1. 147
  1.  

    1. 59

      I don’t pretend that posts are evergreen by hiding their dates.

      Dan Luu, I’m looking at you.

      1. 41

        Someone, please donate him some CSS for max-width.

        1. 16

          This made me realise that with almost every single thing I read, or even watch on TV, I want to know when it was published and I immediately check for it.

          1. 10

            That line made me add dates to my blog because honestly I forgot about it and felt personally attacked.

            1. 9

              In fairness, he does put dates on his index page.

              https://danluu.com

              1. 2

                Which is completely useless for the 99% case where you reach an article from the web or an aggregator and have no idea that the index page has anything.

                1. 1

                  Maybe I just exposed a personal quirk, then. When I visit a site from a link, if it’s of any interest whatsoever to me, practically the first thing I do is look for the index page.

              2. 3

                I’ve seen people argue that they have the date in the URL.

                1. 2

                  It’s not ideal but it’s fair, the date is here even if it’s a lot more annoying to find than necessary.

                  Below URL is putting that in a <meta>.

                  But afaik dan luu puts it nowhere, to get it you have to know that it’s on the index, go back there, and look for the title of the article.

              3. 50

                I disagree with the point about redirecting from plain HTTP to HTTPS. I think it’s good to redirect to HTTPS not only to push the transition to HTTPS everywhere over the finish line, but also to ensure that there’s exactly one canonical URL for each resource. Equivalent URLs should redirect to the canonical one, not serve the same resource directly. That way, you can be sure that if you use a given URL as a key for a particular resource, all references to that resource, after following redirects, will use that URL.

                1. 35

                  Yes. Using plaintext HTTP also puts all the other points in that list at risk, because shitty ISPs can (and do!) mess with it to insert their own annoying JavaScript. HTTPS is not just nice to have, it’s essential to have a non-annoying web.

                  1. 2

                    Can’t a shitty ISP also just strip TLS? It doesn’t really matter if she’s providing the site over raw HTTP or not, what matters is if your browser is configured to prefer HTTPS over HTTP.

                    1. 5

                      Not really, because apps and the like are usually using HTTPS APIs and don’t negotiate down.

                      Plus there’s liability involved when preventing HTTPS if it contains sensitive (healthcare, payment, etc) data.

                      1. 4

                        HTTP strict transport security is a reasonably effective defence against downgrade attacks.

                        1. 2

                          I don’t really see how that’s related - I assume you can both use HSTS (which will make browsers that support it always use HTTPS for your site), and continue to provide your site over HTTP (for e.g. retro computers or whatever).

                          My point was that, if the problem is malicious ISPs injecting stuff into HTTP responses, then it doesn’t matter if you provide access to your sites over raw HTTP or not - if you don’t do that, a malicious ISP could just pretend that you do that anyways.

                          1. 3

                            It’s related because you asked if a shitty ISP could perform a downgrade attack, and I said HSTS defends against that, with caveats. The caveat is that you have to first visit the site over a non-shitty ISP for the HSTS defence to work.

                            You can also put an HTTPS record in the DNS and use DNSSEC to defend against downgrade attacks on the first visit for clients that have validating resolvers.

                            When these defences work, a shitty ISP can’t “just pretend” without their lies being detected by the client. The browser will fail to connect and will not execute the shitty ISP’s malicious javascript.

                            1. 1

                              That’s the opposite of what I meant - I meant that an ISP can do a downgrade attack regardless of whether you accept connections over HTTP or not.

                              This means that there isn’t really much harm in accepting unencrypted requests on your site (assuming it doesn’t handle sensitive information).

                              1. 1

                                There is harm because it makes it much easier for the ISP, and importantly, it opens the door for attackers adjacent to the network path via TCP hijacking. That’s a concern on public WiFi for instance where any other client can inject scripts.

                                Even if that were not the case I don’t understand why you wouldn’t authenticate and encrypt the connection when it’s trivial nowadays. IMO it’s the same thinking as “I’ve got nothing to hide.”
                                It’s not because it’s not going to solve every single attack out there you shouldn’t do it.

                    2. 8

                      This also struck me as questionable. A lot of major browser UIs warn users when pages are not encrypted. So you’re just trying to read an article but the browser UI is whispering over your shoulder that you’re in a bad neighborhood. As developers, we know it’s just a blog and we’re not giving it any sensitive data, but as a general rule, I think redirecting makes more sense than not.

                      1. 1

                        Equivalent URLs should redirect to the canonical one, not serve the same resource directly. That way, you can be sure that if you use a given URL as a key for a particular resource, all references to that resource, after following redirects, will use that URL.

