22 ms·

Cloudflare's inaccessible browser contradicts the company's mission

751 points by mwcampbell 5y ago

sneak 5y ago
This makes logical sense. Smaller companies have fewer innovation tokens; large organizations like Cloudflare carry heavier burdens when releasing new products (i18n and a11y primarily among them).
- devoutsalsa 5y ago
  It seems like Cloudflare could embrace accessibility and use that in marketing as a competitive advantage.
  - daviddever23box 5y ago
    ...as a competitive advantage against whom? Who else is providing this capability at the moment, and are they more or less accessible?
    - yjftsjthsd-h 5y ago
      If they don't already have competitors, they will soon enough, and a11y is a moat to have.
devwastaken 5y ago
Public services, even online, which are not accessible to those with major disabilities, is a violation of the ADA. https://youtu.be/IQjUCqVo4II https://youtu.be/IQjUCqVo4II This may apply in other ways to Cloudflare, and if so fines must be issued. It's 2021, there's no excuses for it other than not wanting to put in the work.
- ceejayoz 5y ago
  The fines would apply to the companies using CloudFlare, wouldn't they?
  - daviddever23box 5y ago
    Yes.
- ggreer 5y ago
  By that logic, isn't every screen sharing app violating the ADA? A screen reader can't read the text on someone else's screen in Zoom, Webex, Slack, etc. Zoom even admits to this in their accessibility FAQ and encourages speakers to supplement with notes.[1] 1. https://zoom.us/accessibility/faq#faq11 https://zoom.us/accessibility/faq#faq11
  - mwcampbell 5y ago
    > By that logic, isn't every screen sharing app violating the ADA? We'd love it if the legislation had that kind of teeth. As it happens, in my day job I've been developing a product to work around the inaccessibility of screen sharing in online meetings, starting with providing real-time access to PowerPoint slides. But I'm not here to plug that product.
    - ggreer 5y ago
      Just curious, but where do you draw the line? To use a silly example: we don't legally require every that everyone who posts an image on social media include a written description. There must be some ratio of cost to benefit at which accommodations stop being reasonable. If we required that screen sharing tools were compatible with screen readers, we'd have to revamp many layers of abstractions. It would require changes to every operating system, every UI framework, every browser, and every screen sharing application. An alternative would be to throw a bunch of machine learning at the problem (to try to turn pixels back into meaning), but that would have a lot of broken corner cases. The issues would likely be as bad as auto-generated subtitles, which are generally not good enough to be considered ADA compliant.[1] My guess is that if the law changed tomorrow and mandated that screen sharing tools accommodate the blind, we'd end up with no cross-platform screen sharing tools. Microsoft would make their Windows screen sharing. Apple would make their MacOS screen sharing. Google would make their ChromeOS screen sharing, and none of them would be interoperable. Also desktop Linux would be SOL. 1. UC Berkeley was forced to delete over 20,000 videos of lectures because their auto-generated subtitles weren't accurate enough: https://news.berkeley.edu/wp-content/uploads/2016/09/2016-08-30-UC-Berkeley-LOF.pdf https://news.berkeley.edu/wp-content/uploads/2016/09/2016-08...
em-bee 5y ago
what is the legal situation here? wouldn't laws that require the employer to make accommodations for the disabled simply force the company to not use this tool for blind employees? the company would have to prove that using this tool is strictly necessary, which i believe is hard to prove, because if it was strictly necessary then everyone at home should be using it too. there should only be few places where such a tool is strictly necessary, and those places already use it. anyone who only starts using it now when it gets more convenient can't make the claim that they could not do their work without it because they could until now.
- mwcampbell 5y ago
  > what is the legal situation here? Honestly, I don't know. We may disagree on whether browser isolation is strictly necessary. But to the extent that Cloudflare's marketing efforts convince IT departments that it is, and that it's important to adopt it company-wide, that's bad for blind people unless Cloudflare makes the product accessible. I don't know if their marketing efforts are succeeding, but I'm being proactive here.
  - em-bee 5y ago
    well, i mean strictly necessary in the eyes of the law. but that's something we won't find out until affected people start suing employers for discrimination or whatever the appropriate claim here is. and until then there will be casualties as you already predict.
- brudgers 5y ago
  The legal situation is akin to speeding. While technically it is illegal to drive 56 in a 55, you won’t get a ticket for it. And lots of places the flow of traffic will be 85 in a 65 and the cops are not about to hold things up. Same with accessibility only there are powerful economic interests at play too.
  - adventured 5y ago
    > And lots of places the flow of traffic will be 85 in a 65 and the cops are not about to hold things up. They sure will. They'll pull a traffic break when something is wrong. They get out in front of a block of traffic, throw on their lights, and begin swerving across lanes, instructing the speeding flow of traffic to collectively slow down. I've seen cops routinely do that in both California and on the East Coast. Cops will do that for various reasons, including safety purposes (if something has happened up ahead) or just to reassert control if they decide the flow of traffic is going too fast. Here is a safety example of it in action in Utah: https://www.youtube.com/watch?v=P9IsAu_96oo https://www.youtube.com/watch?v=P9IsAu_96oo The Germans apparently do this for safety as well: https://www.youtube.com/watch?v=a-TZBhy-jDk https://www.youtube.com/watch?v=a-TZBhy-jDk
goodpoint 5y ago
Cloudflare is also killing Tor with its blockpages. It's a global threat to privacy and freedom of information.
- tmikaeld 5y ago
  It's up the the site owner if they want to block Tor or not, the site owner cloud just as easily have blocked Tor if they where using a normal server.
  - Asooka 5y ago
    But is blocking Tor a decision the site owner has to make, or is it the default and requiring you to set up custom site protection rules if you want to accept Tor traffic?
    - zinekeller 5y ago
      Explicit, using the special "country code" T1. However, I also noticed that natural blockrates (on my non-CF servers) tends to be higher on Tor exit addresses due to (seemingly) more aggressive hacking attempts - probably the same on CF (the real anonymity of Tor is both a blessing and a curse)
      - prophesi 5y ago
        You can explicitly block all TOR nodes, but by default the security settings is set to "Medium" which blocks the majority of them. I'd also like to know Cloudflare's definition of "malicious traffic". I think the main fears are DDoS attacks (which is a nonexistent threat to the majority of site owners) and scraping email addresses for spam. Which can be addressed by informing site owners to use a contact form widget instead of putting their email on their contact page.
        zinekeller 5y ago
        See my corollary comment on some of my non-CF servers and the blocking - Tor does provide important anonymity, and I understand that Cloudflare, which is bigger, can probably absorb it without much damage, but unfortunately Tor exit nodes have a much higher attack and hacking attempts than regular IP addresses. In high-security applications when anonymity is already lost anyway (logging into a bank, for example) it is reasonable, due to the inherent risk, to block Tor exit nodes.
sokoloff 5y ago
> A blind acquaintance of mine once lost his job because of a newly added requirement that he use an inaccessible application. I find it hard to believe this happened as stated in the US, where any number of lawyers would be eager to take such an open-and-shut ADA violation case.
- WORMS_EAT_WORMS 5y ago
  No doubt it could happen but I agree with you. This entire post is very odd and makes absolutely no sense at all.
  - mwcampbell 5y ago
    Can you be more specific about what doesn't make sense? I'm willing to clarify anything I wrote.
    - WORMS_EAT_WORMS 5y ago
      To my understanding their browser isolation text just renders to canvas on their edge servers (don’t quote me on this). Does canvas provide any accessibility at all and is actually a bigger problem with the creation of that standard / element in HTML5 with text generation? It’s essentially an image block that allows text generation with almost no accessibility in mind? That’s not really Cloudflare’s fault if so. I agree accessibility needs to be of higher priority. It’s a shame it’s seems to be almost always a secondary priority to everything in tech. But this post feels like an open letter to some bigger issue when it seems like it’s a very niche and non-common security tool. I mean no disrespect in this.
      - deleted 5y ago
        [deleted]
      - mwcampbell 5y ago
        > To my understanding their browser isolation text just renders to canvas on their edge servers (don’t quote me on this). Does canvas provide any accessibility at all and is actually a bigger problem with the creation of that standard / element in HTML5 with text generation? It’s an image block that allows text generation with almost no accessibility in mind? That’s not really Cloudflare’s fault to be honest. The standard workaround is to create a parallel DOM that's invisible, e.g. covered up by the canvas. To be clear, this parallel DOM should be based on the accessibility tree of the remote browser, not based on the original DOM, as that would undermine the whole point of the exercise. This work-around may not be perfect, but Cloudflare hasn't implemented even this. > But this post feels like an open letter to some bigger issue when it seems like it’s a very niche and non-common security tool. It seems to me, from Cloudflare's original pre-announcement of this technology [1], that they intend for it to be widely adopted. Here's the money quote: > Operating costs translate directly to customer costs. The S2 system was designed to make deployment to an entire enterprise and not just targeted users (aka: vaccinating half the class) both feasible and attractive for customers. [1]: https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/ https://blog.cloudflare.com/cloudflare-and-remote-browser-is...
