Title: The web browser I'm dreaming of Date: 2021-05-17 14:30 Those are the main features I'm expecting from a web browser: - Written in a memory-safe-ish language that a plebeian like me can understand, review and contribute to, like [rust]( https://servo.org/) and [go]( https://github.com/danfragoso/thdwb ) or even [lua]( https://github.com/rdlaitila/LURE ) or [V](https://github.com/vlang/vbrowser), but please no [lisp](https://common-lisp.net/project/closure/), [elisp](https://en.wikipedia.org/wiki/Eww_(web_browser)) or [haskell](https://github.com/chrisdone/vado). - Sandboxed to death. - Ability to [block ads](https://en.wikipedia.org/wiki/Ad_blocking) because the web is a hot bubbling cesspool. - a sensible subset of modern [https](https://en.wikipedia.org/wiki/Https), [html5](https://en.wikipedia.org/wiki/HTML5), [css3](https://en.wikipedia.org/wiki/CSS) and [http 1.1](https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol) (and maybe [http2](https://en.wikipedia.org/wiki/HTTP/2) if you're feeling fancy, because multiplexing requests is neat), - basic javascript (or even better, [typescript](https://en.wikipedia.org/wiki/TypeScript)) support, with something like a dumb interepreter, also written in a memory-safe-ish language. - maybe [tabs](https://en.wikipedia.org/wiki/Tab_(interface)) Now here is a subset of the ones that I don't want, and that the vast majority of websites and their users either don't care about, don't use, or even shouldn't be using in the first place : - Ridiculous performance hacks: - [WASM](https://webassembly.org/): The web used to be readable-ish, debuggable, observable-ish and introspectable. I don't want to run assembly in my web browser and lose those properties, for what exactly? Mining bitcoin/[monero](https://monerominer.rocks/), cross compiling programs to make fun demos, and providing a `RWX` segment for every browser exploits. - [WASM SIMD](https://github.com/WebAssembly/simd/tree/master/proposals/simd): if your website *needs* to use [SIMD](https://en.wikipedia.org/wiki/SIMD) with webassembly, you're either doing something non-exclusively terribly wrong, idiotic or useless. - [WebAssembly Managed Objects / GC](https://chromestatus.com/feature/6062715726462976): "This will allow WebAssembly to implement garbage collected languages efficiently.", because implementing new languages in javascript is a completely mundane task done by the majority of websites. - [WebAssembly BigInt Integration](https://www.chromestatus.com/features/5648655109324800), [WebAssembly multi-values](https://www.chromestatus.com/features/5192420329259008), [WebAssembly Reference Types](https://www.chromestatus.com/features/5166497248837632), [WebAssembly Type Reflection JS API](https://www.chromestatus.com/features/5725002447978496), … can't wait for this to go full-circle and to have WebJavascript! - Crazy [optimizing](https://firefox-source-docs.mozilla.org/js/MIR-optimizations/index.html) [compilers](https://v8.dev/docs/turbofan)/[JIT](https://hacks.mozilla.org/2017/02/a-crash-course-in-just-in-time-jit-compilers/) [contraptions](https://firefox-source-docs.mozilla.org/js/index.html) with [ungodly hacks](https://v8.dev/blog/pointer-compression): we shouldn't need those to have usable webpages. Firefox, for example, [has](https://hacks.mozilla.org/2019/08/the-baseline-interpreter-a-faster-js-interpreter-in-firefox-70/) two-tier interpreter and two-tier JIT. Google Chrome [has](https://bugs.chromium.org/p/v8/issues/detail?id=9684) 3 tier JIT and an interepreter. Previously, it was JIT-only, then 2-tier JIT, then 2-tier JIT plus interpreter, then 3-tier JIT plus interpreter, then singler-tier JIT plus interpreter. I want my javascript to be stupidly interpreted, I don't want [speculative type inference](https://ponyfoo.com/articles/an-introduction-to-speculative-optimization-in-v8), I don't want profile-based optimizations, … I want less code involved with javascript, and I don't care about having near-native performances in this area if it comes as such a high-price complexity-wise. - [DNS prefetching](https://www.w3.org/TR/resource-hints/#dns-prefetch): self-host your resources, instead of delegating them to a steaming pile of untrusted statistics-hoarding CDN kinda obsoleted by http2 anyway. - [Async and defer](https://html.spec.whatwg.org/multipage/scripting.html#attr-script-async), instead of *not* loading gargantuate amounts of javascript. - [Subresource loading with Web Bundles](https://chromestatus.com/feature/5710618575241216): no. - [Battery-savings meta tag](https://www.chromestatus.com/features/5653874167775232): don't eat my battery in the first place. - [WebCodecs](https://www.chromestatus.com/features/5669293909868544): "support emerging applications, such as