4 ms·

“target=_blank” is not only bad practice, but could be harmful

66 points by FabianBeiner 11y ago

lazyjones 11y ago
Can someone please explain why window.opener is set and modifiable when a user clicks on such a link? It seems inappropriate to me and I really don't see a compelling case for not changing this behavior and adding yet more cruft to HTML (ref="noopener") that'll slowly become the "secure default". This is particularly irritating: https://lists.w3.org/Archives/Public/public-whatwg-archive/2015Jan/0008.html https://lists.w3.org/Archives/Public/public-whatwg-archive/2...
- tonyarkles 11y ago
  Likely the same reason a lot of things are iffy on the web: backwards compatibility. You've got large organizations that built line-of-business apps in the early 2000s; they've since laid off the entire development staff but the application continues to run. Now a new version of Chrome comes out and the app doesn't work because the behaviour of window.opener has changed. What to do? Well, you can version lock to the newest version of Chrome that doesn't exhibit this behaviour (probably via an Active Directory Group Policy), or you can require users to use IE or Firefox instead of Chrome. Re-build the web app instead? That's pretty expensive and isn't on the roadmap until Q4 2017, but due to budgetary pressure may not happen until Q3 2018.
  - popmystack 11y ago
    Option 0: Don't lay off the people that create critical business infrastructure?
    - tonyarkles 11y ago
      Heck, let's say they weren't laid off. They all moved onto greener pastures in the 15 years since the project was done. And the whole app is written in Perl, since that was in fashion at the time. I'm not saying that this is a good thing; it's categorically holding us back. But it's how it is, and it's totally a people problem. Browser developers don't want to break existing code, and, because of that, organizations don't realize that their code is broken.
  - lazyjones 11y ago
    > Likely the same reason a lot of things are iffy on the web: backwards compatibility. You've got large organizations These large organizations, affected by purely hypothetical problems (nobody bothered to check for any real issues, or release a developer version of a fix), are a clear minority compared to the entities affected by the security problem that needs fixing. If that's how all the cruft gets added to HTML by a few people from 2-3 browser vendors, it's no wonder that it looks like it does and increasingly frustrates web developers to the point of resignation.
    - tonyarkles 11y ago
      For the record, I'm one of the web developers that resigned. Not from a large company, but from a small consulting company. I'm back in embedded land, and I'm way happier for it. Sure, the vendor-provided code is often shit, but it can be rewritten if necessary.
  - makecheck 11y ago
    Honestly, if organizations like Mozilla need ways to make money, I strongly suggest they create an “utterly backward but 1990s-compatible” version of a browser and charge a ton for it. And then, strip as much as possible out of the free/modern versions so we can move forward.

66 points by FabianBeiner 11y ago

Can someone please explain why window.opener is set and modifiable when a user clicks on such a link? It seems inappropriate to me and I really don't see a compelling case for not changing this behavior and adding yet more cruft to HTML (ref="noopener") that'll slowly become the "secure default". This is particularly irritating: https://lists.w3.org/Archives/Public/public-whatwg-archive/2015Jan/0008.html https://lists.w3.org/Archives/Public/public-whatwg-archive/2...

tonyarkles 11y ago
Likely the same reason a lot of things are iffy on the web: backwards compatibility. You've got large organizations that built line-of-business apps in the early 2000s; they've since laid off the entire development staff but the application continues to run. Now a new version of Chrome comes out and the app doesn't work because the behaviour of window.opener has changed. What to do? Well, you can version lock to the newest version of Chrome that doesn't exhibit this behaviour (probably via an Active Directory Group Policy), or you can require users to use IE or Firefox instead of Chrome. Re-build the web app instead? That's pretty expensive and isn't on the roadmap until Q4 2017, but due to budgetary pressure may not happen until Q3 2018.
- popmystack 11y ago
  Option 0: Don't lay off the people that create critical business infrastructure?
  - tonyarkles 11y ago
    Heck, let's say they weren't laid off. They all moved onto greener pastures in the 15 years since the project was done. And the whole app is written in Perl, since that was in fashion at the time. I'm not saying that this is a good thing; it's categorically holding us back. But it's how it is, and it's totally a people problem. Browser developers don't want to break existing code, and, because of that, organizations don't realize that their code is broken.
- lazyjones 11y ago
  > Likely the same reason a lot of things are iffy on the web: backwards compatibility. You've got large organizations These large organizations, affected by purely hypothetical problems (nobody bothered to check for any real issues, or release a developer version of a fix), are a clear minority compared to the entities affected by the security problem that needs fixing. If that's how all the cruft gets added to HTML by a few people from 2-3 browser vendors, it's no wonder that it looks like it does and increasingly frustrates web developers to the point of resignation.
  - tonyarkles 11y ago
    For the record, I'm one of the web developers that resigned. Not from a large company, but from a small consulting company. I'm back in embedded land, and I'm way happier for it. Sure, the vendor-provided code is often shit, but it can be rewritten if necessary.
- makecheck 11y ago
  Honestly, if organizations like Mozilla need ways to make money, I strongly suggest they create an “utterly backward but 1990s-compatible” version of a browser and charge a ton for it. And then, strip as much as possible out of the free/modern versions so we can move forward.