cupcake-unicorn 5y ago
Thanks so much for holding Cloudflare accountable for this. It's upsetting that they had so much input from you leading up to it and now they're dropping the ball. A lot of accessibility stuff and mission statements just honestly amounts to virtue signalling with companies and sad to see that's the case with Cloudflare so hope they step up. It shouldn't have to get to the point where they're sued but I feel like more often than not that's the only thing that changes things like this.
nickdothutton 5y ago
When requesting new functionality please complete the “revenue opportunity size” field in the Jira and indicate what quarter you expect this opportunity to close.
- geofft 5y ago
  You're not wrong, and the answer is that this sort of thing needs to impact their bottom line somehow - either because customers insist on it as part of a purchase checklist, or because the legal system will actually go after violations, or because they'll lose important employees. I don't have a real sense of which of those is most realistic.
  - daviddever23box 5y ago
    I'm not so sure that there's a legal recourse for this on Cloudflare's part, but it's certainly possible for the customer–at which point, the demand will increase to a tipping point.
_moof 5y ago
Fighting discrimination is difficult and can be exhausting. As someone in a (different) protected class I just want to say kudos for doing this work.
- dnzkw 5y ago
  Isn't demanding that non-trivial work is done just to accommodate your class the opposite of discrimination?
  - codezero 5y ago
    They shouldn’t have to demand accommodation. That’s the point.
    - dnzkw 5y ago
      And my point is that discrimination is an active effort, which this is not. Things are, by default, not accessible, because things are generally crafted for able bodied humans.
      - Xorlev 5y ago
        It takes something that once was made accessible, through active effort, and makes it inaccessible. That's the point.
      - tobr 5y ago
        Where did you get the idea that discrimination has to be the result of an active effort? Anything that makes one group of people excluded or treated worse is discrimination, even if it is the result of an oversight. Your second sentence is basically exactly the problem: able-bodied people are arbitrarily treated as the “default”, and others are left out.
        dnzkw 5y ago
        If it's an oversight how can it be an active effort? Able bodied people are the default because they are the absolutely overwhelming majority. Let's agree to disagree, I think.
Sebb767 5y ago
> A blind acquaintance of mine once lost his job because of a newly added requirement that he use an inaccessible application. IANAL, but wouldn't this be grounds for a lawsuit?
- Ensorceled 5y ago
  Yes. But then you have to hire a lawyer after just losing your job, survive during the time the lawsuit will take, win the lawsuit ("plaintiff was let go because position was redundant"), collect, resume your job or job hunt with a "trouble maker" label. I really wish HN contributors would not suggest the legal system as a solution for these types of problems, it's totally unrealistic.
  - Sebb767 5y ago
    IMO this is a pretty clear-cut discrimination case. I'm aware that lawsuits can be problematic for quite a few reason, but just eating it up would be a just as horrible suggestion.
    - arp242 5y ago
      Aside from practical concerns such as time and money, these kind of battles can be very emotionally draining. Some of the most stressful experiences I've had in life is when some company or person did me a serious injustice and it's hard to get your rights. I found it's better to let go, for my own sake. It's very stressful and very easy for the situation to consume you, which isn't healthy and on balance you may be worse off if you factor this in. Everyone is different, and other people may experience these kind of things different, but I've seen the same in various other people, both publicly and in my private life. Of course this really sucks and is very unfair. But it doesn't change it.
      - Sebb767 5y ago
        Fair enough. Let's just hope said acquaintance was in a position to handle it without regrets.
nanankcornering 5y ago
and they're still passing traffic of 8chan and kiwi something..
gnicholas 5y ago
They wouldn't be the first. An SVP of a major SV company once told me "[my company] doesn't give a shit about accessibility, and no one in Silicon Valley does." When I went to the CSUN accessibility conference that year, guess which company's logo was emblazoned across the lanyards? Yup, their marketing department was happy to write checks that their company had no intention of cashing. Silicon Valley is famous for its 'patina of accessibility': https://medium.com/@nicklum/silicon-valleys-patina-of-accessibility-be406eb25b36 https://medium.com/@nicklum/silicon-valleys-patina-of-access...
- mwcampbell 5y ago
  I understand and can relate to the feeling that nobody gives a shit. And it may be true that the leadership of all of these companies only care about the bottom line. But let's not make things look worse than they are. Whatever the motive, some SV companies are doing good work in accessibility. The most obvious example is Apple; the introduction of VoiceOver on the iPhone in 2009 was groundbreaking and has been tremendously useful to blind people all over the world. Microsoft (disclosure: my former employer) is also doing good work on accessibility, e.g. its Seeing AI app. Of course, we have constructive criticism for these companies as well, but the state of accessibility in mainstream tech is not all bad.
  - gnicholas 5y ago
    I understand that no one is perfect. What bothers me is the hypocrisy: making it seem like they care when they really don’t. Did they spend $100k to sponsor that conference? I’d prefer they spend that money actually training people to care.
    - novok 5y ago
      A more charitable explanation is they may care, but their organization might not put their money where their mouth is. Also organizations are not monolithic singular minds, especially as they get bigger and bigger. They are groups of people and one end doesn't talk to the other is quite common.
chmod775 5y ago
At this point browsers are a basic building block of our society. There is absolutely no excuse for lacking acessibility features. You might as well say your "browser" can't render Arabic.
- kevin_thibedeau 5y ago
  > There is absolutely no excuse for lacking acessibility features. Then how are the kids going to have their flashy Electron apps?
  - mwcampbell 5y ago
    > Then how are the kids going to have their flashy Electron apps? This Electron-bashing is misplaced. In point of fact, Electron is one of the most accessible cross-platform UI solutions.
ushakov 5y ago
i’m getting more worried about where Google is going with their accessibility strategy flutter and the canvas-based google docs are completely inaccessible
- konaraddi 5y ago
  > the canvas-based google docs are completely inaccessible AFAIK Google docs is still accessible. See the “Additional details” at the bottom of https://workspaceupdates.googleblog.com/2021/05/Google-Docs-Canvas-Based-Rendering-Update.html https://workspaceupdates.googleblog.com/2021/05/Google-Docs-...: Compatibility for supported assistive technologies such as screen readers, braille devices, and screen magnification features, will not be impacted by the canvas-based rendering change. We will continue to ensure assistive technology is supported, and work on additional accessibility improvements enabled by canvas-based rendering
  - ushakov 5y ago
    see, they didn’t say that canvas-based Google Docs will be accessible - all they promise here is that it will be “compatible” “compatible” could just mean that assistive technology will work while browsing Google Docs and nothing beyond that this is a textbook example deceptive corporate doublespeak
    - arp242 5y ago
      What more do you want beyond "will work"? Does it not actually work now? What are the issues and practical concerns right now?
- wffurr 5y ago
  Have you tried using a screen reader with Flutter apps or the canvas-based Docs? From the very first result on “Flutter accessibility”: >> We strongly encourage you to include an accessibility checklist as a key criteria before shipping your app. Flutter is committed to supporting developers in making their apps more accessible, and includes first-class framework support for accessibility in addition to that provided by the underlying operating system https://flutter.dev/docs/development/accessibility-and-localization/accessibility https://flutter.dev/docs/development/accessibility-and-local...
nonbirithm 5y ago
Anecdotally, even with websites like Twitter that obfuscate their CSS class names to prevent the use of selective adblock, they still leave the readable ARIA strings in predictable places, allowing uBlock Origin users to create blacklist rules matching them. I'm wondering if those two features are at odds.
- wolfgang42 5y ago
  Do we know that Twitter is intentionally doing that to defeat adblockers? It’s a common speculation I see about them (and maybe it’s a convenient side-effect), but these sorts of mangled class names are also a common feature of popular CSS-in-JS libraries. (I work on an internal app that does the same thing, and it’s incredibly annoying but definitely not explicitly intended to be hostile.)
- madjam002 5y ago
  Twitter uses react-native-web which generates random class names, they’re not doing it to evade ad blockers.
- novok 5y ago
  You can do ad block with text in tag types I've found out. I use it to block the email nag from reddit.
daviddever23box 5y ago
Why not push the screen reader component upstream? It'd be another service add-on, but it might also be useful for folks who want to have narrative browsing, e.g., the equivalent of someone reading the news sites to the listener without having to interact with the site itself.
- mwcampbell 5y ago
  > Why not push the screen reader component upstream? Are you suggesting that a screen reader should run on the same remote machine as the remote browser and push its audio down to the client? Or something else?
  - daviddever23box 5y ago
    Yes - in the same manner as game streaming.
    - mwcampbell 5y ago