                        Can you explain concretely why this is useful and how HTTP -> HTTPS redirects improve the situation? Does the existence of web.archive.org disrupt the property you are hoping to achieve?

                        1. 4

                          It was probably more relevant years ago than it is now. Google used to penalize a site with duplicate content under different URLs. This could have been http: vs. https: but it could also have been allowing URLs based on dates to accept say, a single digit month/day (2002/1/5) or a double digit month/day (2002/01/05). I know my ranking at the time improved when I did proper redirects to a canonical URL for my blog.

                          1. 2

                            It’s useful assuming you want to control your own caching strategy and don’t rely on the Internet Archive Wayback Machine as a cache mechanism for your pages.

                            1. 1

                              so if your browser cache uses URLs after redirects, but your browser isn’t set up to prefer HTTPS proactively, then following an http:// link could waste the space it takes to store that web page. on the other hand forcing HTTPS makes shared caching much more difficult.

                        2. 27

                          This list has the depressing dual properties of (i) going on and on, and (ii) every item being familiar.

                          Some more potential entries:

                          • No full screen images put there to wow you that you have to scroll past.
                          • No huge (probably AI generated) prelude before the page’s content. E.g. this post didn’t start with a short essay on what a website is. (Yes: I’m mad at what search results are like these days.)
                          1. 2

                            I was guilty of the image thing. It was always a frame from a movie I was reviewing.

                            Funny enough when I shrunk the images to fit the content properly, it removed a lot of awkward design challenges and generally looks better, if a little less flashy perhaps.

                            1. 4

                              Vanity isn’t a deadly sin, but subscription pop-ups definitely are.

                          2. 21

                            Of course all this is nice for the reader, but notice that avoiding these annoyances makes it pretty much impossible to make any money from a website. So there’s a certain aspect of privilege here — we all make our living by higher means and don’t have to sully our web pages with tawdry commercial concerns.

                            1. 27

                              “I have a full time job and make enough money so I share my knowledge to you for free because teaching is its own reward” is a fine use of privilege.

                              1. 3

                                I agree! What I’m criticizing is the implicit shaming of sites that do need revenue and are basically forced to use some of the annoyances listed here (because people hate paywalls too.)

                                1. 4

                                  Fixing these bad incentives would be the one of the most broadly beneficial things one could hope to do on the web. I don’t have any good suggestions, sorry. Micropayments clearly haven’t worked. Substack-style subscription models are an improvement, in my view, but I think they have some limits.

                            2. 17

                              I totally didn’t just write this post to hawk on the red or orange sites”.

                              Whoa, is Lobsters “the red site”!?

                              1. 14

                                So raise the scarlet standard high
                                Beneath its shade we’ll live and die,
                                Though cowards flinch and traitors sneer,
                                We’ll keep the red flag flying here.

                                1. 4

                                  Look around this world we made
                                  Equality, our stock in trade
                                  Come and join the brotherhood of man
                                  Oh, what a nice contented world
                                  Let the banners be unfurled
                                  Hold the Red Star proudly high in hand

                                  1. 3

                                    No, Lobsters is exact opposite to the Temples of Syrinx: when someone brings an old and obscure but interesting piece of technology, he is usually upvoted, not disregarded ;)

                                2. 4

                                  She might mean reddit

                                  1. 6

                                    I really doubt that

                                3. 17

                                  This article mostly talks about the obvious candidates, but there is one thing that even many of the otherwise minimal blogs get wrong: Not using the system font stack.

                                  Let’s stop pretending for one second as if selecting a random quirky font on Google Fonts would give a personal touch to your site. All you are doing is increasing the load time, while gaining nothing: The users who really care about fonts, probably prefer to have their system fonts anyway.

                                  And the font loading strategies all suck IMHO. For font-display: block you just keep the user waiting even though the text is already ready. Even worse, the recommended font-display: swap causes a very visible flicker once the correct font swaps in, that you cannot unsee once you have noticed it for the first time.

                                  Since nowadays the cache is not shared between websites anymore, you will get this flicker every time you visit a website for the first time, even if the font is already used on another website.

                                  And I have not even started with the issues when websites just delegate to fonts.google.com or similar CDNs.

                                  1. 35

                                    Hard disagree, but I’m tired of arguing with people who don’t see the point of typefaces. Just maybe consider that not everyone’s like you.

                                    (I do care about fonts, but that also means I don’t think the same two or three typefaces are right everywhere, not even if I got to pick them, and I got terribly bored back when all websites had to use the same damn fonts over and over.)

