4 ms·

As someone who builds an open source remote browser myself, this is a non trivial task. but anyone who wants to attempt to bring accessibility to a pixels only

As someone who builds an open source remote browser myself, this is a non trivial task. but anyone who wants to attempt to bring accessibility to a pixels only or drawing instructions only remote isolated browser security model is welcome to fork my repository and add that kind of stuff. I appreciate the importance of accessibility but the tone of that article strikes me as strident and demanding, acknowledging only the situation feelings and difficulty of accessibility users, but not of the developers, nor of the other user groups. Technically the issue is a trade-off between security and inspectability. the most secure remote browser technology simply sends pixels or in the case of S2 and cloudflare drawing instructions from the remote browser to the local client where the viewport is then presented so there is no HTML JavaScript or css sent to the client... which is the basis of that whole remote browser isolation security model. In order to make that accessible, without having the benefit of the HTML CSS and JavaScript on the client, it's not trivial. The more you expose that information from which you can bring accessibility to the client the greater the attack surface from a security point of view. So it's a trade off.

mcguire 5y ago
The most secure remote browser technology is powered off.
- cenophor 5y ago
  There is no browser if there is no power?
- graderjs 5y ago
  Ha yes, the internet would be secure if powered off. But apart from that the most secure is only sending pixels .. or drawing instructions.
  - sangnoir 5y ago
    How is sending textual information for screen readers less secure? Isn't that just "speech instructions"?
    - graderjs 5y ago
      I think in order to discuss this we'd need to be clear about the actual solutions we're discussing...I'm not right now I'm sorry, so I can say no more than, in general, any additional data you send opens up the attack surface. Tho I can say that, relevant to your idea, at least, in my RBI product[0], you can click somewhere in the viewport and say "Copy text" and then you get a HTML dialog open over the canvas viewport with the text. A screen-reader could potentially then read that. But I think actual accessibility tools need to do so much more...Forgive me, I'm no expert in them. Re the above tho, I don't see that as introducing a greater attack surface (tho I might be wrong) because on the server side we're just getting the innerText of the element the client clicked on, and sending that text back encoded in base64 (IIRC). [0]: https://github.com/i5ik/ViewFinder https://github.com/i5ik/ViewFinder
      - sangnoir 5y ago
        > But I think actual accessibility tools need to do so much more Screen readers do more, but they are not rocket science. I am no expert either, but I've worked on adding accessibility to a project that had none. Screen readers have proactive & interactive modes. In proactive mode, they read whats visible on the page, perhaps just the high-level components, giving a lay of the land. In interactive mode, it gives more detail on the control/item that currently has focus and the actions available (follow link, expand/collapse section, etc), and one would tab to move focus between controls. I'm no expert on RBI, but I looked at your product and it appears to respond in real time to user interaction (hover over elements), perhaps what is missing is a standardized way to integrate Screen readers this "streaming" information; most accessible sites have plain-text ARIA tags/attributes meant for screen readers (with fall backs to 'title' or 'alt'[1]). However, this is just plain text, so sending text to the client adds an attack surface, but not a very large one, IMO. I believe every developer who makes user-facing software should be forced to sit down and use their app/site with the monitor off, interacting with just the screen reader in their headphones. www.a11yproject.com has really good information on how accessibility ('a11y') works, and how to implement it correctly on the web. 1. I'm simplifying by a lot here -screen readers do a lot of heavy lifting, especially for sites/software not designed with accessibility in mind
  - mcguire 5y ago
    I'd just like to note that powering off sounds drastic, right? But that is what this product is doing to the visually impaired.
    - graderjs 5y ago
      No that's cool, i thought you were coming with an antagonistic attitude in the first comment i just tried to play it cool and positive, i succeeded but you showed how you really felt above. This product is not doing that to them, anymore than the visual world, and every image on the internet that isn't captioned in every detail is doing that to them. So don't pretend that it's somehow our fault that o people are blind. That's important. There are important issues here but too often i see people misusing the cause of disabled people as a fake pretext to abuse others, while pretending they're being righteous, by criticizing and trying to control others, driven by their own need to put others down and feel better than them, thinking they're found a legitimate way to perpetrate their abuse. But they haven't. And that's why I'm really scared of talking with people about this because so many get caught up in that game. Especially worse when they say oh let's not care about the feelings of the developers. Because that's exactly what they intend to do... be abusive and then pretend they're righteous while disguising themselves in the cause of supporting disabled people. well they're actually hurting disabled people by proposing these ineffective solutions and poisoning the discussion about this rather than trying to constructively support effective solutions. so what I'm trying to do with this statement is bring it's important topic back from being this excuse for toxic behavior. That's not a respectful or a good use of this topic at all. But separating that out, disabled people have a valuable contribution to make and their voice should be heard and they should have access. So there are important problems that need solutions but the solution proposed by a lot of these people being abusive is oh let's get every vendor to alter everything they do to make it conform to this standard...and agree the case of buildings it's important to have a disabled ramp or something... but in the case of software that's not a scalable solution. And it doesn't respect the