The Screwed-O-Meter (2013)

https://rachelbythebay.com/fun/som/

by theycallhermax • 3 years ago

243 124 3 years ago

rachelbythebay.com

codepoet80• 3 years ago

I have a sinking feeling this applies to most Google services...

EdwardDiego• 3 years ago

You can pay them at least.

themodelplumber• 3 years ago

Yeah I mean I even get invoice emails from them which is kind of amusingly reassuring.

Pxtl• 3 years ago

Yup I paid them for my domain OH WAIT

mdwalters2• 3 years ago

I think the checklist is based on Rachel's experince with companies

deadmutex• 3 years ago

or Apple:

My account has a unique identifier which is referenced by others (e-mail addresses, phone numbers, URLs, ...)
I have a nontrivial investment in hardware or software which only works with this provider and will not interoperate with competitors

etc.

genocidicbunny5• 3 years ago

It's not quite Google-specific, but many of Google's free services do tick a lot of the checkboxes. Gmail is at least 15.

alex7734• 3 years ago

They have a history of killing projects

Yeah that's Google alright

bombcar3• 3 years ago

This is a great way to see how screwed you'll be.

nvy• 3 years ago

s/'ll be/ are

jjoonathan• 3 years ago

Having time on your side counts for a lot. Enough to outweigh every single box on that list. If you take action.

irjustin• 3 years ago

I got 74% for gmail. hrm....

jrockway2• 3 years ago

I got 18% on GMail. I pay them, other people pay them, and they don't have much downtime. IMAP support hasn't changed in decades and pushes each email to your local machine. If they start to suck one day, I just point my MX records somewhere else and nobody will even know. All in all, one of the least scary services I use.

Most of the 18% are them not being bound to any contract. I am not sure I have ever signed a contract that binds the other party (I don't even think my offer to buy a home completely precluded the seller from backing out), so it doesn't extra worry me. Having a backup and a changeable address assuage any of my fears. (I feel the same way about cloud providers. If GCP nukes me, it will be an annoying day to get going on AWS, but hardly the end of the world.)

lukevp• 3 years ago

You just point the MX records of your custom domain to a different provider, you mean? The vast majority of Gmail users do not have custom domains, and directly give out @gmail.com addresses to other users and services.

zootboy• 3 years ago

I got 66% for Gmail, but a bunch of these did feel a little difficult to judge. Like "Bugs are not fixed." Is that any bugs? All bugs? The majority of bugs? Important bugs? Etc, etc. I went with no for "bugs are not fixed", but yes for "bugs are not acknowledged."

Honestly, the biggest potential avenue for being screwed by Gmail is being locked out of all your other accounts that use your Gmail address as a login credential. That's sort of covered by a few of the options, but I think it deserves a question of its own (e.g. "My access to other services is mediated by this service.")

I also drew a line between Gmail and GSuite. GSuite would obviously win back some points in the "I pay for it" category.

quickthrower22• 3 years ago

My mitigation strategy for gmail:

1. Important logins through a domain I own are forwarded to gmail.

2. Do a regular Google takeout.

mikewarot3• 3 years ago

This seems to be quite applicable for services, if you took the questions and applied them to products, especially operating systems or programming languages, we're all in deep deep trouble.

jrockway2• 3 years ago

Can you give me an example of how you are screwed in the programming language case?

mikewarot3• 3 years ago

I use WikidPad[1] to store my notes, appointments, etc. I've been doing so for more than a decade.

I switched to Linux last year, only to find that WikidPad does not work correctly. There were breaking changes made to one of the libraries, so none of the dialog boxes work correctly.

After missing doctors appointments(that I didn't know about, because they were in WikidPad), I decided that WikidPad was something I had to be able to use, and switched back to Windows 10.

I'm fortunate in that I'm not using source code, but rather a Windows Binary, so I should be good, effectively forever... or until Microsoft decides that only "apps" will be allowed.

Look at all the mess that happened when Python decided that we must all convert to Python 3 to satisfy a Unicode fetish, and made a ton of breaking changes along the way.

---

Also, I became interested in a C program written about 21 years ago[2], and it took the efforts of some kind souls here on HN to help me get it to run in a modern environment, because C itself has changed so much in the meanwhile.

[1] https://github.com/WikidPad/WikidPad

[2] https://en.wikipedia.org/wiki/SQUID

stevenwliao2• 3 years ago

Start by analyzing whichever email service you use.