                                    1. 8

                                      I just configured my computer to ignore all website custom fonts. It uses exactly two for all sites (plus two others for specific desktop applications) and this brings me joy having it all be adequately readable and beautiful.

                                      The one downside to this - if it is a downside - is any site that uses an icon font has a lot of random boxes or letters or other forms of breakage. Shame on them, icon fonts are bad anyway, but alas this does include some big name vendors like slack, google, microsoft outlook. Tempting to hack in an exception for those, but meh, nevertheless, the site is still more usable with my settings than without them.

                                      Interestingly, custom website fonts bug me less on Windows than on Linux. I still prefer them being off, but it isn’t so bad that I’ll immediately go out of my way to fix it like i do on linux. Maybe it is a difference between the system font renderers.

                                      1. 4

                                        The comment you replied to gave good reasons to avoid loading custom fonts and just use default fonts available on the system. You could also try engaging by providing solid reasoning for why you prefer custom fonts.

                                        1. 9

                                          They look nice! Custom fonts look nice, people create very aesthetically pleasing webpages designed around particular fonts or that look better with certain font styles than others. That’s more than a good enough reason to support custom fonts. Most people like when webpages follow a design language and look nice, font is part of that.

                                          1. 3

                                            Aesthetics. Not everything is provable by solid reasoning. Good typography is beautiful, just like other aspects of design, and contributes to the beauty of the document it’s in. Some people don’t get that, and it’s not something you can get anywhere by arguing about.

                                            1. 3

                                              I totally appreciate good typography–my copy of Bringhurst’s The Elements of Typographic Style is more than two decades old. But the web is not a traditional typographic medium and web pages are not ‘documents’ in the traditional sense of typesetting. Obviously, they have similar abilities to use custom typefaces, but there are constraints and factors to consider in the web medium that go beyond just the considerations of typographic style.

                                        2. 6

                                          I float back and forth on this one on my personal site. I designed my site around Source Serif Pro, and like to use small-caps. These look pretty bad without a font that supports them.

                                          Currently I think I have the page download the font, but I also am quick to have a change of heart and disable it sometimes.

                                          For work web based apps we always use system fonts because we prioritise speed.

                                          1. 3

                                            I set my site just use whatever the browser uses because this way user can choose any font theyre comfortable with.

                                            I often feel like in things meant to be read imposing some specific font is not good for the reader. Maybe they use some specialized font to help them read?

                                            1. 2

                                              IiRC google fonts also make browsers fingerprintable that wouldn’t otherwise be.

                                              1. 11

                                                You don’t need to use Google Fonts though, you can (and should) self-host the fonts if you want custom fonts. This has privacy benefits, but also typically performance benefits — the browser doesn’t need to try and open multiple connections to different hosts, it can just talk to one host and request everything it needs.

                                              2. 2

                                                I prefer font-display: optional; with a custom font at the head of an otherwise system font stack. The font either loads quickly, or it falls back to an appropriate system font. And yes, of course the font should be served locally.

                                              3. 8

                                                Sadly, I get the impression that there’s a real lack of site authoring tools that don’t herd users down the path of enabling many (if not all) of these antifeatures. For the non-computer-brained who want to publish a simple personal site, much of this shit comes out of the box.

                                                1. 2

                                                  Fortunately, there has been a renaissance in bloat-free blogging tools: bearblog, lmno.lol (which was just shared on here recently), and the ever-popular md2blog ;)

                                                2. 7

                                                  I often read Lobsters on my seven year old smartphone. I really appreciate how quickly this page loads and how it doesn’t turn my device into a hand warmer.

                                                  1. 5

                                                    They should include not screwing with the default window/tab issue by never adding target="_blank" to links for no reason. No, external sites were not meant to be open in a new tab/window & a user can middle click, right-click-then-new-tab, or Ctrl+click for this behavior, but if they want it in the current tab/window you have entirely removed that default behavior with target="_blank".

                                                    1. 15

                                                      I also don’t mess with whether it opens in a tab or new window or whatever else.

                                                      1. 1

                                                        It was a long rant & I missed that part 😄

                                                      2. 9

                                                        Another common offence: messing with that “right-click-then-new-tab” behaviour. I use that frequently, whenever I expect to go back and forth between the site and the linked pages. Or just when I want to create a small reading list for the day. For instance, I just opened up the Lobste.rs home page and right-clicked-opened all stories that seemed interesting.

                                                        But some sites use Javascript for linking and then the “right-click-then-new-tab” does not work. Very annoying.