latency-sensitive game streaming, client-side effects or transcoding, and polyfillable media container support". Nobody except Google is doing game streaming in a browser, and nobody except youtube wants to have web browsers doing transcoding. - Things my operating system is already doing, but apparently needs to be done by my special snowflake of a web browser. - [Fullscreen API](https://developer.mozilla.org/en-US/docs/Web/API/Fullscreen_API) - [Multi-Screen Window Placement](https://www.chromestatus.com/features/5252960583942144): I already have a windows manager taking care of my screen estate. - DNS things: - [DNSSEC](https://caniuse.com/dnssec), because in the Chrome Security Teams' [own words](https://bugs.chromium.org/p/chromium/issues/detail?id=50874#c22): "DNSSEC and DANE (types 2/3) do not measurably raise the bar for security compared to alternatives, and can be negative for security." - [DNS-over-HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS#Web_browsers) - [Themes](https://addons.mozilla.org/en-US/firefox/themes/): my browser isn't an IDE. - [Handwriting recognition](https://chromestatus.com/feature/5263213807534080): why. - [In-browser screenshot tools](https://screenshots.firefox.com/). - [Picture-in-Picture API](https://developer.mozilla.org/en-US/docs/Web/API/Picture-in-Picture_API): "The Picture-in-Picture API allow websites to create a floating video window always on top of other windows so that users may continue consuming media while they interact with other content sites, or applications on their device.", I already have something called a [desktop](https://en.wikipedia.org/wiki/Desktop_metaphor) to arrange windows aroud, thanks. Moreover, it seems that the only reason it exists is because youtube doesn't want non-premium users to be able to listen to it without being able to throw ads at their eyeballs. - A crapton of (often forked) vendored things because screw properly packaged dependencies? - On Debian, Firefox embeds its own copy of [sqlite](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/third_party/sqlite3/src/), a crapload of [rust crates](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/third_party/rust/), various python [libraries](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/third_party/python/), [libprio](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/third_party/prio/), [msgpack](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/third_party/msgpack/), [dav1d](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/third_party/dav1d/), [aom](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/third_party/aom), parts of [curl](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/toolkit/crashreporter/google-breakpad/src/third_party/curl/), [libdisasm](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/toolkit/crashreporter/google-breakpad/src/third_party/libdisasm/), Google's [breakpad](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/toolkit/crashreporter/google-breakpad/), more [python stuff](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/testing/web-platform/tests/tools/third_party/), [nICEr](https://sources.debian.org/src/firefox/88.0.1-1/dom/media/webrtc/transport/third_party/nICEr/), [libevent](https://sources.debian.org/src/firefox-esr/78.10.0esr-1/ipc/chromium/src/third_party/libevent/), [nrappkit](https://sources.debian.org/src/firefox/88.0.1-1/dom/media/webrtc/transport/third_party/nrappkit/), … and [a lot more](https://codesearch.debian.net/search?q=package%3Afirefox+path%3Aparty+copyright&literal=0) - Still on Debian, Chromium is a [lot of fun as well](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/): [abseil](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/abseil-cpp/), [python-markdown](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/Python-Markdown/), [afl](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/afl/) (yes.), [ashmem](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/ashmem/), [boringssl](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/boringssl/), [breakpad](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/breakpad/), [brotli](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/brotli/), [jinja2](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/jinja2/), [jsoncpp](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/jsoncpp/), [lcov](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/lcov/), [libfuzzer](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/libFuzzer/src/), some [xmpp stuff](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/libjingle_xmpp/), [liblouis](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/liblouis/), [libusb](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/libusb/), [lixbml with