5 ms·

Does anybody bother to go through this codebase? It's a great tool, but Facebook is the last company I'd want to have the obscene privileges that extensions hav

Does anybody bother to go through this codebase? It's a great tool, but Facebook is the last company I'd want to have the obscene privileges that extensions have.

danabramov 7y ago
If you saw the scary permission dialog upgrading, that was due to our mistake: https://twitter.com/reactjs/status/1162174507391574017 https://twitter.com/reactjs/status/1162174507391574017. Commits with fixes: * https://github.com/bvaughn/react-devtools-experimental/commit/545de6f02e7d8905ba4e1cd358e68bb640a31a0a https://github.com/bvaughn/react-devtools-experimental/commi... * https://github.com/bvaughn/react-devtools-experimental/commit/527fc4a63f497db1f370a8312807c2a68147edec https://github.com/bvaughn/react-devtools-experimental/commi... Both of these issues should be fixed in 4.0.2. Brian goes into more detail on why we originally added these permissions during the rewrite, and why we were able to remove them: https://www.reddit.com/r/reactjs/comments/cqx554/introducing_the_new_react_devtools/ex0p0m1/ https://www.reddit.com/r/reactjs/comments/cqx554/introducing.... (TLDR: some were for features we ended up cutting; others had easier workarounds that didn't need these permissions.) The source code is here (https://github.com/bvaughn/react-devtools-experimental/commits/source https://github.com/bvaughn/react-devtools-experimental/commi...). We're currently moving it into React repo so it's easier to find (https://github.com/facebook/react/pull/16381 https://github.com/facebook/react/pull/16381) but haven't managed to make the CI green so the source of truth for releases is still in that branch. We plan to cut over to React repo as source of truth next week.
- ralusek 7y ago
  Yes, thanks for addressing.
brianvaughn 7y ago
> but Facebook is the last company I'd want to have the obscene privileges that extensions have. reply Sounds like you're talking about extensions in general, but for what it's worth- React DevTools doesn't require any super deep permissions¹ and all of the source code is in the open². ¹ https://github.com/bvaughn/react-devtools-experimental/blob/2bcc6c6d04e302f9c1cd2f724ee2033a999b36b8/shells/browser/chrome/manifest.json#L43-L47 https://github.com/bvaughn/react-devtools-experimental/blob/... ² https://github.com/bvaughn/react-devtools-experimental/tree/source https://github.com/bvaughn/react-devtools-experimental/tree/...
- marvindanig 7y ago
  Yeah, but the intent is to drive developers away from the building blocks of web and weaken the value of HTML standards and accessibility guidelines that make the web awesome. Evil has many masks. And a corporation powered ‘open source’ is now the worst evil monster we have had to face in decades.
  - brianvaughn 7y ago
    That's definitely not the intent.
    - marvindanig 7y ago
      ...the sibling comment below disproves yours.
      - danabramov 7y ago
        To give some context. Historically React has been all about sharing what worked for us at FB for creating dynamic, complex apps. If it doesn't work well for you, please don't use it. There are plenty of alternatives. The notion that there's some kind of plan to "weaken the web" there just isn't true. I don't know what you're basing it on. You may not remember this, but when React came out, everybody laughed at it. It was not some kind of asset for Facebook at the time. If we talk about motivation, ours is quite the opposite. We want to empower web developers to create complex UIs, comparable to native apps. We very much want the web to win, or at least to stay relevant. The only reason React got open sourced and kept being developed in the open was because engineers working on it wanted to share it with the wider web community. They saw something useful in it. Eventually, the industry took note, but it wasn't until a few years later. We believe in open web, and this is why we work on React. The notion that React is at odds with accessibility is also mistaken. React outputs regular DOM, and common React setups like Create React App include more accessibility checks than you'd get writing HTML by hand. Maybe you're confusing React with something else? Yes, keeping dynamic JS apps accessible has its own set of challenges (we document some here: https://reactjs.org/docs/accessibility.html https://reactjs.org/docs/accessibility.html), but it's not React that makes it hard. It's the dynamic UI expected by users that makes it hard. If anything, in my experience React makes it easier for teams to adopt better accessibility practices by putting them directly into React components (example: https://ui.reach.tech https://ui.reach.tech). Finally, concerning standards. We've worked and will continue working with standards committees to bring good parts of React into the platform. For example, the "object spread" operator in JavaScript was originally added to JSX, and was championed in TC39 by a React team member. Similarly, we're closely working with standard bodies to improve web app responsiveness. Not just for React, but for all libraries. You can learn more about this work here: * https://github.com/WICG/is-input-pending https://github.com/WICG/is-input-pending * https://www.youtube.com/watch?v=mDdgfyRB5kg https://www.youtube.com/watch?v=mDdgfyRB5kg Happy to address any specific concerns if you have them.

