4 ms·

I don't think it's technically hard to fix at all. I think the more likely issue is that it may break badly coded websites that do stupid stuff. Chrome+Firefox

by points 16y ago

I don't think it's technically hard to fix at all. I think the more likely issue is that it may break badly coded websites that do stupid stuff. Chrome+Firefox should definitely do it though. You can't really just cop-out that if something is open source then it's not fair game for criticism. Firefox has some big bugs open for months before they get worked on. To prevent the example cited from working would likely take 10-20 lines of code in webkit/firefox. But it'd likely take a week or so to get up to speed with the project to be able to know where to insert those lines of code. Fixing other methods of hiding an iframe would likely take a bit more thought, but it's hardly rocket science. I have enough to do without fixing browsers ;)

jrockway 16y ago
Firefox has some big bugs open for months before they get worked on. I have enough to do without fixing browsers. You explained your own observation. You can't really just cop-out that if something is open source then it's not fair game for criticism. Open Source is certainly "fair game for criticism". But you aren't going to get anything out of criticism, because criticism cannot write any code. Open Source is all about people seeing a problem, fixing the problem, and sharing the fix. Nothing more. And it certainly has no obligation to a user who is quick to criticize but slow to fix. It's the software engineering equivalent of yelling at the TV when the news makes you mad. It's pointless and makes you look insane.
- points 16y ago
  I disagree. For the people working on webkit, the fix is probably an hours work. For me, it'd likely be a week to get up to speed with the project. So it's more efficient for me, and other users not familiar with the codebase to yell at the developers for a day or two and see if they'll fix it. I know in open source utopia everyone seamlessly just hops into other projects, fixes a bug, says 'here you go! bye for now', and carries on to the next project, but that doesn't happen in real life. Who knows though, maybe I'm wrong. Maybe there's a really good reason they allow clickjacking. But I certainly can't see one.

by points 16y ago

jrockway 16y ago

Firefox has some big bugs open for months before they get worked on. I have enough to do without fixing browsers. You explained your own observation. You can't really just cop-out that if something is open source then it's not fair game for criticism. Open Source is certainly "fair game for criticism". But you aren't going to get anything out of criticism, because criticism cannot write any code. Open Source is all about people seeing a problem, fixing the problem, and sharing the fix. Nothing more. And it certainly has no obligation to a user who is quick to criticize but slow to fix. It's the software engineering equivalent of yelling at the TV when the news makes you mad. It's pointless and makes you look insane.

points 16y ago
I disagree. For the people working on webkit, the fix is probably an hours work. For me, it'd likely be a week to get up to speed with the project. So it's more efficient for me, and other users not familiar with the codebase to yell at the developers for a day or two and see if they'll fix it. I know in open source utopia everyone seamlessly just hops into other projects, fixes a bug, says 'here you go! bye for now', and carries on to the next project, but that doesn't happen in real life. Who knows though, maybe I'm wrong. Maybe there's a really good reason they allow clickjacking. But I certainly can't see one.