patches](https://sources.debian.org/src/chromium/90.0.4430.93-1/third_party/libxml/chromium/), … - Fuck accessibility misfeatures: - [Encrypted Media Extensions](https://www.w3.org/TR/encrypted-media/), adding [proprietary inscrutable blackblox garbage](https://en.wikipedia.org/wiki/Digital_rights_management#Shortcomings) so that some people can watch netflix in their browser. Just give up on DRM already, they're [useless at best, harmful at worst](https://en.wikipedia.org/wiki/Digital_rights_management#Shortcomings). - [Frames](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe): a thing from the past that should be thrown directly into the Sun. - [Clipboard API](https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_API): not only a privacy concern since website shouldn't be able to read/write into your clipboard, but also a nice opportunity to screw accessibility over by preventing people from copy/pasting content on websites. [Sandbox](https://bugs.chromium.org/p/chromium/issues/detail?id=352369) [escapes](https://bugs.chromium.org/p/chromium/issues/detail?id=319117) as a bonus. - [Pointer Lock API](https://developer.mozilla.org/en-US/docs/Web/API/Pointer_Lock_API): "It gives you access to raw mouse movement, locks the target of mouse events to a single element, eliminates limits on how far mouse movement can go in a single direction, and removes the cursor from view. It is ideal for first person 3D games, for example.". Because of course implementing FPS in a web browser is a such a common genuine usecase warranting an implementation of this feature in every single web browser. - [Session history management](https://html.spec.whatwg.org/multipage/browsers.html#dom-history-pushstate), because manipulating the user's browsing history is of course a feature and not a horrible malpractice! - [Print events](https://developer.mozilla.org/en-US/docs/Web/Guide/Printing#detecting_print_requests), because adding annotation and watermarks is neat! - [Disabling the spellcheck](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/spellcheck), what's even the usecase for this? - Multimedia stuff, because the web is the new [demoscene](https://en.wikipedia.org/wiki/Demoscene) [apparently](https://www.dwitter.net/): - [WebGL](https://en.wikipedia.org/wiki/WebGL): My web browser isn't a game console. Microsoft even [considered it harmful](https://msrc-blog.microsoft.com/2011/06/16/webgl-considered-harmful/). - [WebGL 2.0](https://webgl2fundamentals.org/webgl/lessons/webgl2-whats-new.html), because you can't deprecate/supersede shit fast enough, and having bleeding edge accelerated 3D graphics rendering in a web browser is an *essential* capability. - [WebRTC](https://webrtc.org/): "real-time communication capabilities", in a web browser. [Pepperidge farm remembers](https://knowyourmeme.com/memes/pepperidge-farm-remembers) when chat apps weren't running in browsers. - [Web MIDI API](https://www.w3.org/TR/webmidi/): to run synthesisers I suppose? [Sandbox](https://bugs.chromium.org/p/chromium/issues/detail?id=564501) [escapes](https://bugs.chromium.org/p/chromium/issues/detail?id=921581) as a bonus. - [WebVR](https://webvr.info/) [WebXR Device API](https://www.w3.org/TR/webxr/), virtual reality, why… - [Canvas API](https://developer.mozilla.org/en-US/docs/Web/API/Canvas_API): "The Canvas API provides a means for drawing graphics via JavaScript and the HTML `` element. Among other things, it can be used for animation, game graphics, data visualization, photo manipulation, and real-time video processing." all essential usecases for the vast majority of websites. Actually, a significant number of websites are using this API for [tracking purposes](https://en.wikipedia.org/wiki/Canvas_fingerprinting). - [WebGPU](https://webgpu.io): I don't want to play games , I want to __browse the web__. I don't want my browser to have low-level access to my GPU and its *stellar* quality drivers. - [Media Session API](https://developer.mozilla.org/en-US/docs/Web/API/Media_Session_API), to customize media notifications. - [Media Session API: Video conferencing actions](https://www.chromestatus.com/features/5744304695803904): completely worth adding an API in a browser for a feature used by maybe less than a dozen websites. - [Gamepad support](https://www.w3.org/TR/gamepad/), because I've always dreamt of browsing the web with a joystick or a PS1 controler! [Sandbox escape](https://bugs.chromium.org/p/chromium/issues/detail?id=998431) as a bonus. - [Gamepad light indicator API](https://www.chromestatus.com/features/5076099056795648): why. - [GamePad multitouch extension](https://www.chromestatus.com/feature/4782975812108288): a badly named API to support wiimotes-like devices. - [Gamepad Button and Axis Events](https://www.chromestatus.com/features/5989275208253440): how