Does anybody bother to go through this codebase? It's a great tool, but Facebook is the last company I'd want to have the obscene privileges that extensions have.

danabramov 7y ago

If you saw the scary permission dialog upgrading, that was due to our mistake: https://twitter.com/reactjs/status/1162174507391574017 https://twitter.com/reactjs/status/1162174507391574017. Commits with fixes: * https://github.com/bvaughn/react-devtools-experimental/commit/545de6f02e7d8905ba4e1cd358e68bb640a31a0a https://github.com/bvaughn/react-devtools-experimental/commi... * https://github.com/bvaughn/react-devtools-experimental/commit/527fc4a63f497db1f370a8312807c2a68147edec https://github.com/bvaughn/react-devtools-experimental/commi... Both of these issues should be fixed in 4.0.2. Brian goes into more detail on why we originally added these permissions during the rewrite, and why we were able to remove them: https://www.reddit.com/r/reactjs/comments/cqx554/introducing_the_new_react_devtools/ex0p0m1/ https://www.reddit.com/r/reactjs/comments/cqx554/introducing.... (TLDR: some were for features we ended up cutting; others had easier workarounds that didn't need these permissions.) The source code is here (https://github.com/bvaughn/react-devtools-experimental/commits/source https://github.com/bvaughn/react-devtools-experimental/commi...). We're currently moving it into React repo so it's easier to find (https://github.com/facebook/react/pull/16381 https://github.com/facebook/react/pull/16381) but haven't managed to make the CI green so the source of truth for releases is still in that branch. We plan to cut over to React repo as source of truth next week.

ralusek 7y ago
Yes, thanks for addressing.

brianvaughn 7y ago

> but Facebook is the last company I'd want to have the obscene privileges that extensions have. reply Sounds like you're talking about extensions in general, but for what it's worth- React DevTools doesn't require any super deep permissions¹ and all of the source code is in the open². ¹ https://github.com/bvaughn/react-devtools-experimental/blob/2bcc6c6d04e302f9c1cd2f724ee2033a999b36b8/shells/browser/chrome/manifest.json#L43-L47 https://github.com/bvaughn/react-devtools-experimental/blob/... ² https://github.com/bvaughn/react-devtools-experimental/tree/source https://github.com/bvaughn/react-devtools-experimental/tree/...

marvindanig 7y ago
Yeah, but the intent is to drive developers away from the building blocks of web and weaken the value of HTML standards and accessibility guidelines that make the web awesome. Evil has many masks. And a corporation powered ‘open source’ is now the worst evil monster we have had to face in decades.
- brianvaughn 7y ago
  That's definitely not the intent.
  - marvindanig 7y ago
    ...the sibling comment below disproves yours.
    - danabramov 7y ago
      To give some context. Historically React has been all about sharing what worked for us at FB for creating dynamic, complex apps. If it doesn't work well for you, please don't use it. There are plenty of alternatives. The notion that there's some kind of plan to "weaken the web" there just isn't true. I don't know what you're basing it on. You may not remember this, but when React came out, everybody laughed at it. It was not some kind of asset for Facebook at the time. If we talk about motivation, ours is quite the opposite. We want to empower web developers to create complex UIs, comparable to native apps. We very much want the web to win, or at least to stay relevant. The only reason React got open sourced and kept being developed in the open was because engineers working on it wanted to share it with the wider web community. They saw something useful in it. Eventually, the industry took note, but it wasn't until a few years later. We believe in open web, and this is why we work on React. The notion that React is at odds with accessibility is also mistaken. React outputs regular DOM, and common React setups like Create React App include more accessibility checks than you'd get writing HTML by hand. Maybe you're confusing React with something else? Yes, keeping dynamic JS apps accessible has its own set of challenges (we document some here: https://reactjs.org/docs/accessibility.html https://reactjs.org/docs/accessibility.html), but it's not React that makes it hard. It's the dynamic UI expected by users that makes it hard. If anything, in my experience React makes it easier for teams to adopt better accessibility practices by putting them directly into React components (example: https://ui.reach.tech https://ui.reach.tech). Finally, concerning standards. We've worked and will continue working with standards committees to bring good parts of React into the platform. For example, the "object spread" operator in JavaScript was originally added to JSX, and was championed in TC39 by a React team member. Similarly, we're closely working with standard bodies to improve web app responsiveness. Not just for React, but for all libraries. You can learn more about this work here: * https://github.com/WICG/is-input-pending https://github.com/WICG/is-input-pending * https://www.youtube.com/watch?v=mDdgfyRB5kg https://www.youtube.com/watch?v=mDdgfyRB5kg Happy to address any specific concerns if you have them.