Add additional checkboxes:

- [y/n] Is SMS the only 2FA method available?

- [y/n] Is there no 2FA at all?

- [y/n] Do they have a history of unpatched zero-days?

- [y/n] Is it possible that if there is a security breach, you won't hear about it because no tech journalist pays attention to this service?

- [y/n] Can someone socially engineer the support team to get access to your account?

- [y/n] If a hacker gets access to your account, can your bank accounts be drained?

worthless-trash• 3 years ago

Aren't all vulnerabilities zerodays and therefore unpatched at some point?

slater2• 3 years ago

known vs. unknown, and all that

lcnPylGDnU4H9OF3• 3 years ago

It’s a zero-day only at the point when it’s been exploited without having been reported. “Zero” is referring to the number of days since disclosure that an exploit ocurred. If it’s patched before it’s exploited, it wouldn’t be considered a “zero-day exploit”.

stevenwliao2• 3 years ago

I guess to be more specific, zero-days that they don't fix even after they're exploited.

jbm• 3 years ago

Forget about emails, this seems like it applies to banks directly (in Canada at least).

bombcar3• 3 years ago

Can you recover your account if you forget your password or lose your 2FA?

If so, how?

Is that socially engineerable?

johngalt• 3 years ago

Excellent checklist. Anyone who is directly accountable for operations but only a non-voting advisory role for platform selection will have flashbacks reading this list.

sandworm101• 3 years ago

Do they claim to not be technically "evil"?

Are they in fact evil?

intelVISA• 3 years ago

Well, the answer is of course: it depends.

Am I paid enough to look past that?

slater2• 3 years ago

things are so bad, "may your startup never be featured, even tangentially, on rachel's site" is the new "may you live in interesting times" :D

duxup• 3 years ago

It is interesting too how many of these are things people in one way or another… want / incentivize.

A large chunk of the individual consumer web is free services where we are the product… but generally we won’t pay / use much of anything else.

Then we get upset when the service nobody is paying (or not enough) costs money and/or dies.

We as consumers seem attracted to / incentivize the inevitable “eshit…”

gvb3• 3 years ago

If you read with JavaScript disabled, she says

Hey NoScript peeps, (or other users without Javascript), I dig the way you roll. That's why this page is mostly static and doesn't generate the list dynamically. The only things you're missing are a progressive descent into darkness and a happy face who gets sicker and sicker as you go on. Oh, and there's a total at the bottom, but anyone who uses NoScript can surely count for themselves.

Rock on!

Love it!

jchw• 3 years ago

You know, on that note, I bet you could find a way to do this purely with CSS. Wouldn't be terribly useful, but alas.

quickthrower22• 3 years ago

You could also do it server side

polalavik• 3 years ago

I ask this out of genuine curiosity - what is HNs obsession with disabling JavaScript? Are y’all browsing the internet like this? If so how and why? Isn’t most of the modern web dependent on JavaScript?

Anytime I’ve shared a personal project on HN someone has commented that it doesn’t work with JavaScript disabled.

tkgally• 3 years ago

I've often wondered the same thing. I look forward to reading people's responses.

Arnavion• 3 years ago

Are y’all browsing the internet like this? If so how and why? Isn’t most of the modern web dependent on JavaScript?

It's not all or nothing. I enable JS for the bank, webmail, etc websites I visit regularly and trust. There's no need to have it enabled on the rest of the shit that I only visit when it gets linked on HN.

mattl• 3 years ago

JavaScript is irrelevant to most of the internet. Only the web part would be affected.

I think there’s some vague good reason to block all JS and put sites you trust on an allowlist but I no longer do it personally.

beachy• 3 years ago

what is HNs obsession with disabling JavaScript?

1) Disgust at sites that use JS for gratuitous purposes, absurd scrolling, stupid visual effects.

2) A kind of chest thumping "I was here long before Javascript was a thing, laddy".

3) Security fears, desire to reduce attack surface

4) Revulsion of JS as a language

genocidicbunny5• 3 years ago

Are y’all browsing the internet like this? If so how and why?

Yes. All JS turned off by default unless it's on a whitelist. Takes a few days to get the whitelist set up, but its fairly straightforward.

Between this and uBlock, it makes the web a lot safer and resource intensive to browse. For example, people frequently cite Chrome as being faster than Firefox, but with my setup that has rarely been a the case in a very long time.