many games can you name on top of your head that are using axis events? - [Web Audio API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_API): because without the ability to add effects to audio, mix sources, create audio visualizations and apply spatial effects, how would one reimplement [ardour](https://ardour.org/) in a browser? On the bright side, processing audio is a straighforward process, and this added complexity will for sure never be a source of [critical security issues](https://securitylab.github.com/research/one_day_short_of_a_fullchain_renderer/). - A [builtin PDF viewer](https://caniuse.com/pdf-viewer): Can we please *stop* trying to shove every single desktop application in web browsers? It's not as if the PDF specification was a longuer-than-the-Bible trashfire complexity-wise that will invariably [lead to catastrophic bugs](https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/) anyway. [Sandbox escape](https://www.rapid7.com/db/modules/exploit/multi/browser/firefox_pdfjs_privilege_escalation/) as a bonus. - [Client-side video editing](https://chromestatus.com/feature/5649171363135488): I don't even. - [Speech Recognition](https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecognition): this should be something globally available on your operating system; Imagine if every program on your computer was implementing this in their own fashion. [Sandbox escape](https://bugs.chromium.org/p/chromium/issues/detail?id=1067851) as a bonus. - Security misfeatures: - [Sandboxed iframes](https://html.com/attributes/iframe-sandbox/): I don't want frames in the first place. Including websites in your website is idiotic, but doing it with data that you don't trust is a whole new level. - [Seamless iframes](https://www.w3.org/TR/2011/WD-html5-20110525/the-iframe-element.html#attr-iframe-seamless), because phishing isn't a thing! - [XSS auditor](https://groups.google.com/a/chromium.org/g/blink-dev/c/TuYw-EZhO9g/m/blGViehIAwAJ): easily bypassable, with false-positives, introducing cross-site leaks, … - [Portals](https://web.dev/hands-on-portals/), because using pictures and links is too much to ask apparently. Stop considering loading pages as something obscene. [Sandbox](https://bugs.chromium.org/p/chromium/issues/detail?id=971702) [escape](https://bugs.chromium.org/p/chromium/issues/detail?id=1041406) as a bonus. - [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API): Just use TLS, don't brew your own cryptography with javascript, it's often useless at best, dangerous when not completelic moronic most of the time. - [Do not track](https://en.wikipedia.org/wiki/Do_Not_Track): Enabled by default, respected by no one. - [Credential Management API](https://developer.mozilla.org/en-US/docs/Web/API/Credential_Management_API): Just use a [password manager](https://en.wikipedia.org/wiki/Password_manager) already, instead of delegating this to websites themselves. - [Signed HTTP Exchanges (SXG)](https://tools.ietf.org/html/draft-yasskin-http-origin-signed-responses), with [AMP](https://en.wikipedia.org/wiki/Accelerated_Mobile_Pages#Reception) as the main usecase, because Same-Origin Policy are too easy to manipulate, so let's add some more nightmarish cryptographically signed insanity on top of it. - [Document Policy](https://wicg.github.io/document-policy/), because browsers are supporting so much crap that apparently we now need a declarative policy to inform users what features will be (mis)used to track them. - [SameSite attribute](https://caniuse.com/same-site-cookie-attribute): The "strict" mode should be the default behaviour. - [Public Key Pinning](https://caniuse.com/publickeypinning), deprecated in Chrome, it's a bandaid over the [CA system](https://en.wikipedia.org/wiki/Certificate_authority) in the form of a trigger-happy tripple-barrel footgun doubling as a [cool ransomware vector](https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning#Criticism_and_decline). - [noopener](https://html.spec.whatwg.org/multipage/links.html#link-type-noopener) should be the default behaviour. - [Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity): it solves some security problems that you shouldnt be having because including resources from untrusted sources in the first place is pure concentrated whole-grain stupidy. - [Third party cookies](https://support.mozilla.org/en-US/kb/disable-third-party-cookies): drop them by default, into a volcano. - [WebOTP API](https://chromestatus.com/feature/5873577578463232) and its [cross-origin iframe support ](https://chromestatus.com/feature/5679508336148480): 2FA via sms-based OTP [doesn't prevent phishing](https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html), and even if it did, which it