arcliteIndira

8 lat temudiscuss

It's extremely obvious that Facebook knows what a good website looks like, versus what they deliver.

You can take a look at the entire ecosystem of React code out across so many repos and documentation sites, and then stand that next to Facebook proper, and then note the difference in tone, quality and psychological warfare.

https://reactjs.org

With that in mind, consider what kind of strategy and tactics Facebook's internal operations must be operating.

arcliteIndira

8 lat temudiscuss

As a developer, I don't want to learn to make AMP pages.

As a user, I look at AMP pages, and still want the real thing, not the AMP page.

In general, on mobile, a lighter page is nice sometimes.

As a rule, I don't want the typical metric fuck-ton of trash that SEO advertising bloat, that pages dump into a single page load.

I don't want to sign up for email. I don't want to hear about how I can either accept cookies and continue reading because resistence is futile, or acknowlege that it's too late and also accept cookies, because everyone must accept all cookies, so just accept the cookies.

I also don't need convenient share buttons. I'm not embedding anything. I'm not tweeting anything. It's not going on stumbleupon or pinterest or anywhere else. I'm not posting the link for this page on any other website.

I'm not commenting with Disqus or in any other way, and I don't need 95% of the page scroll to consist of arguments between random people below the fold.

arcliteIndira

8 lat temudiscuss

Wow, so, you really believe that asking people to lock up their important messages to you, using a public key that you've provided through a verified, alternate non-email channel really won't work?

PGP actually does do something about incoming email attachments. It offers the opportunity to programmatically reject anything that is non-encrypted ASCII text, and renders malicious files as non-executable ASCII text, when such policies are properly enforced. At this point, the promiscuous user is protected from delving deeper into emails. The server can effectively isolate attachments entirely, by proxying mail delivery, and refusing to decrypt attachments automatically. This would further defend against account compromise, through practices that require special handling of attachments. Email then becomes a medium of communication, rather than file transfer, and file transfer is pushed to other protocols and applications.

Sort of like a point-and-call policy. Forcing a user to cognitively jump through hoops to discover the contents of an attachment, when they should really be using email for the exchange of messages with humans, or automated control messages, such as multi-factor auth. Doing something like this limits email to character data only, rather than interpretable instructions. You know, much in the way we don't execute JavaScript from an email context.

Example:

comments