I've also generally found a strong correlation between websites that don't work or work badly without JS and them being websites I don't want to frequent. And when the website doesn't work without enabling most of the JS, including all the ad and tracking stuff? That's a good sign that I probably should never whitelist that website.

There's also just the matter of principle. If a website works just fine for my needs with most or all of the JS turned off, it wasn't really necessary in the first place was it?

gvb3• 3 years ago

Yes, I'm browsing with JavaScript disabled by default. It cuts out an incredible amount of crap. With JavaScript, web sites (especially "news" sites) are unusably slow due to all the crap advertising pushing GB of crap JavaScript at you.

Sturgeon's law is understated. 99.987% of anything in an iframe is crap.

https://en.m.wikipedia.org/wiki/Sturgeon%27s_law

panic• 3 years ago

Try it sometime! Turning off JavaScript makes web browsing noticeably faster and less memory-intensive. You may be surprised how much still works fine with it off. Software like NoScript lets you allow it temporarily if something really does need it.

lcnPylGDnU4H9OF3• 3 years ago

For example, analytics scripts don’t necessarily need to be enabled even if other scripts are. NoScript in particular allows such options.

Not only analytics but advertising and general “tracking” stuff. There are many reasons and any individual may have one or more which would persuade the decision.

If one “offers advice” that a website “doesn’t work with javascript disabled” just consider that they are suggesting to try implementing progressive enhancement (https://en.wikipedia.org/wiki/Progressive_enhancement) as is done on the linked page. Basically get the page working with HTML only, then add CSS, then add JS.

Calavar2• 3 years ago

You leave Javascript enabled, open 15 tabs, and in all likelihood 2 or 3 of them are discreetly running cryptominers, another 2 or 3 are using the timed visited links attack to sniff your browser history [1], another 4 or 5 are installing permacookies, and Google and Meta and Twitter are now aware of 12 out of the 15 tabs you opened because those pages have a Google analytics or AdSense JS snippet or a like/retweet button somewhere on the page.

Javascript is a security and privacy nightmare. It's frankly absurd to me that we default to Javascript switched on everywhere for everything. It feels like chmodding your entire home directory to 777 on a shared system.

JS is also an accessibility nightmare, but unfortunately turning it off doesn't fix that.

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=252165

shrimp_emoji• 3 years ago

Are y’all browsing the internet like this?

I also do.

If so how and why? Isn’t most of the modern web dependent on JavaScript?

I expect a webpage to be a webpage, not an "app". I always think it's funny that many pages will print the message "This app requires JavaScript to run" when they fail to work without JS. "Apps", I feel, should be executables I run on my machine after installation. I mean, that's bad enough -- how do I know a video game isn't scouring my system for all my personal data to sell to advertisers as it admitted in the EULA I didn't read? But now webpages can be fly-by-night Turing complete brain surgeries on my computer? No thanks.

Gee, thanks W3C, for making battery life and other things JS queries which are at best useless and at worst tools to track and datamine me. (By the way, all the ads, sometimes also malware, loaded via JS sure eat into that battery life. Yay!) Let me whole-heartedly subscribe to this Molochian acceleration to value extractive singularity so that I can visit a webpage! Maybe I'll also get to enjoy some shitty animations or standard workflow-breaking behavior (e.g., pagination/right-click context menu hijacking) while I'm at it to get in the way of the content I wanna get. :D

bombcar3• 3 years ago

If using Safari, you can turn on lockdown and see what uses Javascript for speed; it's actually less than you might think.

qbit• 3 years ago

I disable js in safari (which is my main browser) on ios. If there is something that I really want to see that requires js, I switch to brave which has js enabled. But most of the time if a site requires js, I just leave the site. I now find browsing the web with js enabled to be intolerable.

1vuio0pswjnm7• 3 years ago

"Are y'all browsing the internet like this?"

Yes.

"If so how and why?"

Make HTTP request(s) outside browser then view with HTML reader. Many other ways to do it. Depends on personal preference.

Why: Because it's more flexible and efficient than using a browser. For example, 1. send multiple HTTP request in single TCP connection, 2. filter response body, e.g., using UNIX utilities, 3. it's both fast and reliable. There is no waiting.

"Isn't most of the web dependent on JavaScript?"

For ads and tracking, yes. For displaying text, generally no. In the later case, some sites may use Javascript to request text (JSON) from some other path or domain. In these cases, one can send the requests to the other path or domain without using JS. If the user prefers only text content, without graphics, this is especially convenient.