doesn't, I don't want my web browser to have access to my text messages! - [Extended validation certificates](https://en.wikipedia.org/wiki/Extended_Validation_Certificate): useless, expensive and [don't improve security](https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/). - [COOP/COEP/CORP/CORS/CORB](https://scotthelme.co.uk/coop-and-coep/) headers: don't let your site be included in others instead. - Exotic fileformats and protocols support - [FTP support](https://en.wikipedia.org/wiki/File_Transfer_Protocol): the [70s](https://tools.ietf.org/html/rfc114) called, they wanted their protocol invented before TCP/IP back. - [Gopher support](https://en.wikipedia.org/wiki/Gopher_(protocol)#Web_browsers). - [3GP](https://developer.mozilla.org/en-US/docs/Web/Media/Formats/Containers#3gp): "The format was designed for use on 3G mobile phones, but can still be used on more modern phones and networks." - [QuickTime](https://developer.mozilla.org/en-US/docs/Web/Media/Formats/Containers#quicktime) shit - [ADTS](https://developer.mozilla.org/en-US/docs/Web/Media/Formats/Containers#adts)/[AAC](https://en.wikipedia.org/wiki/Advanced_Audio_Coding): everyone uses mp3, ogg or flac except Apple and a few game consoles. - [TIFF](https://developer.mozilla.org/en-US/docs/Web/Media/Formats/Image_types#tiff_tagged_image_file_format), because tiff is [such a great format](https://www.cvedetails.com/vendor/2224/Libtiff.html), and uncompressed/ghetto-compressed scanned photos are something common on the web. - [BMP](https://developer.mozilla.org/en-US/docs/Web/Media/Formats/Image_types#bmp_bitmap_file): [horribly inefficient](https://en.wikipedia.org/wiki/BMP_file_format), nobody uses it anymore, just drop it already. - [WAV](https://caniuse.com/wav): Uncompressed audio, nobody should use it to play sounds on webpages. - Tracking garbage: - [Trust Token API](https://www.chromestatus.com/features/5078049450098688): cryptocrap-powered [tracking](https://github.com/WICG/trust-token-api). - [Federated Learning of Cohorts](https://www.chromestatus.com/features/5710139774468096): tracking via third-party cookies was awful, so the obvious solution is to get rid of them replace them with an [opaque](https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea) [rube-goldberg machinery](https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea) with pinky-swear promises attached, while this in fact significantly eases fingerprinting and targeted advertisements, leading to "[interesting](https://www.reuters.com/article/us-facebook-advertisers/u-s-charges-facebook-with-racial-discrimination-in-targeted-housing-ads-idUSKCN1R91E8)" [side](https://www.bloomberg.com/news/features/2018-03-27/ad-scammers-need-suckers-and-facebook-helps-find-them) [effects](https://stoponlinevaw.com/wp-content/uploads/2018/10/Black-ID-Target-by-Russia-Report-SOVAW.pdf)). It's hilarious that everyone hates it and is turning it off; both **big** content providers like [WordPress](https://make.wordpress.org/core/2021/04/18/proposal-treat-floc-as-a-security-concern/), [Github pages](https://github.blog/changelog/2021-04-27-github-pages-permissions-policy-interest-cohort-header-added-to-all-pages-sites/), [Gitlab pages](https://gitlab.com/gitlab-org/gitlab/-/issues/327904), [The Markup](https://twitter.com/JuliaAngwin/status/1379812115800854534), [The Guardian](https://twitter.com/kfranasz/status/1379797684442259459), … and web browsers like [Vivaldi](https://vivaldi.com/blog/no-google-vivaldi-users-will-not-get-floced/), [Brave](https://brave.com/why-brave-disables-floc/), [Microsoft Edge](https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-googles-floc-tracking-in-microsoft-edge-for-now/), [Opera](https://www.theverge.com/2021/4/16/22387492/google-floc-ad-tech-privacy-browsers-brave-vivaldi-edge-mozilla-chrome-safari), Firefox, … Lawyers and States are also talking about [antitrust/anticompetitive behaviour](https://en.wikipedia.org/wiki/Federated_Learning_of_Cohorts#Antitrust_response) as well as [blalant GDPR violation](https://en.wikipedia.org/wiki/Federated_Learning_of_Cohorts#GDPR_compliance). - [Idle detection](https://web.dev/idle-detection/): with [exotic usecases](https://web.dev/idle-detection/#use-cases), when you can actually vividly hear advertiser thinking how cool this is to check if users are looking at ads or not! - [Conversion Measurement API](https://chromestatus.com/feature/6412002824028160): fuck no. - [Beacon API](https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API): Why would I want data to be sent to websites after I closed the page? - [Web Bluetooth](https://web.dev/bluetooth/): No, I don't want websites to communicates with devices over bluetooth, providing them [yet an other