Eric Lawrence

I'm a bit confused about how it actually works, and somehow they decided to not include a demonstration video.

If clicking on it does trigger a location permission prompt: what's the point? The "issues" with prompts getting denied can already be solved by web developers doing this themselves, rather than just blindly firing off a request on page load.

If clicking on it does not trigger a location permission prompt: have we forgotten about the Line Of Death [0]? Clicking random website-styled elements should never result in dangerous actions being taken - and leaking the user's physical location is definitely dangerous. Sure, they are trying to restrict the styling, but that's a fools' errant: somebody will just make a browser game where the button looks to refer to something ingame, but actually leak your real-world location.

Besides, who's actually asking for this? Location is perhaps useful for Google Maps-like websites to save you a few seconds of scrolling, but in practice it has mostly been spammy websites trying to get me to "subscribe to local news". Making geolocation easier is the last thing I want in my browser!

[0]: https://textslashplain.com/2017/01/14/the-line-of-death/

I'm a little concerned about the new Safari interface [0], which very smoothly integrates the tab/address bar with page content. For example, the background color of the page flows behind the open tabs such that it looks like one unified interface, rather than browserchrome || pagecontent.

This is all great to experience as web apps increasingly take over the functions of native apps. It does help them feel more like first-class citizens, rather than plain documents pulled up through a program.

But it easily brings up new potential abuses by phishing sites, spammy notifications, and other bad actors. The new design seems to start breaking down the browser UI's Line of Death [1], at least in perception.

[0] https://www.apple.com/v/macos/monterey-preview/a/images/overview/safari_streamlined__c4ptqnb6dz0i_large_2x.jpg
[1] https://textslashplain.com/2017/01/14/the-line-of-death/

I fear we're regressing.

There is a concept in browser UX design called the "line of death"[1] - the delineation between trusted browser UX and untrusted website UX. Unfortunately, because it looks ugly, every new year of visual designers further weaken its guarantees.

Here's an interesting anecdote from an earlier time. In the 2000s, back when the internet was a lot newer, and UX best practices were much less well understood, and internet users were starting to see the first big wave of "evil" websites, many of us independently discovered a surprisingly simple and surprisingly effective mitigation. If you choose a custom browser theme, preferably with bright colors, websites can't fake browser UX elements. The default theme will clearly mismatch, and websites can't guess what theme you did pick.

[1] - https://textslashplain.com/2017/01/14/the-line-of-death/

> In general, the idea is that Edge developers check in their code to the internal Main branch. Code from Microsoft employees is joined by code pulled by the “pump” from the upstream Chromium project, with various sheriffs working around the clock to fix any merge conflicts between the upstream code pumped in and the code Microsoft engineers have added.

Source: https://textslashplain.com/2022/08/04/understanding-browser-channels/

Microsoft have their own branch, where they add Edge-specific changes, and they regularly pull changes from the Chromium source (probably not all changes) and merge them to their branch. If you don’t consider this a fork, then please explain why.

Speaking of responsibility: I want ad networks (a scourge on modern society) to be very liable when their systems are spreading malware and scams.

IIRC the last time my mom came to me with a fake "You Must Upgrade Now" ad on her phone (from an otherwise-legit puzzle game), the ad-network did have a feedback function... but strangely there wasn't any category for fraud.

It might be less of an issue if there were clearer ad-vs-not boundaries, but that starts getting into issues like the browser security line of death [0].

[0] https://textslashplain.com/2017/01/14/the-line-of-death/

People keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that.

https://textslashplain.com/2024/10/13/content-blocking-in-manifest-v3/ shows a ten-line ad blocker that blocks Google's ads, https://github.com/extesy/hoverzoom/discussions/670 is a list of polite email messages from people who'd like to have elevated access to browsers.