Tanoc• 3 years ago

I've been running like this ever since Javascript started to take over from Flash, circa 2010 or so. RAM usage is decreased, CPU usage is decreased, UI spam is basically gone, it often disables hostile page formatting, it lets me see which websites are slapped together like a five year old played with LEGOs and are thus security nightmares, and it generally just makes things safer and faster.

newusertoday• 3 years ago

yes i do this too however my usecase is slightly different than other commenters so let me share that. It helps me in prioritizing the content that i am really interested to see by putting the effort to open it in a new private window. i fall for click bait and click on the links and when i find that it is not visible in js disabled i mostly close them unless i really want to see it so it acts like a first level filter.

Qwertious2• 3 years ago

"The modern web" often depends on JS, but the World Wide Web was originally created as a system for sharing documents, and some people refuse to accept the slow change towards web-apps, especially in cases where it's unnecessary. For instance, news articles don't need JS.

JavaScript is fine for e.g. territorial.io - where JS isn't an implementation detail but critical to the core concept - but if it's unnecessary, then some people despise being forced to use it.

Disabling JS reduces third-party blocking code, tends to speed up page loads by removing the need to download JS scripts, has no degradation of the content 99% of the time, and is an extremely effective ad/tracker blocker. Overall, it's not hard to see why some people love it.

JS also breaks some web browsers, which pisses off anyone who likes those web browsers.

JS is often proprietary code running on the client's computer, or at least hard-to-verify open-source code that's running on the client's computer and creates unnecessary remote code-execution security holes.

I don't care personally, but I can see why some people do and I think "the modern web" is rather problematic and needs to be reformed.

I think JS can actually be a good thing overall (when executed properly), because it reduces the need to load content from the server and thus can make the user's app more resilient against inconsistent internet connections. Also, JS runs client-side which is better than relying on code that runs serverside, as a rule. (See "service as a software substitute".)

Dalewyn4• 3 years ago

what is HNs obsession with disabling JavaScript? Are y’all browsing the internet like this? If so how and why? Isn’t most of the modern web dependent on JavaScript?

You know how most security vulnerabilities are some form or another of Remote Code Execution, right?

Well, now consider what JavaScript usually is: Code from a Remote server that Executes on its own locally. The remote server might not have anything to do with the website you intended to visit, too.

The literal nature of JavaScript is a security threat and liability.

ben_w• 3 years ago

Javascript is an attack vector, and a way for some ads slip past the ad blocker.

While some websites do need JS and therefore get it selectively enabled (if I trust them), if all I want to do is read some text then I generally have a better experience without JS.

DonHopkins• 3 years ago

It's not an obsession with disabling JavaScript, it's an obsession with whining about sites that use JavaScript.

jjav• 3 years ago

Isn’t most of the modern web dependent on JavaScript?

Way more than justified, sadly. Web pages are supposed to serve documents which can be read, there is zero need for client-side scripting in that case. And that's the predominant use case.

Yes, javascript is useful for the occasional site that needs client-side interactivity. Games that run on the browser are a good use case. Maybe the only one.

But for documents? No, absolutely not needed.

As to why object to it? Code running on my computer being served from an untrusted third party is always a huge security risk. I don't want to run your code, I don't trust some random website admin. Yes, browsers do their best at containing the malware but it will never be completely perfect. The only perfect solution is to simply never run any code being served off some random website. Which means disabling javascript as much as possible.

simple-thoughts• 3 years ago

Personally I selectively disable scripts because it’s not any 3rd party business to know which sites I visit on my private device. And if a site works without any JavaScript that’s the ideal scenario - I don’t have to hunt thru the scripts to see which ones are actually required for the site to work.

hooby• 3 years ago

I can't speak for anyone else besides myself, so I can't answer the question "what is HNs obsession".

But I can share my thoughts on NoScript:

An ad-blocker acts as a blacklist of sites/domains which are not allowed to run JavaScript in your browser. So basically everything is allowed by default - and the plugin downloads a list of known sites/domains that serve ads, track you, serve malware etc. That list is curated by someone else - and with the goal of disabling as many ads as possible while breaking as little site functionality as possible.

NoScript allows you to manage a whitelist of sites/domains which are allowed to run JavaScript in your browser. So by default everything is forbidden - and only sites/domains explicitly added to that list can run JS. And you have to curate that list yourself - so it's up to you to add sites/domains to those you want to trust permanently/temporarily. This is more involved, requires more effort, and many sites will break - loosing legit features, sometimes even breaking static content.