      That would be better than nothing, and if Cloudflare had done that, I don't think I'd be complaining publicly at this point. But there are still problems with this approach. The ones that come to mind: 1. Assuming the remote service only sends down streaming audio, this doesn't work for blind people that must use a refreshable Braille display, e.g. deafblind people. Perhaps one could hack a way to get their local screen reader to render specific text on the Braille display, but probably not without that screen reader speaking the same text. That leads me to... 2. A blind user is already running a screen reader, with its own text-to-speech engine, configured the way they want it. Adding a remote screen reader to the mix would mean two different TTS engines, and the user would need to have a way of configuring the remote one, e.g. to adjust its speed. For blind people, TTS settings are very personal. 3. The remote screen reader and the local one may clash on keyboard commands. And, depending on the screen reader, this is another thing that the use may have customized already; for example, some screen readers have desktop and laptop keymaps. 4. Also speaking of keyboard commands, some of them might not be implementable in a browser-based application. It's common, at least on Windows, for screen readers to use non-standard modifier keys, e.g. Insert or Caps Lock.
lbriner 5y ago
Sad but typical and not just from big "evil" companies (not suggesting that CF is!) I just ran Jekyll to migrate my Blogger blog to self-hosted and with the default importer and default theme, I clicked the Web Accessibility button and immediately got some several hundred contrast errors (lots of blog post links) and some incorrect heading levels. Just basics but people are too unaware of accessibility requirements that this even happens before a release. What is missing? Is there not an online checker like w3c does for markup or acid does for browser tests? Oh yes, it is here: https://wave.webaim.org/ https://wave.webaim.org/ and there is also a browser plugin so no real excuses.
- arp242 5y ago
  I don't know what you did exactly, but the default Jekyll theme is fairly simple black-on-white and doesn't seem to have any major issues from quick spot-check. I think it may be an issue with your import(?)
miki123211 5y ago
This problem unfortunately applies to a lot of remote access software, particularly when the web browser is the client. I know of one company that switched to Web VNC for accessing a specific piece of software. They had a lot of offices and the software was expensive (paid per machine). This way, they could switch to a much smaller number of licenses, letting any employee connect from anywhere and wait in line if necessary. A blind person has lost a job over this.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- digitallyfree 5y ago
  I'm not sure if remote access programs (web browser or not) even support screen readers on the client, especially since many of those render the entire desktop server-side and send it back to the client as an image or video. A possible option may be to run the screen reader on the remote desktop itself if that's possible.
  - mwcampbell 5y ago
    > A possible option may be to run the screen reader on the remote desktop itself if that's possible. For generic remote desktop access, that's what we have to do. But piping accessibility information (in its generic form, not pre-rendered as speech) to the client side in that case is much harder than it would be for this Chromium-based remote browser. (I know this from relevant experience during my time on the Windows accessibility team at Microsoft.)
- yjftsjthsd-h 5y ago
  > A blind person has lost a job over this. IANAL, but in at least the US and Europe that sounds like the easiest lawsuit of their life
  - 5y ago
Animats 5y ago
We're probably headed for a world in which everything is rendered to an image server-side. The HTML/CSS/Javascript mess has become so bloated and attack-ridden that sending images needs less bandwidth and is simpler.
- mwcampbell 5y ago
  That wouldn't be so bad if the server sent down a tree of semantic UI elements, a.k.a. an accessibility tree, along with that image. That's basically what I advised Cloudflare to do ~18 months ago.
  - miki123211 5y ago
    Except doing so is probably much more complicated than actually dealing with the CSS and HTML. Hell, it would probably take twice as much manpower to make this remote browser thing accessible than it took to make it work in the first place.
    - mwcampbell 5y ago
      I doubt that. Chromium's internal accessibility tree is already serializable; it has to be, so it can be sent from the renderer process to the main process. So Cloudflare's modified Chromium could send that tree down to their JS-based client, which could then construct a DOM with the appropriate HTML tags and ARIA attributes. This DOM wouldn't have any JavaScript or any references to remote resources, so it wouldn't pose the same security risks as the original web page.
      - x0x0 5y ago
        Would you need the css? And mutations to this dom would need to be tightly synced to image updates to not confuse the hell out of nvda? Or am I misunderstanding?
        mwcampbell 5y ago
MattGaiser 5y ago
For people who have worked on accessibility related stuff in production projects, how much more expensive is it vs just ignoring it?
- BoorishBears 5y ago
  Does it matter? Tomorrow morning you can wake up needing those accessibility features.
  - wyager 5y ago
    Of course it matters. If your model of the world is “we need to spend infinite resources ensuring every system can be operated by anyone with any disability”, that’s obviously nonsense. Accessibility is valuable but not infinitely so. Sometimes (usually) it’s best not to encumber an innovation just because the innovation doesn’t immediately apply to everyone.
    - BoorishBears 5y ago
      You're answering a statement no one made. They asked "what does it cost vs just ignoring it". The point is just ignoring it (in other words assigning it 0 value) shouldn't be on the table. I'm also giving this person the benefit of the doubt and assuming they're not asking if accessibility costs infinity dollars.
  - MattGaiser 5y ago
    I am trying to get a sense of how big an ask this is. Is it a million dollar ask? 100K? A million a year (does it need a full time team)?
    - arp242 5y ago
      It really depends on the specifics; for something like this I suspect it's a non-trivial investment. For a lot of other things it's not that hard. For a lot of things a18y features are just good features in general; zooming text for example is something loads of people do, not just blind or low-vision people.
tomklein 5y ago
Out of curiosity: Do screenreaders use OCR nowadays and if so, is it working good or rather bad due to the lost HTML markup?
- miki123211 5y ago
  They sort of do. Voice Over on iOS, and it's screen recognition, is probably the most notable example. It even tries to recognize some UI controls and emulate common behaviors (like sliding a slider), for example. It's far from perfect. It might help when you need to click the odd inaccessible button, but is definitely not enough for daily web browsing.
- arp242 5y ago
  OCR is a poor substitute since it can't really effectively navigate things due to lack of navigational information, recognition of semantic elements like headers, etc. I'm not blind myself, but I've tried to use some screen readers in the past to get a feel of what it's like. While I'm a very inexperienced user, one thing I noticed is that even with the best designs it's actually really time-consuming compared to regular browsing. I would imagine that an OCR solution would be even more time-consuming, if it even works well at all.
  - thatguy0900 5y ago
    I've heard that actual blind people train themselves to use a speed of speech that is almost unintelligible, so it might be significantly faster for them to use the same software
  - mwcampbell 5y ago
    Please be careful about drawing conclusions on what web browsing must be like for blind people, based on your limited experience with a screen reader. One of my blind friends put it more eloquently: https://news.ycombinator.com/item?id=9284744 https://news.ycombinator.com/item?id=9284744 A sibling comment makes a good point about blind people running their speech synthesizers at high speeds. Experienced screen reader users are also good at using their screen reader's many keyboard commands to jump around a web page.
miki123211 5y ago
On most Cloudflare-related HN threads, Cloudflare was really active and eager to answer the engineers' questions. It's notable that this one is different. The fact that it's Sunday afternoon may be part of the reason, but I guess they really don't have anything to say. I'd really love to see their internal Slack now, though.
- mwcampbell 5y ago
  I submitted this on Friday, but for whatever reason, it didn't catch on then. Thanks to the HN mods for putting it in the second-chance pool. I've pinged Cloudflare and eastdakota again on Twitter, so let's see what happens.
  - whoaisme 5y ago
    When google makes arbitrary decisions we hate on google. When hn makes arbitrary decisions we say thank you. And we wonder why the tech industry is so fucked up. Imagine how even more pathetic this site would be if dang paid you all 6 figures.
  - oknhy30ao 5y ago
    Hey, I don't work on the Browser Isolation team, but want to let you know that there's a project in progress and your post is certainly being discussed. I'm hoping we can provide a solution that meets or exceeds your expectations. PS-- Please ardon the throwaway account, CF employees have been getting targetted online.
    - mwcampbell 5y ago
      . I look forward to the results of that work in progress. In the meantime, I still think it's reasonable to expect an official response. As far as I can tell, Cloudflare has not publicly acknowledged the problem yet (please correct me if I'm wrong); even a disclaimer on the product page would be better than nothing. And the last private response I got about this was 4 months ago. But thanks for telling us what you can.
akagusu 5y ago
Why people are still using and promoting Cloudflare when the company is repeatedly trying to position itself as an internet gatekeeper? There is already a consensus that internet gatekeeping is bad for people, so why people are volunteering for this? This company already has a tremendous control over what people can or cannot see on internet since a lot of websites use it has CDN, but there should be a limit on what companies can do or cannot. In this particular case, we have blind people blocked from internet, and it doesn't matter if this is not on purpose or it is just a side effect, because in practice they are been blocked, and yet something like this is unable to make a scratch its reputation.
