3 ms·

Chrome team member here, and one of the people working on the portals spec. This isn't accurate. This feature is being developed behind a flag, as it's still h

Chrome team member here, and one of the people working on the portals spec. This isn't accurate. This feature is being developed behind a flag, as it's still highly experimental and undergoing a lot of change. There is an origin trial [1] for mobile-only same-origin-only portals [2] which people can use to test how well this works in the wild, but it's nowhere near shipping. You can learn more about the intention of the element in [3]. [1]: https://github.com/GoogleChrome/OriginTrials/blob/gh-pages/developer-guide.md https://github.com/GoogleChrome/OriginTrials/blob/gh-pages/d... [2]: https://developers.chrome.com/origintrials/#/view_trial/-7680889164480380927 https://developers.chrome.com/origintrials/#/view_trial/-768... [3]: https://github.com/WICG/portals/blob/master/README.md https://github.com/WICG/portals/blob/master/README.md

earthboundkid 6y ago
Can you give a motivating example for a website that isn’t Google to use portal? I’m not seeing it. Something that I would actually use if it existed is an auto-height sizing iframe. Because that doesn’t exist, I have to hack around it with Pym.js. That would solve an actual need, unlike portal, which afaict only solves the “I want to be Google SER” usecase.
- anoncareer0212 6y ago
  Your knowledge is correct https://news.ycombinator.com/item?id=23692067 https://news.ycombinator.com/item?id=23692067
- domenicd 6y ago
  https://github.com/WICG/portals/blob/master/README.md#use-cases https://github.com/WICG/portals/blob/master/README.md#use-ca... https://github.com/WICG/portals/blob/master/key-scenarios.md https://github.com/WICG/portals/blob/master/key-scenarios.md (although that's a bit out of date and some of the use cases mentioned there might not be possible anymore as we've tightened the restrictions on cross-site communication to prevent tracking)
  - ocdtrekkie 6y ago
    > So we anticipate many of the current cases for iframes, such as ads, being able to be replaced with portals. I love how the reason Google is pushing this spec is buried near the bottom.
    - IMTDb 6y ago
      And the very first reason they state is to speed up loading by using hidden portals, and then activating them on demand. When you first stated use case is a hack around what the spec really is supposed to provide, you have an issue. If you want to speed up rendering of links, create a spec designed and optimised to speed up rendering of links. Not something that will clutter the DOM, then need additional CSS rules to hide what your new element is supposed to do altogether. All of that to sort of arrive to your primary use case.
  - dane-pgp 6y ago
    I see from the list of issues that "about:blank cannot host a portal"[0] (and in fact the parent page has to be served over HTTP/HTTPS). Does that mean that it's impossible to have a bookmarklet with a data URI that defines a page with a portal in it? It would be really nice if the trick described in [1] could be combined with portals to allow a user to bookmark a fixed bundle of code for a web app, to defend against a malicious server sending different JavaScript on different visits or to different visitors. This would probably also require that the SRI spec be extended to work with portals, so that the contents of a portal could be guaranteed to match a specified hash. Are there any plans for that? [0] https://github.com/WICG/portals/issues/214#issuecomment-647716506 https://github.com/WICG/portals/issues/214#issuecomment-6477... [1] https://news.ycombinator.com/item?id=17776456 https://news.ycombinator.com/item?id=17776456
- rezonant 6y ago
  Unfortunately auto resizing iframe without the opt-in of the embedded page could be used to snoop on private data using frame extents as a side channel. Imagine a page that is 10 times longer if you are signed into it-- a third party site you visit could use this fact to determine if you are signed into the embedded website, for instance, and they could make the frame invisible and you wouldn't even know it happened. While the embedding site can of course opt out of iframe embedding with X-Frame-Options, we can't assume that sites are built that way, and there may be legitimate use cases for iframing where you still don't want to expose the size of the underlying page. Things like pym.js and iframe-resizer are probably the best bet security wise as it requires opt-in by the underlying page.
  - earthboundkid 6y ago
    My uses case includes controlling both sides. I just don’t want to have to use JS for what is a non-interactive use case that could easily be handled declaratively by the browser.
    - rezonant 6y ago
      That's fair- I don't think there would be a problem with an X-Frame-Options header that specifically said frame extents can be made available to the embedder or something.

earthboundkid 6y ago

Can you give a motivating example for a website that isn’t Google to use portal? I’m not seeing it. Something that I would actually use if it existed is an auto-height sizing iframe. Because that doesn’t exist, I have to hack around it with Pym.js. That would solve an actual need, unlike portal, which afaict only solves the “I want to be Google SER” usecase.

anoncareer0212 6y ago
Your knowledge is correct https://news.ycombinator.com/item?id=23692067 https://news.ycombinator.com/item?id=23692067
domenicd 6y ago
https://github.com/WICG/portals/blob/master/README.md#use-cases https://github.com/WICG/portals/blob/master/README.md#use-ca... https://github.com/WICG/portals/blob/master/key-scenarios.md https://github.com/WICG/portals/blob/master/key-scenarios.md (although that's a bit out of date and some of the use cases mentioned there might not be possible anymore as we've tightened the restrictions on cross-site communication to prevent tracking)
- ocdtrekkie 6y ago
  > So we anticipate many of the current cases for iframes, such as ads, being able to be replaced with portals. I love how the reason Google is pushing this spec is buried near the bottom.
  - IMTDb 6y ago
    And the very first reason they state is to speed up loading by using hidden portals, and then activating them on demand. When you first stated use case is a hack around what the spec really is supposed to provide, you have an issue. If you want to speed up rendering of links, create a spec designed and optimised to speed up rendering of links. Not something that will clutter the DOM, then need additional CSS rules to hide what your new element is supposed to do altogether. All of that to sort of arrive to your primary use case.
- dane-pgp 6y ago
  I see from the list of issues that "about:blank cannot host a portal"[0] (and in fact the parent page has to be served over HTTP/HTTPS). Does that mean that it's impossible to have a bookmarklet with a data URI that defines a page with a portal in it? It would be really nice if the trick described in [1] could be combined with portals to allow a user to bookmark a fixed bundle of code for a web app, to defend against a malicious server sending different JavaScript on different visits or to different visitors. This would probably also require that the SRI spec be extended to work with portals, so that the contents of a portal could be guaranteed to match a specified hash. Are there any plans for that? [0] https://github.com/WICG/portals/issues/214#issuecomment-647716506 https://github.com/WICG/portals/issues/214#issuecomment-6477... [1] https://news.ycombinator.com/item?id=17776456 https://news.ycombinator.com/item?id=17776456
rezonant 6y ago
Unfortunately auto resizing iframe without the opt-in of the embedded page could be used to snoop on private data using frame extents as a side channel. Imagine a page that is 10 times longer if you are signed into it-- a third party site you visit could use this fact to determine if you are signed into the embedded website, for instance, and they could make the frame invisible and you wouldn't even know it happened. While the embedding site can of course opt out of iframe embedding with X-Frame-Options, we can't assume that sites are built that way, and there may be legitimate use cases for iframing where you still don't want to expose the size of the underlying page. Things like pym.js and iframe-resizer are probably the best bet security wise as it requires opt-in by the underlying page.
- earthboundkid 6y ago
  My uses case includes controlling both sides. I just don’t want to have to use JS for what is a non-interactive use case that could easily be handled declaratively by the browser.
  - rezonant 6y ago
    That's fair- I don't think there would be a problem with an X-Frame-Options header that specifically said frame extents can be made available to the embedder or something.