So, there are some parallels in there - one is a general blacklist that's remotely managed for you - and the other is a whitelist that you have to manage on your own.

You get more control and more security - at the cost of increased hassle, as many sites will just be broken out of the gate, and some will still be broken even after you (temporarily) allow first-party scripts a CDN or two. Some less recommendable sites need JS from 20+ domains (some of which dynamically load in even more domains) to work, while other sites work perfectly fine with just first-party scripts allowed and nothing else. For me that's interesting to know.

But you also get to see and learn a lot about what's going on under the hood, which might be interesting too, if you work in the field.

It's up to everyone to decide for themselves, whether that's worth the hassle - for most people it's probably not. But if you are technically minded and have already gained a little bit of experience with NoScript - the hassle isn't actually that great.

All pages you use regularly will be permanently whitelisted - many other pages can deliver you their static content fine even without JS - lots of pages are pretty easy to whitelist temporarily in just a few clicks - and the rest are often best to stay away from anyway.

Nmi2osv7• 3 years ago

Isn’t most of the modern web dependent on JavaScript?

most modern web developers are very dumb

c.f. tailwind

RugnirViking• 3 years ago

For me the app that I use hacker news through has it disabled by default, I click through if I have to and I'm particularly interested

flangola7• 3 years ago

At one time the concept of running arbitrary unfamiliar code without so much as glancing at it was recognized as the horror it is.

If I'm visiting your webpage it is because there is information as HTML that I wish to read. Why do you need to issue commands to my computer? That's invasive and unnecessary and certainly not something I'm enthusiastically consenting to.

Many JavaScript payloads are also huge. Millions of humans do not have a reliable and fast cable or fiber ISP connection.

JohnFen2• 3 years ago

what is HNs obsession with disabling JavaScript?

It's a defensive measure to help prevent tracking and other attacks.

Are y’all browsing the internet like this?

I am.

Isn’t most of the modern web dependent on JavaScript?

A well-designed webpage degrades gracefully and is still usable without JS. There are plenty of badly-designed websites that don't do this, of course. I just don't go back to those.

Rapzid• 3 years ago

what is HNs obsession with disabling JavaScript

I suspect it's a very vocal minority.

Are y’all browsing the internet like this

I'm not, no. 15 years ago I would NoScript for security reasons. But I visit far less shady sites and times have changed with browser security. Never did I NoScript for philosophical reasons.

tristor• 3 years ago

what is HNs obsession with disabling JavaScript?

Javascript is an inherent security vulnerability because it allows other entities to execute arbitrary code on your computer system. Disabling it is basic prudence at this point.

Are y’all browsing the internet like this?

Yes. Every system I use online has Javascript disabled by default for all sites and a curated whitelist.

If so how and why?

Why is already answered above. How is via Firefox + NoScript + uBlock Origin. This allows me to control which domains are allowed to execute Javascript with a default-deny policy and blanket disable XSS.

Isn’t most of the modern web dependent on JavaScript?

Yes, but most of it renders text just fine without it, and the ones that don't are usually sites I don't want to be on anyway. Most of the modern web is also garbage that is actively harmful to the security of your system and to your psyche.

paulcole• 3 years ago

Hacker News scores about 40%

yjftsjthsd-h3• 3 years ago

I guess there should be a checkbox, or maybe even a slider, for "how much do you care about this service?" or "how much does this service impact your life?"; if HN dropped off the face of the earth tomorrow, I'd be unhappy, but life would go on, whereas for many people a gmail account ban would be catastrophic.

chunsj• 3 years ago

With my email message service provider, I think, 59% of screwedness, I have.

jameskerr2• 3 years ago

Classic

neilv• 3 years ago

That smiley face is very optimistic. I ticked several showstoppers, and it's still grinning. What a can-do trooper!

Also, when using this analysis platform to vet production architectures, the more terrifying a SaaS/PaaS option is, the more clearly the indicator "green lights" that plan.

I suspect that enterprise sales is involved.

justinclift• 3 years ago

Needs some other questions added. :)

* Does your house have an audio/video doorbell that staff or contractors of the company could ever interact with?

denkmoon• 3 years ago

Absolutely love the way the page gets darker.

MandieD• 3 years ago

Posted in 2013, but still current.

The Screwed-O-Meter (2013)

Related Stories