- vorpalhex 5y ago
  I don't think Cloudflare is intentionally trying to gatekeep the internet. At the same time the road to hell is paved with good intentions. Their CDN service has allowed a lot more sites to exist than the two it has harmed (and I don't consider those two to be great losses). However they are certainly becoming an internet chokepoint and we need more alternatives to them for the good of the internet.
  - saagarjha 5y ago
    Perhaps they don’t see it as “gatekeeping”, but it is clearly an explicit goal of theirs that the internet goes through them.
  - akagusu 5y ago
    Every big company IS intentionally trying to gatekeep their markets.
- wombarly 5y ago
  Because without CloudFlare we would: Pay thousands in bandwidth costs per month; Double or triple our servers to handle peaks (they cache and serve the HTML for us); Be down constantly because of DDOS attacks.
  - rhizome 5y ago
manquer 5y ago
Is there a case for ML based advanced screen readers which do not need assistance from the application ? The problem seems fairly tacklable . Learning what is on a display screen is relatively easier than most computer vision problem spaces. There are many repetitive patterns in typical application UX. For example let say there is a label for Save Icon that is an image (a Floppy Disk in most apps) and not alt tagged. By visually reading the image of the screen the model should not have to much difficulty in tagging it that as Save button ? Most consumer / biz app UX do follow many standard conventions if only out of convenience and lack of imagination, so building a learning algorithm around these components should be possible ?
- mwcampbell 5y ago
  This is being worked on. AFAIK, Apple is the first to incorporate this approach into a released product, with the Screen Recognition feature of VoiceOver starting in iOS 14.
  - manquer 5y ago
    Thanks for the response Matt. I leave the link here for others to look into [1]. Their effort seems currently limited to iOS based Phone screens. iOS is perhaps easier to solve given the strong Apple design guidelines for apps to pass the App Store review process. Perhaps a community supported distributed approach to help build the database of annotated screens for the model to learn from, combined with open source models for all kinds of screens and applications( not just Apple) would be interesting project to work on. [1] https://machinelearning.apple.com/research/creating-accessibility-metadata https://machinelearning.apple.com/research/creating-accessib...
    - SLJ7 5y ago
      Interestingly, iOS screen recognition also allows exploration of screenshots and remote desktop screens. I've heard of people using it to remotely install Windows as well. It would surprise me if Apple didn't have plans to put the same feature into its M1 mac.
- 5y ago
hbag 5y ago
Aren't Cloudflare the guys that're the only thing keeping Kiwifarms up and running? Fuck those guys.
alisonkisk 5y ago
Why does a networking infrastructure product affect the browser visual UI in an way? > A blind acquaintance of mine once lost his job because of a newly added requirement that he use an inaccessible application. If this happens to you, please call a lawyer. This is an easy case to win.
- mwcampbell 5y ago
  > Why does a networking infrastructure product affect the browser visual UI in an way? Because, as the original technology announcement [1] (which I linked in the OP) explains, they're running a remote browser and sending the rendered graphics from that browser down to the local client. So, since they're not putting in the extra work to send the semantic information required by screen readers and other accessibility tools, this breaks accessibility. > If this happens to you, please call a lawyer. This is an easy case to win. You're the fourth commenter on this thread to make that suggestion. Please check out the responses to the other three. [2] [3] [4] [1]: https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/ https://blog.cloudflare.com/cloudflare-and-remote-browser-is... [2]: https://news.ycombinator.com/item?id=28027986 https://news.ycombinator.com/item?id=28027986 [3]: https://news.ycombinator.com/item?id=28028116 https://news.ycombinator.com/item?id=28028116 [4]: https://news.ycombinator.com/item?id=28029813 https://news.ycombinator.com/item?id=28029813
deleted 5y ago
[deleted]
fouc 5y ago
While we're on the topic, I have a question: Are there large companies that have deliberately made their products less accessible to those with disabilities, because they're completely hostile to scrapers (and the open web)? Is it even possible to make a completely closed/hard-to-scrape web app that is still 100% accessible to the blind?
- mwcampbell 5y ago
  > Are there large companies that have deliberately made their products less accessible to those with disabilities, because they're completely hostile to scrapers (and the open web)? I'm not aware of any, but that doesn't mean they're not out there, in some specialized niche perhaps. > Is it even possible to make a completely closed/hard-to-scrape web app that is still 100% accessible to the blind? I would guess not. The headless browsers that scrapers are already using could be extended to expose their accessibility tree to scripts as well as the DOM.
ipv6ipv4 5y ago
Accessibility is important. Four months is not a lot of time for any large scale software project with a large team. Every little feature takes time. Why is it assumed that Cloudflare is not working on accessibility?
- mwcampbell 5y ago
  OK, I shouldn't have led with that number. If I had first told them about the problem 4 months ago, then of course it would be too soon to expect a solution. But as I wrote further down in the OP, I first contacted them about this roughly 18 months ago. As far as I can tell, they haven't done anything about it in all that time. And though I was previously in contact with the product manager, it has been 4 months since the last time he wrote to me, despite my recurring requests for an update. Also to be clear, I didn't choose to escalate this now because it has been 4 months. The trigger was Cloudflare's "Impact Week", which included a blog post about their Flarability employee resource group.
  - ipv6ipv4 5y ago
    If my understanding is correct, Cloudflare first released Browser Isolation 4 months ago. If my experience in the industry is relevant, they just barely released an MVP to get ‘something out the door’. I don’t know where accessibility is on their feature backlog (for all I know, maybe it isn’t) and I understand your point but I don’t think that 4 months is a long time for these things.
- haser_au 5y ago
  The open letter states the author contacted Matthew Prince (CEO, Cloudflare) 18 months ago, and received a response; "...assuring me that the team was taking accessibility into account. In particular, you wrote the following, referring to your company’s mission: “Agree with you that it’s critical we not take a step backward as we’re working toward building a better Internet.”
eastdakota 5y ago
This has been prioritized since long before Matt emailed me. It was specifically flagged during our diligence process of S2 Systems, the company we acquired for the Remote Browser Isolation (RBI) technology. It has been an engineering project that I have personally followed since we acquired S2 nearly two year ago. Unfortunately, this has proved a non-trivial problem to solve, in spite of significant engineering resources dedicated to it, and we don't yet have an acceptable solution. But I'm confident we're on the right track. The challenge is that the process of rendering content inert to local security threats also makes it also not compatible with current screen reader technology. Matt has helpfully suggested some ideas which are in-line with what we have been working on, but the diversity of the web makes the solution very complex in practice. While I appreciate his suggestion in this thread that if we would just hire him this could be fixed in a few months, I think he would acknowledge upon reflection that is flippant. How the web is rendered and the diversity of web pages, especially dynamically updated pages, makes many solutions that seem obvious not tenable. We need to validate the solution we deliver will work across all the complexities of the web and across a broad range of accessibility devices while, at the same time, not introducing new threats. We already have a great team doing this work. RBI is still a new product for us, and it's only been recently that we've gotten the core technology to work to a level that's acceptable, but I'm confident with the work we're doing we will be the first RBI technology in the market with broad accessibility support. In the meantime, we provide our customers a way to bypass the RBI technology to accommodate their visually impaired employees. In these cases, we recommend that additional safeguards be put in place for these employees' machines to guard against potential security compromise. This isn't a perfect solution, but it does help significantly reduce the surface area of attack while allowing visually impaired employees to do their jobs. I hope that others in the space with similar technologies — including Mighty, Menlo Security, zScaler, and others — will also dedicate the resources needed to make their products as accessible as possible. Matt is right to call on the industry to prioritize the needs of visually impaired users. As we solve these challenging problems ourselves, we will share what we've learned, how we overcame challenges, and we will not do anything to restrict the intellectual property behind the solutions so the entire industry can benefit. As for the rest of the discussion in this thread, I agree that Cloudflare is fundamentally in the trust business. It takes 5 minutes to sign up for Cloudflare, but only seconds to leave. We need to earn the trust of our customers, as well as Internet users in general, on a daily basis or we won't have a business. Appreciate everyone holding us accountable to that.
rspartain 5y ago
It is easy to agree that accessibility is important; it is another thing to make sure new products are accessible to all I am interested to see the response to this open letter. As a blind person myself I know how vital accessibility is in employment. . .