way](https://www.wsj.com/articles/coronavirus-tracking-apps-raise-questions-about-bluetooth-security-11588239000) to track me, in the real™ world. [Various](https://bugs.chromium.org/p/chromium/issues/detail?id=1025067) [sandbox](https://bugs.chromium.org/p/chromium/issues/detail?id=1024116) [escapes](https://bugs.chromium.org/p/chromium/issues/detail?id=1024121) as a bonus. - [Web Bluetooth Scanning](https://www.chromestatus.com/features/5346724402954240): no. - [Privacy sandbox](https://www.chromium.org/Home/chromium-privacy/privacy-sandbox): [flaming tracking garbage](https://www.eff.org/deeplinks/2019/08/dont-play-googles-privacy-sandbox-1). - [Geolocation](https://caniuse.com/geolocation): Why would websites want to know my location, except for geoblocking, tracking and [geotargeting](https://en.wikipedia.org/wiki/Geotargeting)? They usually already have my actual IP address, which is [more than enough](https://en.wikipedia.org/wiki/Internet_geolocation) anyway, don't provide them with more. - [Referer](https://en.wikipedia.org/wiki/HTTP_referer): Yet another purely tracking-oriented misfeature from the past. - [Web NFC](https://web.dev/nfc/): Even the [official usecases](https://web.dev/nfc/#use-cases) are dull and über-specific. - [navigator.hardwareConcurrency](https://html.spec.whatwg.org/multipage/workers.html#dom-navigator-hardwareconcurrency): why should websites care about how many *logical* cores my CPU has‽ - [Magnetometer](https://www.w3.org/TR/magnetometer/): use [usecases section](https://www.w3.org/TR/magnetometer/#usecases-and-requirements) of the specification is hilarious, in a tragic way. - [Gyroscope](https://www.w3.org/TR/gyroscope/): no. - [Ambient Light Events](https://developer.mozilla.org/en-US/docs/Web/API/Ambient_Light_Events)/[AmbientLightSensor](https://developer.mozilla.org/en-US/docs/Web/API/AmbientLightSensor): What's the usecase for this? Changing the theme of the website to match the current lighting *mood*? - [Accelerometer](https://www.w3.org/TR/accelerometer/): can't have too many ways to track/identify your environment! - [Proximity Events](https://developer.mozilla.org/en-US/docs/Web/API/Proximity_Events): "When the device proximity sensor detects a change between the device and an object, it notifies the browser of that change.". What is the legitimate usecase for this? Implementing automatic parking for your car via your phone's web browser? - [Orientation Sensor](https://www.w3.org/TR/orientation-sensor/)/[DeviceOrientation Event Specification](https://www.w3.org/TR/orientation-event/): why should a website care how I handle my device? - [Battery Status API](https://developer.mozilla.org/en-US/docs/Web/API/Battery_Status_API), deprecated, but still a shitty idea in the first place. - [Broadcast Channel API](https://developer.mozilla.org/en-US/docs/Web/API/Broadcast_Channel_API): "basic communication between browsing contexts and workers on the same origin.". It seems that it's simple to use [Spectre](https://leaky.page/) in the first place. - [Content Index API](https://developer.mozilla.org/en-US/docs/Web/API/Content_Index_API): "The Content Index API allows developers to register their offline enabled content with the browser.". If I want to access a webpage offline, I just *save* it. No need for the browser to perform special shenenigans for this to happen. - [Web Periodic Background Synchronization API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Periodic_Background_Synchronization_API): "The Web Periodic Background Synchronization API provides a way to register tasks to be run in a service worker at periodic intervals with network connectivity. These tasks are referred to as periodic background sync requests.". One more oportunity to nuke my battery, excellent! - [PageTransitionEvent](https://developer.mozilla.org/en-US/docs/Web/API/Window/pageshow_event)/[Page Visibility API](https://developer.mozilla.org/en-US/docs/Web/API/Page_Visibility_API), no I don't need website to know if I'm looking at them or not. - [Network Information API](https://developer.mozilla.org/en-US/docs/Web/API/Network_Information_API), because of course websites have to know what type of connection I'm using. Just minimize the amount of data I need to download to browse your website, instead of thinking that I'm ok with more ads because I'm using a fiber connection, because I'm not. - [Screen Capture API](https://developer.mozilla.org/en-US/docs/Web/API/Screen_Capture_API): why would a website need to see how it's looking on my device‽ - [Ping API](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a#attr-ping): "Typically for tracking." → volcano. - [Web Periodic Background Synchronization API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Periodic_Background_Synchronization_API): I don't