                                                        1. 9

                                                          An other fun one is when they don’t handle ctrl properly, so if you’re in the habit of using ctrl+click to quickly open interesting links into new background tabs you find yourself with an empty background tab, and your current window navigating away.

                                                          And then they somehow fuck up the history with a bunch of intermediate redirects, so you have to use the back button’s dropdown to go back (if the SPA updates the URL at all, that is)

                                                          1. 1

                                                            Middle-clicking also opens the link in a new tab. Hope to have saved you some clicking :-)

                                                            1. 2

                                                              Thanks! But I have a mouse with a scroll wheel as a middle button and I just don’t like clicking with that :) At this point, the muscle memory is so ingrained that it would take me real effort to unlearn right-clicking.

                                                          2. 5

                                                            Even worse is the pages that reimplement link handling in JS and break standard browser functionality (alt click to select, not follow, is the usual one since it’s less known than right click).

                                                          3. 3

                                                            Agree with much of it and do the same for my site. I sometimes feel these posts encourage a kind of starkness which I’m less a fan of. It does makes sense as a reaction to the hellscape of, say, a news website. But personal blogs are nice when they have some personality, which will of course be up to individual taste.

                                                            1. 3

                                                              Nor are you popping up strange things when text is highlighted, nor are you fiddling with the contents of the clipboard when something is copied.

                                                              The more well-intended of these things originate from {mobile vendors, browser vendors, and mobile browser vendors} dropping the ball. How am I supposed to scroll to the top of a long web-page on a phone? Add #top to the URL? Oh yeah editing the URL to add a fragment’s gonna be real obvious to all the grandmas out there, but unfortunately [bz]oomers that don’t know HTML are an important market segment so we all get to enjoy discovering everyone’s ad-hoc re-implementation of basic functionality. Adding navigational cruft isn’t the responsibility of your web-page, it belongs to lower down in the stack.

                                                              1. 5

                                                                How am I supposed to scroll to the top of a long web-page on a phone?

                                                                Replace your Android with an iPhone then touch the top of the screen. Dunno why Google have not copied this feature, sigh. Like you, I get irritated by the workarounds perpetrated by web devs.

                                                              2. 3

                                                                How refreshing to solely have the reader in mind.

                                                                1. 2

                                                                  There should be a “popular manifest” that contains a short list of similar stuff that one can recommend to people when they start a website.

                                                                  My personal pet peeve is requiring JS to view your content. I browse with NoScript and it’s really annoying.

                                                                  As an aside, I like how the front page lists all posts without pagination. I do that too on my blog. Which means my front page is 130k, but no one notices it :D

                                                                  1. 2

                                                                    Which means my front page is 130k

                                                                    130k - that’s smaller than the fonts on most pages! I’m always appalled that gmail loads 15M - before any actual emails, rediculous.

                                                                    You’ve done good.

                                                                    1. 1

                                                                      I gave it a try to draft something at:

                                                                      https://github.com/alexpdp7/alexpdp7/blob/master/programming/the-content-web-manifesto/README.md

                                                                      (Yes, I know it’s kinda ironic to put that on GitHub. However, I just tried loading it with lynx and it works… relatively well.)

                                                                    2. 1

                                                                      I follow these for my website with a few exceptions: (1) I use redirect HTTP to HTTPS, as others have mentioned, (2) I load the page in parts via <img loading="lazy" ...> in long articles, (3) I self-host goatcounter for basic analytics, which you can avoid by disabling JS or visiting /#toggle-goatcounter.

                                                                      1. 1

                                                                        the ironic thing for me is that i cannot seem to get the linked page to load at all i’m not sure if that’s the “web page annoyances” part or the “don’t inflict on you here” part

                                                                        1. 1

                                                                          nice! this is inspirational, I’m adapting my page to be more like this, thanks!

                                                                          1. -1

                                                                            You aren’t “leaving tracks” with some kind of “trust me I’m a dolphin” style third-party “CDN” service. You connect to me, ask for stuff, and I provide it. Easy.

                                                                            “trust me I’m a dolphin” style third-party “CDN” service had to become a webpage such a good line https://websim.ai/c/9udbqRb00LMeAiAUH

                                                                            1. 2

                                                                              So… pretty much the antithesis of what the OP was talking about?

                                                                            2. -6

                                                                              This post resonates with me so much and why I built a blogging platform that didn’t inflict any of this silliness on readers.

                                                                              If anyone is looking to start a blog or migrate to a kinder platform, I built one https://lmno.lol

                                                                              1. 26

                                                                                Do you post or reply to anything that isn’t about your own work?