751 points by mwcampbell 5y ago

This makes logical sense. Smaller companies have fewer innovation tokens; large organizations like Cloudflare carry heavier burdens when releasing new products (i18n and a11y primarily among them).

devoutsalsa 5y ago
It seems like Cloudflare could embrace accessibility and use that in marketing as a competitive advantage.
- daviddever23box 5y ago
  ...as a competitive advantage against whom? Who else is providing this capability at the moment, and are they more or less accessible?
  - yjftsjthsd-h 5y ago
    If they don't already have competitors, they will soon enough, and a11y is a moat to have.

devwastaken 5y ago

Public services, even online, which are not accessible to those with major disabilities, is a violation of the ADA. https://youtu.be/IQjUCqVo4II https://youtu.be/IQjUCqVo4II This may apply in other ways to Cloudflare, and if so fines must be issued. It's 2021, there's no excuses for it other than not wanting to put in the work.

ceejayoz 5y ago
The fines would apply to the companies using CloudFlare, wouldn't they?
- daviddever23box 5y ago
  Yes.
ggreer 5y ago
By that logic, isn't every screen sharing app violating the ADA? A screen reader can't read the text on someone else's screen in Zoom, Webex, Slack, etc. Zoom even admits to this in their accessibility FAQ and encourages speakers to supplement with notes.[1] 1. https://zoom.us/accessibility/faq#faq11 https://zoom.us/accessibility/faq#faq11
- mwcampbell 5y ago
  > By that logic, isn't every screen sharing app violating the ADA? We'd love it if the legislation had that kind of teeth. As it happens, in my day job I've been developing a product to work around the inaccessibility of screen sharing in online meetings, starting with providing real-time access to PowerPoint slides. But I'm not here to plug that product.
  - ggreer 5y ago
    Just curious, but where do you draw the line? To use a silly example: we don't legally require every that everyone who posts an image on social media include a written description. There must be some ratio of cost to benefit at which accommodations stop being reasonable. If we required that screen sharing tools were compatible with screen readers, we'd have to revamp many layers of abstractions. It would require changes to every operating system, every UI framework, every browser, and every screen sharing application. An alternative would be to throw a bunch of machine learning at the problem (to try to turn pixels back into meaning), but that would have a lot of broken corner cases. The issues would likely be as bad as auto-generated subtitles, which are generally not good enough to be considered ADA compliant.[1] My guess is that if the law changed tomorrow and mandated that screen sharing tools accommodate the blind, we'd end up with no cross-platform screen sharing tools. Microsoft would make their Windows screen sharing. Apple would make their MacOS screen sharing. Google would make their ChromeOS screen sharing, and none of them would be interoperable. Also desktop Linux would be SOL. 1. UC Berkeley was forced to delete over 20,000 videos of lectures because their auto-generated subtitles weren't accurate enough: https://news.berkeley.edu/wp-content/uploads/2016/09/2016-08-30-UC-Berkeley-LOF.pdf https://news.berkeley.edu/wp-content/uploads/2016/09/2016-08...

em-bee 5y ago

what is the legal situation here? wouldn't laws that require the employer to make accommodations for the disabled simply force the company to not use this tool for blind employees? the company would have to prove that using this tool is strictly necessary, which i believe is hard to prove, because if it was strictly necessary then everyone at home should be using it too. there should only be few places where such a tool is strictly necessary, and those places already use it. anyone who only starts using it now when it gets more convenient can't make the claim that they could not do their work without it because they could until now.

mwcampbell 5y ago
> what is the legal situation here? Honestly, I don't know. We may disagree on whether browser isolation is strictly necessary. But to the extent that Cloudflare's marketing efforts convince IT departments that it is, and that it's important to adopt it company-wide, that's bad for blind people unless Cloudflare makes the product accessible. I don't know if their marketing efforts are succeeding, but I'm being proactive here.
- em-bee 5y ago
  well, i mean strictly necessary in the eyes of the law. but that's something we won't find out until affected people start suing employers for discrimination or whatever the appropriate claim here is. and until then there will be casualties as you already predict.
brudgers 5y ago
The legal situation is akin to speeding. While technically it is illegal to drive 56 in a 55, you won’t get a ticket for it. And lots of places the flow of traffic will be 85 in a 65 and the cops are not about to hold things up. Same with accessibility only there are powerful economic interests at play too.
- adventured 5y ago
  > And lots of places the flow of traffic will be 85 in a 65 and the cops are not about to hold things up. They sure will. They'll pull a traffic break when something is wrong. They get out in front of a block of traffic, throw on their lights, and begin swerving across lanes, instructing the speeding flow of traffic to collectively slow down. I've seen cops routinely do that in both California and on the East Coast. Cops will do that for various reasons, including safety purposes (if something has happened up ahead) or just to reassert control if they decide the flow of traffic is going too fast. Here is a safety example of it in action in Utah: https://www.youtube.com/watch?v=P9IsAu_96oo https://www.youtube.com/watch?v=P9IsAu_96oo The Germans apparently do this for safety as well: https://www.youtube.com/watch?v=a-TZBhy-jDk https://www.youtube.com/watch?v=a-TZBhy-jDk

goodpoint 5y ago

Cloudflare is also killing Tor with its blockpages. It's a global threat to privacy and freedom of information.

tmikaeld 5y ago
It's up the the site owner if they want to block Tor or not, the site owner cloud just as easily have blocked Tor if they where using a normal server.
- Asooka 5y ago
  But is blocking Tor a decision the site owner has to make, or is it the default and requiring you to set up custom site protection rules if you want to accept Tor traffic?
  - zinekeller 5y ago
    Explicit, using the special "country code" T1. However, I also noticed that natural blockrates (on my non-CF servers) tends to be higher on Tor exit addresses due to (seemingly) more aggressive hacking attempts - probably the same on CF (the real anonymity of Tor is both a blessing and a curse)
    - prophesi 5y ago
      You can explicitly block all TOR nodes, but by default the security settings is set to "Medium" which blocks the majority of them. I'd also like to know Cloudflare's definition of "malicious traffic". I think the main fears are DDoS attacks (which is a nonexistent threat to the majority of site owners) and scraping email addresses for spam. Which can be addressed by informing site owners to use a contact form widget instead of putting their email on their contact page.
      - zinekeller 5y ago
        See my corollary comment on some of my non-CF servers and the blocking - Tor does provide important anonymity, and I understand that Cloudflare, which is bigger, can probably absorb it without much damage, but unfortunately Tor exit nodes have a much higher attack and hacking attempts than regular IP addresses. In high-security applications when anonymity is already lost anyway (logging into a bank, for example) it is reasonable, due to the inherent risk, to block Tor exit nodes.

sokoloff 5y ago

> A blind acquaintance of mine once lost his job because of a newly added requirement that he use an inaccessible application. I find it hard to believe this happened as stated in the US, where any number of lawyers would be eager to take such an open-and-shut ADA violation case.

WORMS_EAT_WORMS 5y ago
No doubt it could happen but I agree with you. This entire post is very odd and makes absolutely no sense at all.
- mwcampbell 5y ago
  Can you be more specific about what doesn't make sense? I'm willing to clarify anything I wrote.
  - WORMS_EAT_WORMS 5y ago
    To my understanding their browser isolation text just renders to canvas on their edge servers (don’t quote me on this). Does canvas provide any accessibility at all and is actually a bigger problem with the creation of that standard / element in HTML5 with text generation? It’s essentially an image block that allows text generation with almost no accessibility in mind? That’s not really Cloudflare’s fault if so. I agree accessibility needs to be of higher priority. It’s a shame it’s seems to be almost always a secondary priority to everything in tech. But this post feels like an open letter to some bigger issue when it seems like it’s a very niche and non-common security tool. I mean no disrespect in this.
    - deleted 5y ago
      [deleted]
    - mwcampbell 5y ago
      > To my understanding their browser isolation text just renders to canvas on their edge servers (don’t quote me on this). Does canvas provide any accessibility at all and is actually a bigger problem with the creation of that standard / element in HTML5 with text generation? It’s an image block that allows text generation with almost no accessibility in mind? That’s not really Cloudflare’s fault to be honest. The standard workaround is to create a parallel DOM that's invisible, e.g. covered up by the canvas. To be clear, this parallel DOM should be based on the accessibility tree of the remote browser, not based on the original DOM, as that would undermine the whole point of the exercise. This work-around may not be perfect, but Cloudflare hasn't implemented even this. > But this post feels like an open letter to some bigger issue when it seems like it’s a very niche and non-common security tool. It seems to me, from Cloudflare's original pre-announcement of this technology [1], that they intend for it to be widely adopted. Here's the money quote: > Operating costs translate directly to customer costs. The S2 system was designed to make deployment to an entire enterprise and not just targeted users (aka: vaccinating half the class) both feasible and attractive for customers. [1]: https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/ https://blog.cloudflare.com/cloudflare-and-remote-browser-is...