developers. I think the better solution is something like a browser extension and I think the ultimate solution is to leverage The power of AI to direct that ability to create the accessibility trees and so on from websites without needing annotations surely that should be possible and I think that is the ultimate solution and you're only doing disabled people a disservice by focusing on these you know ineffective solutions when there are technologically much better and much more scalable and effective ones and then you're only doing developers or disservice by having this abusive attitude. I'm not saying you were exactly doing that but I did detect that antagonism so it seems like you could get caught up in that too but I'm making a larger point about a dynamic that I see in these types of discussions. so the short way of saying it is it's a really important topic so the most effective way to deal with that is to respect the developers, respectfully engage The stakeholders and try to leverage the most effective technology not to misuse the topic itself as an excuse to be abusive because you feel you need to do that.
jakelazaroff 5y ago
> I appreciate the importance of accessibility but the tone of that article strikes me as strident and demanding, acknowledging only the situation feelings and difficulty of accessibility users, but not of the developers, nor of the other user groups. Who cares about the “feelings and difficulty” of the developers? This isn’t a niche side project they’re building for free on nights and weekends. They’re being paid handsomely by a multi-billion dollar corporation selling the software for profit. And let’s be clear about what’s happening. The trade off isn’t about security. I’m sure you’re right that it’s not trivial, but problem is entirely solvable — it just costs money. Cloudflare has decided that accommodating visually impaired users is less important than their profit margins on this thing.
- graderjs 5y ago
  I think you always need to care about the feelings of the developers... Because that privileged and entitled attitude that I see prevalent in open source and even in complaints from customers to a company... I think it's a lacking in empathy thing and it's not a good thing to encourage at all... Also, I don't think you will achieve a good outcome for yourself or for anyone involved (and that's important) if you start from the point of view of let's just not care about the feelings of this group. But I can also see how you feel like the feelings of accessibility users are not being cared about by this decision...but I encourage you to take a step back and see things in less absolute terms because I...think the situation has a lot of nuance which when appreciated changes the the way you'd be likely to choose if you are in charge of this. [i edited out a whole bunch of stuff in the middle...go here, if you wanna see it: https://pastebin.com/YkcRgFFz https://pastebin.com/YkcRgFFz] Also in this specific category consider the idea that the isolation model is perforated by the need for accessibility so while you think you're getting simply a gain for accessibility users by opening the product up to be used by them you may be doing so in such a way that weakens the security model not only for all the other users, but for accessibility users as well... So, technically, or logically.. it very much is a trade-off about security, as much as you may wish to deny. I think if you weren't thinking in such absolute terms but more acquainted with the nuance of this technology you might see that as well. but hey i could be misreading you in my own strident and stupid way, so i'm sorry if that's the case and it's possible i haven't yet considered the nuance of your view and feelings on this.
howinteresting 5y ago
It is correct for the feelings of blind users to be prioritized over those of the developers. Blind and other disabled people have to deal with ableism in society every single day.
- graderjs 5y ago
  No that's not right, nor even correct. You can't just disregard their feelings, and put someone else above them no matter the issue. There's no justification for this. Disabled people have a valuable contribution to make and their voice should be heard. They should have access. But this good cause is often misused by people using it as a fake pretext for abusing others under the delusion they are absolutely right, and persecuting anyone who disagrees as absolutely wrong. This it is correct to prioritize feelings over bullshit is part of this. It's ape brain shit of trying to dominate others with criticism and control, and pretend they're holy warriors. That attitude is a contributor to why I'm so scared to engage with people about this topic. It's also sad for disabled people because these abusive crusaders give the cause a bad name, and generate counter productive resistance all for the sake of their own compensatory ego gyrations. But separating out how the topic is misused by some looking to criticize or control others...there is a real issue here and and it's an important and good cause. But the solutions posited, often by the same folks, are not I think the best technical solutions, they're not scalable or efficient. Asking every website to provide hints might be OK at a small scale, but at internet scale it doesn't work. I think the right solution is to direct AI at the problem and have these accessibility directives generated automatically. Intelligent accessibility is a feature that should be present in browsers (or screen readers) by way of AI. People who care about the topic and want change should get to work on that.
  - mwcampbell 5y ago
    Original author here. I am taking your comments to heart. I'm not yet prepared to concede that we should give up on accessibility standards for platform and application developers and expect AI to solve the whole thing; I need to discuss this with others in the blind community. I appreciate that expecting every application and website to implement accessibility standards doesn't scale, but it's the best we have so far. You said the tone of my article was strident and demanding. Please note that it was addressed to the leader of a growing public company, calling on the company to live up to their own PR about their mission. I wouldn't take that tone with a solo developer like you. Even so, I don't believe I was abusive or persecuting. Still, it's likely that writing and promoting this article did make some part of my ape brain feel good about fighting for a righteous cause. So thanks for making me stop and think.