want website to silently do things behind my back. - [Storage Pressure Event](https://chromestatus.com/feature/5666274359115776): why would a website need to know if my device is running low on space? Just don't store your garbage client-side in the first place. - Straight spam: - [Vibration API](https://developer.mozilla.org/en-US/docs/Web/API/Vibration_API): great way to empty my battery and get on my nerve at the same time! - [Notification](https://developer.mozilla.org/en-US/docs/Web/API/notification): just no. I don't want them on my phone, I don't want them on my desktop, I don't want them on the web. I want to be able to focus on what I'm doing, and not be constantly distracted. Also, in what situation would I want to allow a website to notify me of anything? Nothing they have to tell me about is urgent enough that it shouldn't be sendeable via email. - [Autoplay](https://developer.mozilla.org/en-US/docs/Web/Media/Autoplay_guide): I really love it when some random webpage decides to play audio on its own, and I have to hunt which one it is and where are the media controls on it. - [Contact Picker API](https://developer.mozilla.org/en-US/docs/Web/API/Contact_Picker_API), I can copy-paste phone numbers, thank you. - [Screen Wake Lock API](https://developer.mozilla.org/en-US/docs/Web/API/Screen_Wake_Lock_API), another really cool way to drain all my battery. - [Web App Manifest](https://www.w3.org/TR/appmanifest/): I already have bookmarks, thanks. - [Modal Dialogs](https://html.spec.whatwg.org/multipage/interactive-elements.html#the-dialog-element): just do it with html already. - ["Sponsored images"](https://brave.com/introducing-sponsored-images-in-brave/): stop trying to shove ads everywhere. - [Popups](https://support.mozilla.org/en-US/kb/pop-blocker-settings-exceptions-troubleshooting#w_what-are-pop-ups): I thought we all agreed in the 1990s that those were the cancer of the internet, and should be eradicated. - [Run PWA on OS Login](https://www.chromestatus.com/feature/5534549008187392): no I don't want websites to crawl from the depths of my browser and be automatically run at my operating system's startup. - Useless API: - [Barcode Detection API](https://developer.mozilla.org/en-US/docs/Web/API/Barcode_Detection_API) [y tho](https://www.urbandictionary.com/define.php?term=y%20tho). - [WebUSB](https://en.wikipedia.org/wiki/WebUSB): [USB](https://en.wikipedia.org/wiki/USB) is [horrible](https://github.com/google/syzkaller/blob/master/docs/linux/found_bugs_usb.md) security-wise, and what would be the usecases anyway? - [Permissions API](https://developer.mozilla.org/en-US/docs/Web/API/Permissions_API): since we now have a gigantic pile of API and weird features, we of course need an API to see which ones are available. - [WebSockets](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API): "a two-way interactive communication session between the user's browser and a server.", I don't want interactivity, I want to read webpages. - [Web Storage API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API): client-side key-value storage, which should happen server-side instead. - [Background Tasks API](https://developer.mozilla.org/en-US/docs/Web/API/Background_Tasks_API): because everything is so bloated that we need asynchronism in resources processing. - [Merchant Validation](https://github.com/w3c/payment-request/issues/646): I knew that [PHP5](https://php-legacy-docs.zend.com/manual/php5/en/refs.creditcard.html) had some credit card processing features, but it's no excuse to bolt some payment primitive dircetly into javascript. - [Microtransaction payment handlers](https://chromestatus.com/feature/5651629867008000): can't wait for the blockchain version. - [Payment Request API](https://developer.mozilla.org/en-US/docs/Web/API/Payment_Request_API): the justification for this API's existence is that checkout forms are too cumbersome. [A](https://bugs.chromium.org/p/chromium/issues/detail?id=996741) [ton](https://bugs.chromium.org/p/chromium/issues/detail?id=912947) of [sandbox](https://bugs.chromium.org/p/chromium/issues/detail?id=993223) [escapes](https://securitylab.github.com/research/one_day_short_of_a_fullchain_sbx/) [as](https://bugs.chromium.org/p/chromium/issues/detail?id=956597) a bonus. - [MediaStream Image Capture API](https://developer.mozilla.org/en-US/docs/Web/API/MediaStream_Image_Capture_API), because of course I want my web browser to be able to use my webcam and take pictures! [Sandbox](https://bugs.chromium.org/p/chromium/issues/detail?id=998548) [escapes](https://bugs.chromium.org/p/chromium/issues/detail?id=995964) as a bonus. - [Push API](https://developer.mozilla.org/en-US/docs/Web/API/Push_API): just use ajax - [Web Serial API](https://chromestatus.com/feature/6577673212002304): What