cupcake-unicorn 5y ago

Thanks so much for holding Cloudflare accountable for this. It's upsetting that they had so much input from you leading up to it and now they're dropping the ball. A lot of accessibility stuff and mission statements just honestly amounts to virtue signalling with companies and sad to see that's the case with Cloudflare so hope they step up. It shouldn't have to get to the point where they're sued but I feel like more often than not that's the only thing that changes things like this.

nickdothutton 5y ago

When requesting new functionality please complete the “revenue opportunity size” field in the Jira and indicate what quarter you expect this opportunity to close.

geofft 5y ago
You're not wrong, and the answer is that this sort of thing needs to impact their bottom line somehow - either because customers insist on it as part of a purchase checklist, or because the legal system will actually go after violations, or because they'll lose important employees. I don't have a real sense of which of those is most realistic.
- daviddever23box 5y ago
  I'm not so sure that there's a legal recourse for this on Cloudflare's part, but it's certainly possible for the customer–at which point, the demand will increase to a tipping point.

_moof 5y ago

Fighting discrimination is difficult and can be exhausting. As someone in a (different) protected class I just want to say kudos for doing this work.

dnzkw 5y ago
Isn't demanding that non-trivial work is done just to accommodate your class the opposite of discrimination?
- codezero 5y ago
  They shouldn’t have to demand accommodation. That’s the point.
  - dnzkw 5y ago
    And my point is that discrimination is an active effort, which this is not. Things are, by default, not accessible, because things are generally crafted for able bodied humans.
    - Xorlev 5y ago
      It takes something that once was made accessible, through active effort, and makes it inaccessible. That's the point.
    - tobr 5y ago
      Where did you get the idea that discrimination has to be the result of an active effort? Anything that makes one group of people excluded or treated worse is discrimination, even if it is the result of an oversight. Your second sentence is basically exactly the problem: able-bodied people are arbitrarily treated as the “default”, and others are left out.
      - dnzkw 5y ago
        If it's an oversight how can it be an active effort? Able bodied people are the default because they are the absolutely overwhelming majority. Let's agree to disagree, I think.

Sebb767 5y ago

> A blind acquaintance of mine once lost his job because of a newly added requirement that he use an inaccessible application. IANAL, but wouldn't this be grounds for a lawsuit?

Ensorceled 5y ago
Yes. But then you have to hire a lawyer after just losing your job, survive during the time the lawsuit will take, win the lawsuit ("plaintiff was let go because position was redundant"), collect, resume your job or job hunt with a "trouble maker" label. I really wish HN contributors would not suggest the legal system as a solution for these types of problems, it's totally unrealistic.
- Sebb767 5y ago
  IMO this is a pretty clear-cut discrimination case. I'm aware that lawsuits can be problematic for quite a few reason, but just eating it up would be a just as horrible suggestion.
  - arp242 5y ago
    Aside from practical concerns such as time and money, these kind of battles can be very emotionally draining. Some of the most stressful experiences I've had in life is when some company or person did me a serious injustice and it's hard to get your rights. I found it's better to let go, for my own sake. It's very stressful and very easy for the situation to consume you, which isn't healthy and on balance you may be worse off if you factor this in. Everyone is different, and other people may experience these kind of things different, but I've seen the same in various other people, both publicly and in my private life. Of course this really sucks and is very unfair. But it doesn't change it.
    - Sebb767 5y ago
      Fair enough. Let's just hope said acquaintance was in a position to handle it without regrets.

nanankcornering 5y ago

and they're still passing traffic of 8chan and kiwi something..

gnicholas 5y ago

They wouldn't be the first. An SVP of a major SV company once told me "[my company] doesn't give a shit about accessibility, and no one in Silicon Valley does." When I went to the CSUN accessibility conference that year, guess which company's logo was emblazoned across the lanyards? Yup, their marketing department was happy to write checks that their company had no intention of cashing. Silicon Valley is famous for its 'patina of accessibility': https://medium.com/@nicklum/silicon-valleys-patina-of-accessibility-be406eb25b36 https://medium.com/@nicklum/silicon-valleys-patina-of-access...

mwcampbell 5y ago
I understand and can relate to the feeling that nobody gives a shit. And it may be true that the leadership of all of these companies only care about the bottom line. But let's not make things look worse than they are. Whatever the motive, some SV companies are doing good work in accessibility. The most obvious example is Apple; the introduction of VoiceOver on the iPhone in 2009 was groundbreaking and has been tremendously useful to blind people all over the world. Microsoft (disclosure: my former employer) is also doing good work on accessibility, e.g. its Seeing AI app. Of course, we have constructive criticism for these companies as well, but the state of accessibility in mainstream tech is not all bad.
- gnicholas 5y ago
  I understand that no one is perfect. What bothers me is the hypocrisy: making it seem like they care when they really don’t. Did they spend $100k to sponsor that conference? I’d prefer they spend that money actually training people to care.
  - novok 5y ago
    A more charitable explanation is they may care, but their organization might not put their money where their mouth is. Also organizations are not monolithic singular minds, especially as they get bigger and bigger. They are groups of people and one end doesn't talk to the other is quite common.

chmod775 5y ago

At this point browsers are a basic building block of our society. There is absolutely no excuse for lacking acessibility features. You might as well say your "browser" can't render Arabic.

kevin_thibedeau 5y ago
> There is absolutely no excuse for lacking acessibility features. Then how are the kids going to have their flashy Electron apps?
- mwcampbell 5y ago
  > Then how are the kids going to have their flashy Electron apps? This Electron-bashing is misplaced. In point of fact, Electron is one of the most accessible cross-platform UI solutions.

ushakov 5y ago

i’m getting more worried about where Google is going with their accessibility strategy flutter and the canvas-based google docs are completely inaccessible

konaraddi 5y ago
> the canvas-based google docs are completely inaccessible AFAIK Google docs is still accessible. See the “Additional details” at the bottom of https://workspaceupdates.googleblog.com/2021/05/Google-Docs-Canvas-Based-Rendering-Update.html https://workspaceupdates.googleblog.com/2021/05/Google-Docs-...: Compatibility for supported assistive technologies such as screen readers, braille devices, and screen magnification features, will not be impacted by the canvas-based rendering change. We will continue to ensure assistive technology is supported, and work on additional accessibility improvements enabled by canvas-based rendering
- ushakov 5y ago
  see, they didn’t say that canvas-based Google Docs will be accessible - all they promise here is that it will be “compatible” “compatible” could just mean that assistive technology will work while browsing Google Docs and nothing beyond that this is a textbook example deceptive corporate doublespeak
  - arp242 5y ago
    What more do you want beyond "will work"? Does it not actually work now? What are the issues and practical concerns right now?
wffurr 5y ago
Have you tried using a screen reader with Flutter apps or the canvas-based Docs? From the very first result on “Flutter accessibility”: >> We strongly encourage you to include an accessibility checklist as a key criteria before shipping your app. Flutter is committed to supporting developers in making their apps more accessible, and includes first-class framework support for accessibility in addition to that provided by the underlying operating system https://flutter.dev/docs/development/accessibility-and-localization/accessibility https://flutter.dev/docs/development/accessibility-and-local...

nonbirithm 5y ago

Anecdotally, even with websites like Twitter that obfuscate their CSS class names to prevent the use of selective adblock, they still leave the readable ARIA strings in predictable places, allowing uBlock Origin users to create blacklist rules matching them. I'm wondering if those two features are at odds.

wolfgang42 5y ago
Do we know that Twitter is intentionally doing that to defeat adblockers? It’s a common speculation I see about them (and maybe it’s a convenient side-effect), but these sorts of mangled class names are also a common feature of popular CSS-in-JS libraries. (I work on an internal app that does the same thing, and it’s incredibly annoying but definitely not explicitly intended to be hostile.)
madjam002 5y ago
Twitter uses react-native-web which generates random class names, they’re not doing it to evade ad blockers.
novok 5y ago
You can do ad block with text in tag types I've found out. I use it to block the email nag from reddit.

daviddever23box 5y ago

Why not push the screen reader component upstream? It'd be another service add-on, but it might also be useful for folks who want to have narrative browsing, e.g., the equivalent of someone reading the news sites to the listener without having to interact with the site itself.

