> I don't just want a usable signal, I want a fast signal, and one that gets faster over time.
But shouldn't the government only be concerned with providing a usable signal? If you want a fast signal, then leave that to private enterprise. You can pay them for a faster connection, and they can pay the government to upgrade the infrastructure in a particular area.
> inklesspen's objections to GETs changing server state seem to be based on web-accelerators following links. If web accelerators do not parse js, then inklesspen's objections are not relevant. Am I correct?
No. GETs are defined to be safe by the HTTP specification. Web accelerators are only talked about so much because the problems GWA caused were so widely talked about. In reality, anything that see the URI can conceivably cause problems.
By abusing GETs in the way that you are, you're essentially gambling that no software is going to see and follow your links automatically. Right now, software like that might not exist. But you never know what fancy Firefox extension, UserJS script or proxy magic somebody could release tomorrow.
When it's so easy to use HTTP properly, is it really worth taking that kind of risk?
> Anything that assumes that GET links can be arbitrarily followed will break stuff all over the web.
Arbitrarily performing GETs is something condoned by the HTTP 1.1 specification. Anything that assumes that GETs won't be arbitrarily followed is clueless.
You'd think people would have learned this the first time around. Don't write out-of-spec code and then complain when conforming code comes along and trashes your app. It's your bug, not theirs.
> GWA needs all kinds of heuristics to avoid that kind of thing.
How reliable. Wouldn't it be better to follow the spec so this kind of guesswork wasn't necessary?
> It comes from an e-mail sent to the address associated with the account, though. The only way he can get the reset code is to have it e-mailed to him, so unless he's forwarded on the e-mail to someone else (why would you do this?), the reset is coming from him.
So what happens when your fancy new spam filter follows the link in your email to see how spammy the page is? You end up locked out of your account, logged out, with a random password you can't retrieve.
It's really not hard to come up with scenarios where GETs are automatically performed. The HTTP 1.1 specification was written with this in mind. Assuming that it's not going to happen is simply an unnecessary risk.
But shouldn't the government only be concerned with providing a usable signal? If you want a fast signal, then leave that to private enterprise. You can pay them for a faster connection, and they can pay the government to upgrade the infrastructure in a particular area.