website doesn't need to access a serial port nowadays? [Sandbox escape](https://bugs.chromium.org/p/chromium/issues/detail?id=960484) as a bonus. - The [fuckton]( https://www.chromestatus.com/metrics/css/popularity ) of useless CSS properties that _nobody_ is using. - [Video encoders](https://www.chromestatus.com/feature/6206321818861568): "This feature ships an AV1 encoder in Chrome desktop, specifically optimized for video conferencing with WebRTC integration.", a common feature of websites, thus it's completely worth adding a complete *video encoder* in the browser. - [Raw Sockets API](https://www.chromestatus.com/features/6398297361088512): the only usecase I see for this is DDoS and implementing [nmap](https://nmap.org) in javascript. Oh, and also, free [SOP](https://en.wikipedia.org/wiki/Same-origin_policy) [bypasses](https://github.com/mozilla/standards-positions/issues/431#issuecomment-690860040) - Misc junk: - [Craptocurrencies trading](https://brave.com/binance/): fuck no. - [File System Access API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_Access_API): "It expands the current file capabilities of a browser and can enable developers to create software to open and save files. Software such as IDE's, photo or video editors and text editors, to name but a few.". - [File and Directory Entries API](https://wicg.github.io/entries-api/): "a "virtual drive" within the browser sandbox", to be used for drag'n'drop. Just use an upload form instead. - [Offline web applications](https://www.w3.org/TR/offline-webapps/): I don't want web pages to become applications. Stop having apps for everything. Moreover, most of the webpages aren't (and shouldn't be) super-interactive, and are already perfectly usable offline. - [IndexDB](https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API): because a fullfledged client-side SQL database sounds like a must-have to browse webpages. And of course, there is already [IndexDB 2.0](https://www.w3.org/TR/IndexedDB-2/) and [IndexDB 3.0](https://www.w3.org/TR/IndexedDB-3/), each 3 years distant from the other, a sane amount of time for everyone to implement something this complex. But I guess you gotta compete with Google to see who can [deprecate](https://killedbygoogle.com/) the fastest! [A](https://bugs.chromium.org/p/chromium/issues/detail?id=981873) [metric](https://bugs.chromium.org/p/chromium/issues/detail?id=945370) [ton](https://bugs.chromium.org/p/chromium/issues/detail?id=966784) [of](https://bugs.chromium.org/p/chromium/issues/detail?id=984521) [various](https://bugs.chromium.org/p/chromium/issues/detail?id=728887) [interesting](https://bugs.chromium.org/p/chromium/issues/detail?id=725032) [sandbox](https://bugs.chromium.org/p/chromium/issues/detail?id=966762) [escapes](https://bugs.chromium.org/p/chromium/issues/detail?id=1005753) [as](https://bugs.chromium.org/p/chromium/issues/detail?id=972239#c26) [a](https://bugs.chromium.org/p/chromium/issues/detail?id=942898) [nice](https://bugs.chromium.org/p/chromium/issues/detail?id=842990) [bonus](https://bugs.chromium.org/p/chromium/issues/detail?id=941746). - [SVG favicons](https://css-tricks.com/svg-favicons-and-all-the-fun-things-we-can-do-with-them/): nobody is going to zoom on your favicons, or appreciate how crisp they are on a retina display. - [Pocket](https://www.mozilla.org/en-US/firefox/pocket/) should be a web extension, not something bundled in my browser, ideally with a less [shitty privacy policy]( https://getpocket.com/privacy). - [DOMMatrix](https://drafts.fxtf.org/geometry/#dommatrix): just use javascript arrays. - Plugins support, like [h264](https://support.mozilla.org/en-US/kb/open-h264-plugin-firefox) or [DRM](https://support.mozilla.org/en-US/kb/enable-drm) in Firefox: Java and Flash were pure cancer in every possible ways, just trash this "feature" already. - [Heavy Ad Intervention](https://www.chromestatus.com/features/4800491902992384): "These poorly performant ads (whether intentional or not) harm the user’s browsing experience by making pages slow, draining device battery, and consuming mobile data (for those without unlimited plans)." Fascinating. The same reasoning applies to every single ad: what about blocking them all? - [Quirk mode](https://en.wikipedia.org/wiki/Quirks_mode): If a website is important enough to warrant a special snowflake mode in a browser because it uses some obsbolete features/hacks, it surely can hire someone to fix their broken code. - [Internationalized domain name](https://en.wikipedia.org/wiki/Internationalized_domain_name): because [phishing isn't a thing](https://en.wikipedia.org/wiki/IDN_homograph_attack). [Punycode](https://en.wikipedia.org/wiki/Punycode) isn't a solution since it only covers ASCII domains spoofing.