mwcampbell 5y ago
> Why not push the screen reader component upstream? Are you suggesting that a screen reader should run on the same remote machine as the remote browser and push its audio down to the client? Or something else?
- daviddever23box 5y ago
  Yes - in the same manner as game streaming.
  - mwcampbell 5y ago
    That would be better than nothing, and if Cloudflare had done that, I don't think I'd be complaining publicly at this point. But there are still problems with this approach. The ones that come to mind: 1. Assuming the remote service only sends down streaming audio, this doesn't work for blind people that must use a refreshable Braille display, e.g. deafblind people. Perhaps one could hack a way to get their local screen reader to render specific text on the Braille display, but probably not without that screen reader speaking the same text. That leads me to... 2. A blind user is already running a screen reader, with its own text-to-speech engine, configured the way they want it. Adding a remote screen reader to the mix would mean two different TTS engines, and the user would need to have a way of configuring the remote one, e.g. to adjust its speed. For blind people, TTS settings are very personal. 3. The remote screen reader and the local one may clash on keyboard commands. And, depending on the screen reader, this is another thing that the use may have customized already; for example, some screen readers have desktop and laptop keymaps. 4. Also speaking of keyboard commands, some of them might not be implementable in a browser-based application. It's common, at least on Windows, for screen readers to use non-standard modifier keys, e.g. Insert or Caps Lock.

lbriner 5y ago

Sad but typical and not just from big "evil" companies (not suggesting that CF is!) I just ran Jekyll to migrate my Blogger blog to self-hosted and with the default importer and default theme, I clicked the Web Accessibility button and immediately got some several hundred contrast errors (lots of blog post links) and some incorrect heading levels. Just basics but people are too unaware of accessibility requirements that this even happens before a release. What is missing? Is there not an online checker like w3c does for markup or acid does for browser tests? Oh yes, it is here: https://wave.webaim.org/ https://wave.webaim.org/ and there is also a browser plugin so no real excuses.

arp242 5y ago
I don't know what you did exactly, but the default Jekyll theme is fairly simple black-on-white and doesn't seem to have any major issues from quick spot-check. I think it may be an issue with your import(?)

miki123211 5y ago

This problem unfortunately applies to a lot of remote access software, particularly when the web browser is the client. I know of one company that switched to Web VNC for accessing a specific piece of software. They had a lot of offices and the software was expensive (paid per machine). This way, they could switch to a much smaller number of licenses, letting any employee connect from anywhere and wait in line if necessary. A blind person has lost a job over this.

deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
digitallyfree 5y ago
I'm not sure if remote access programs (web browser or not) even support screen readers on the client, especially since many of those render the entire desktop server-side and send it back to the client as an image or video. A possible option may be to run the screen reader on the remote desktop itself if that's possible.
- mwcampbell 5y ago
  > A possible option may be to run the screen reader on the remote desktop itself if that's possible. For generic remote desktop access, that's what we have to do. But piping accessibility information (in its generic form, not pre-rendered as speech) to the client side in that case is much harder than it would be for this Chromium-based remote browser. (I know this from relevant experience during my time on the Windows accessibility team at Microsoft.)
yjftsjthsd-h 5y ago
> A blind person has lost a job over this. IANAL, but in at least the US and Europe that sounds like the easiest lawsuit of their life
- 5y ago

Animats 5y ago

We're probably headed for a world in which everything is rendered to an image server-side. The HTML/CSS/Javascript mess has become so bloated and attack-ridden that sending images needs less bandwidth and is simpler.

mwcampbell 5y ago
That wouldn't be so bad if the server sent down a tree of semantic UI elements, a.k.a. an accessibility tree, along with that image. That's basically what I advised Cloudflare to do ~18 months ago.
- miki123211 5y ago
  Except doing so is probably much more complicated than actually dealing with the CSS and HTML. Hell, it would probably take twice as much manpower to make this remote browser thing accessible than it took to make it work in the first place.
  - mwcampbell 5y ago
    I doubt that. Chromium's internal accessibility tree is already serializable; it has to be, so it can be sent from the renderer process to the main process. So Cloudflare's modified Chromium could send that tree down to their JS-based client, which could then construct a DOM with the appropriate HTML tags and ARIA attributes. This DOM wouldn't have any JavaScript or any references to remote resources, so it wouldn't pose the same security risks as the original web page.
    - x0x0 5y ago
      Would you need the css? And mutations to this dom would need to be tightly synced to image updates to not confuse the hell out of nvda? Or am I misunderstanding?
      - mwcampbell 5y ago

MattGaiser 5y ago

For people who have worked on accessibility related stuff in production projects, how much more expensive is it vs just ignoring it?

BoorishBears 5y ago
Does it matter? Tomorrow morning you can wake up needing those accessibility features.
- wyager 5y ago
  Of course it matters. If your model of the world is “we need to spend infinite resources ensuring every system can be operated by anyone with any disability”, that’s obviously nonsense. Accessibility is valuable but not infinitely so. Sometimes (usually) it’s best not to encumber an innovation just because the innovation doesn’t immediately apply to everyone.
  - BoorishBears 5y ago
    You're answering a statement no one made. They asked "what does it cost vs just ignoring it". The point is just ignoring it (in other words assigning it 0 value) shouldn't be on the table. I'm also giving this person the benefit of the doubt and assuming they're not asking if accessibility costs infinity dollars.
- MattGaiser 5y ago
  I am trying to get a sense of how big an ask this is. Is it a million dollar ask? 100K? A million a year (does it need a full time team)?
  - arp242 5y ago
    It really depends on the specifics; for something like this I suspect it's a non-trivial investment. For a lot of other things it's not that hard. For a lot of things a18y features are just good features in general; zooming text for example is something loads of people do, not just blind or low-vision people.

tomklein 5y ago

Out of curiosity: Do screenreaders use OCR nowadays and if so, is it working good or rather bad due to the lost HTML markup?

miki123211 5y ago
They sort of do. Voice Over on iOS, and it's screen recognition, is probably the most notable example. It even tries to recognize some UI controls and emulate common behaviors (like sliding a slider), for example. It's far from perfect. It might help when you need to click the odd inaccessible button, but is definitely not enough for daily web browsing.
arp242 5y ago
OCR is a poor substitute since it can't really effectively navigate things due to lack of navigational information, recognition of semantic elements like headers, etc. I'm not blind myself, but I've tried to use some screen readers in the past to get a feel of what it's like. While I'm a very inexperienced user, one thing I noticed is that even with the best designs it's actually really time-consuming compared to regular browsing. I would imagine that an OCR solution would be even more time-consuming, if it even works well at all.
- thatguy0900 5y ago
  I've heard that actual blind people train themselves to use a speed of speech that is almost unintelligible, so it might be significantly faster for them to use the same software
- mwcampbell 5y ago
  Please be careful about drawing conclusions on what web browsing must be like for blind people, based on your limited experience with a screen reader. One of my blind friends put it more eloquently: https://news.ycombinator.com/item?id=9284744 https://news.ycombinator.com/item?id=9284744 A sibling comment makes a good point about blind people running their speech synthesizers at high speeds. Experienced screen reader users are also good at using their screen reader's many keyboard commands to jump around a web page.

miki123211 5y ago

On most Cloudflare-related HN threads, Cloudflare was really active and eager to answer the engineers' questions. It's notable that this one is different. The fact that it's Sunday afternoon may be part of the reason, but I guess they really don't have anything to say. I'd really love to see their internal Slack now, though.

mwcampbell 5y ago
I submitted this on Friday, but for whatever reason, it didn't catch on then. Thanks to the HN mods for putting it in the second-chance pool. I've pinged Cloudflare and eastdakota again on Twitter, so let's see what happens.
- whoaisme 5y ago
  When google makes arbitrary decisions we hate on google. When hn makes arbitrary decisions we say thank you. And we wonder why the tech industry is so fucked up. Imagine how even more pathetic this site would be if dang paid you all 6 figures.
- oknhy30ao 5y ago
  Hey, I don't work on the Browser Isolation team, but want to let you know that there's a project in progress and your post is certainly being discussed. I'm hoping we can provide a solution that meets or exceeds your expectations. PS-- Please ardon the throwaway account, CF employees have been getting targetted online.
  - mwcampbell 5y ago
    . I look forward to the results of that work in progress. In the meantime, I still think it's reasonable to expect an official response. As far as I can tell, Cloudflare has not publicly acknowledged the problem yet (please correct me if I'm wrong); even a disclaimer on the product page would be better than nothing. And the last private response I got about this was 4 months ago. But thanks for telling us what you can.

