data. Having the size of my view port, the version of my browser and OS, the type of video codecs I support and other shenanigans shouldn't leave my browser without my consent. The problem is that I can easily spoof most of my browser's info but JS makes it almost impossible to sanitize everything.
>The problem with 3rd party tracking is not technological, the web was deliberately engineered to work in this manner. The browsers work exactly as specified, and that specification is the problem
How is that not a complete contradiction? I'm not saying it's a bug, I know very well it's just a huge dump of features that keeps pouring in year after year. I'm just saying that web standards are the embodiment of "we were so preoccupied with whether or not we could that we didn't stop to think if we should".
IMO there are broadly two different use cases for the web currently: Web applications like Google Docs on one hand and glorified PDF reader for mostly static content like HN, internet forums, news websites, Wikipedia etc... on the other. Web Apps are the part that require this ridiculous complexity to expose rich content. That's the stuff you'd use Java applets, XUL, Flash or ActiveX for in the past. Those apps could be whitelisted on a site-by-site basis in the same way that you install an app on your smartphone for instance. You know that you expose yourself to bugs and privacy leakages but you know what you're in for.
99% of the websites I browse everyday don't expose any functionality that ought to require any form of interactive scripting or advanced features beyond displaying text and images (and maybe video). Yet my browser will gladly let them access all these advanced APIs by default, load custom fonts, let them run code on my GPU, make 3rd party requests, mine cryptocurrencies... That's just ridiculous.
The safest code is code that doesn't run.
>When I'm thinking like this is usually a sign of age
Come on, we're not old, we're wise! At least I hope so...
https://news.ycombinator.com/item?id=2300836 (2011) https://news.ycombinator.com/item?id=10734966 (2015)
Also: Some user would ask the site's support about the prompts, not the browser's, which would be an incentive to get rid of JavaScript for the site.
The web is a lost cause as far I'm concerned, it was under-engineered at the start and as a result people kept pilling mounds of crap on top to make up for it. What started as a way to display basic markup and images has been arm wrestled into handling complex web applications and videogames. The thing is so complex that it would probably take me less time to write a basic operating system and run Firefox on it than implementing my own browser from scratch on Linux. And despite all of this you end up having to use a billion of 3rd party javascript libraries to do anything remotely complex in the browser, things that have been standard in Qt or GTK since forever with a fraction of the code base and memory footprint.
And now people seem to enjoy reimplementing all the internet protocols on top of HTTP. The world has gone mad. I'm going to get a "gopher should've won" tatoo and live in as an hermit on some nearby mountain.
I'm glad that there appears to be a lot of discussion surrounding internet privacy lately, including in the mainstream. However I think that focusing all the discussion of Facebook is becoming counter-productive. Facebook exploited the weaknesses of the web very successfully but it only exploited tools that existed long before it was created. I have absolutely no illusion that Google & friends are doing pretty much the same thing, and if you have an Android phone the amount of info Google can harvest is nothing short of terrifying when you think about it from an Orwellian perspective. Don't miss the forest for the Facetree.
Assuming that internet giants will adhere to some "code of conduct" is naive at best. "Do no evil", yeah right. We let them have to tools to do these things, we need to pry some of them away from their hands through technology and regulation (probably in that order).