akagusu 5y ago

Why people are still using and promoting Cloudflare when the company is repeatedly trying to position itself as an internet gatekeeper? There is already a consensus that internet gatekeeping is bad for people, so why people are volunteering for this? This company already has a tremendous control over what people can or cannot see on internet since a lot of websites use it has CDN, but there should be a limit on what companies can do or cannot. In this particular case, we have blind people blocked from internet, and it doesn't matter if this is not on purpose or it is just a side effect, because in practice they are been blocked, and yet something like this is unable to make a scratch its reputation.

vorpalhex 5y ago
I don't think Cloudflare is intentionally trying to gatekeep the internet. At the same time the road to hell is paved with good intentions. Their CDN service has allowed a lot more sites to exist than the two it has harmed (and I don't consider those two to be great losses). However they are certainly becoming an internet chokepoint and we need more alternatives to them for the good of the internet.
- saagarjha 5y ago
  Perhaps they don’t see it as “gatekeeping”, but it is clearly an explicit goal of theirs that the internet goes through them.
- akagusu 5y ago
  Every big company IS intentionally trying to gatekeep their markets.
wombarly 5y ago
Because without CloudFlare we would: Pay thousands in bandwidth costs per month; Double or triple our servers to handle peaks (they cache and serve the HTML for us); Be down constantly because of DDOS attacks.
- rhizome 5y ago

manquer 5y ago

Is there a case for ML based advanced screen readers which do not need assistance from the application ? The problem seems fairly tacklable . Learning what is on a display screen is relatively easier than most computer vision problem spaces. There are many repetitive patterns in typical application UX. For example let say there is a label for Save Icon that is an image (a Floppy Disk in most apps) and not alt tagged. By visually reading the image of the screen the model should not have to much difficulty in tagging it that as Save button ? Most consumer / biz app UX do follow many standard conventions if only out of convenience and lack of imagination, so building a learning algorithm around these components should be possible ?

mwcampbell 5y ago
This is being worked on. AFAIK, Apple is the first to incorporate this approach into a released product, with the Screen Recognition feature of VoiceOver starting in iOS 14.
- manquer 5y ago
  Thanks for the response Matt. I leave the link here for others to look into [1]. Their effort seems currently limited to iOS based Phone screens. iOS is perhaps easier to solve given the strong Apple design guidelines for apps to pass the App Store review process. Perhaps a community supported distributed approach to help build the database of annotated screens for the model to learn from, combined with open source models for all kinds of screens and applications( not just Apple) would be interesting project to work on. [1] https://machinelearning.apple.com/research/creating-accessibility-metadata https://machinelearning.apple.com/research/creating-accessib...
  - SLJ7 5y ago
    Interestingly, iOS screen recognition also allows exploration of screenshots and remote desktop screens. I've heard of people using it to remotely install Windows as well. It would surprise me if Apple didn't have plans to put the same feature into its M1 mac.
5y ago

hbag 5y ago

Aren't Cloudflare the guys that're the only thing keeping Kiwifarms up and running? Fuck those guys.

alisonkisk 5y ago

Why does a networking infrastructure product affect the browser visual UI in an way? > A blind acquaintance of mine once lost his job because of a newly added requirement that he use an inaccessible application. If this happens to you, please call a lawyer. This is an easy case to win.

mwcampbell 5y ago
> Why does a networking infrastructure product affect the browser visual UI in an way? Because, as the original technology announcement [1] (which I linked in the OP) explains, they're running a remote browser and sending the rendered graphics from that browser down to the local client. So, since they're not putting in the extra work to send the semantic information required by screen readers and other accessibility tools, this breaks accessibility. > If this happens to you, please call a lawyer. This is an easy case to win. You're the fourth commenter on this thread to make that suggestion. Please check out the responses to the other three. [2] [3] [4] [1]: https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/ https://blog.cloudflare.com/cloudflare-and-remote-browser-is... [2]: https://news.ycombinator.com/item?id=28027986 https://news.ycombinator.com/item?id=28027986 [3]: https://news.ycombinator.com/item?id=28028116 https://news.ycombinator.com/item?id=28028116 [4]: https://news.ycombinator.com/item?id=28029813 https://news.ycombinator.com/item?id=28029813

deleted 5y ago

[deleted]

fouc 5y ago

While we're on the topic, I have a question: Are there large companies that have deliberately made their products less accessible to those with disabilities, because they're completely hostile to scrapers (and the open web)? Is it even possible to make a completely closed/hard-to-scrape web app that is still 100% accessible to the blind?

mwcampbell 5y ago
> Are there large companies that have deliberately made their products less accessible to those with disabilities, because they're completely hostile to scrapers (and the open web)? I'm not aware of any, but that doesn't mean they're not out there, in some specialized niche perhaps. > Is it even possible to make a completely closed/hard-to-scrape web app that is still 100% accessible to the blind? I would guess not. The headless browsers that scrapers are already using could be extended to expose their accessibility tree to scripts as well as the DOM.

ipv6ipv4 5y ago

Accessibility is important. Four months is not a lot of time for any large scale software project with a large team. Every little feature takes time. Why is it assumed that Cloudflare is not working on accessibility?

mwcampbell 5y ago
OK, I shouldn't have led with that number. If I had first told them about the problem 4 months ago, then of course it would be too soon to expect a solution. But as I wrote further down in the OP, I first contacted them about this roughly 18 months ago. As far as I can tell, they haven't done anything about it in all that time. And though I was previously in contact with the product manager, it has been 4 months since the last time he wrote to me, despite my recurring requests for an update. Also to be clear, I didn't choose to escalate this now because it has been 4 months. The trigger was Cloudflare's "Impact Week", which included a blog post about their Flarability employee resource group.
- ipv6ipv4 5y ago
  If my understanding is correct, Cloudflare first released Browser Isolation 4 months ago. If my experience in the industry is relevant, they just barely released an MVP to get ‘something out the door’. I don’t know where accessibility is on their feature backlog (for all I know, maybe it isn’t) and I understand your point but I don’t think that 4 months is a long time for these things.
haser_au 5y ago
The open letter states the author contacted Matthew Prince (CEO, Cloudflare) 18 months ago, and received a response; "...assuring me that the team was taking accessibility into account. In particular, you wrote the following, referring to your company’s mission: “Agree with you that it’s critical we not take a step backward as we’re working toward building a better Internet.”

eastdakota 5y ago

This has been prioritized since long before Matt emailed me. It was specifically flagged during our diligence process of S2 Systems, the company we acquired for the Remote Browser Isolation (RBI) technology. It has been an engineering project that I have personally followed since we acquired S2 nearly two year ago. Unfortunately, this has proved a non-trivial problem to solve, in spite of significant engineering resources dedicated to it, and we don't yet have an acceptable solution. But I'm confident we're on the right track. The challenge is that the process of rendering content inert to local security threats also makes it also not compatible with current screen reader technology. Matt has helpfully suggested some ideas which are in-line with what we have been working on, but the diversity of the web makes the solution very complex in practice. While I appreciate his suggestion in this thread that if we would just hire him this could be fixed in a few months, I think he would acknowledge upon reflection that is flippant. How the web is rendered and the diversity of web pages, especially dynamically updated pages, makes many solutions that seem obvious not tenable. We need to validate the solution we deliver will work across all the complexities of the web and across a broad range of accessibility devices while, at the same time, not introducing new threats. We already have a great team doing this work. RBI is still a new product for us, and it's only been recently that we've gotten the core technology to work to a level that's acceptable, but I'm confident with the work we're doing we will be the first RBI technology in the market with broad accessibility support. In the meantime, we provide our customers a way to bypass the RBI technology to accommodate their visually impaired employees. In these cases, we recommend that additional safeguards be put in place for these employees' machines to guard against potential security compromise. This isn't a perfect solution, but it does help significantly reduce the surface area of attack while allowing visually impaired employees to do their jobs. I hope that others in the space with similar technologies — including Mighty, Menlo Security, zScaler, and others — will also dedicate the resources needed to make their products as accessible as possible. Matt is right to call on the industry to prioritize the needs of visually impaired users. As we solve these challenging problems ourselves, we will share what we've learned, how we overcame challenges, and we will not do anything to restrict the intellectual property behind the solutions so the entire industry can benefit. As for the rest of the discussion in this thread, I agree that Cloudflare is fundamentally in the trust business. It takes 5 minutes to sign up for Cloudflare, but only seconds to leave. We need to earn the trust of our customers, as well as Internet users in general, on a daily basis or we won't have a business. Appreciate everyone holding us accountable to that.

rspartain 5y ago

It is easy to agree that accessibility is important; it is another thing to make sure new products are accessible to all I am interested to see the response to this open letter. As a blind person myself I know how vital accessibility is in employment. . .