mcguire 5y ago

The most secure remote browser technology is powered off.

cenophor 5y ago
There is no browser if there is no power?
graderjs 5y ago
Ha yes, the internet would be secure if powered off. But apart from that the most secure is only sending pixels .. or drawing instructions.
- sangnoir 5y ago
  How is sending textual information for screen readers less secure? Isn't that just "speech instructions"?
  - graderjs 5y ago
    I think in order to discuss this we'd need to be clear about the actual solutions we're discussing...I'm not right now I'm sorry, so I can say no more than, in general, any additional data you send opens up the attack surface. Tho I can say that, relevant to your idea, at least, in my RBI product[0], you can click somewhere in the viewport and say "Copy text" and then you get a HTML dialog open over the canvas viewport with the text. A screen-reader could potentially then read that. But I think actual accessibility tools need to do so much more...Forgive me, I'm no expert in them. Re the above tho, I don't see that as introducing a greater attack surface (tho I might be wrong) because on the server side we're just getting the innerText of the element the client clicked on, and sending that text back encoded in base64 (IIRC). [0]: https://github.com/i5ik/ViewFinder https://github.com/i5ik/ViewFinder
    - sangnoir 5y ago
      > But I think actual accessibility tools need to do so much more Screen readers do more, but they are not rocket science. I am no expert either, but I've worked on adding accessibility to a project that had none. Screen readers have proactive & interactive modes. In proactive mode, they read whats visible on the page, perhaps just the high-level components, giving a lay of the land. In interactive mode, it gives more detail on the control/item that currently has focus and the actions available (follow link, expand/collapse section, etc), and one would tab to move focus between controls. I'm no expert on RBI, but I looked at your product and it appears to respond in real time to user interaction (hover over elements), perhaps what is missing is a standardized way to integrate Screen readers this "streaming" information; most accessible sites have plain-text ARIA tags/attributes meant for screen readers (with fall backs to 'title' or 'alt'[1]). However, this is just plain text, so sending text to the client adds an attack surface, but not a very large one, IMO. I believe every developer who makes user-facing software should be forced to sit down and use their app/site with the monitor off, interacting with just the screen reader in their headphones. www.a11yproject.com has really good information on how accessibility ('a11y') works, and how to implement it correctly on the web. 1. I'm simplifying by a lot here -screen readers do a lot of heavy lifting, especially for sites/software not designed with accessibility in mind
- mcguire 5y ago
  I'd just like to note that powering off sounds drastic, right? But that is what this product is doing to the visually impaired.
  - graderjs 5y ago
    No that's cool, i thought you were coming with an antagonistic attitude in the first comment i just tried to play it cool and positive, i succeeded but you showed how you really felt above. This product is not doing that to them, anymore than the visual world, and every image on the internet that isn't captioned in every detail is doing that to them. So don't pretend that it's somehow our fault that o people are blind. That's important. There are important issues here but too often i see people misusing the cause of disabled people as a fake pretext to abuse others, while pretending they're being righteous, by criticizing and trying to control others, driven by their own need to put others down and feel better than them, thinking they're found a legitimate way to perpetrate their abuse. But they haven't. And that's why I'm really scared of talking with people about this because so many get caught up in that game. Especially worse when they say oh let's not care about the feelings of the developers. Because that's exactly what they intend to do... be abusive and then pretend they're righteous while disguising themselves in the cause of supporting disabled people. well they're actually hurting disabled people by proposing these ineffective solutions and poisoning the discussion about this rather than trying to constructively support effective solutions. so what I'm trying to do with this statement is bring it's important topic back from being this excuse for toxic behavior. That's not a respectful or a good use of this topic at all. But separating that out, disabled people have a valuable contribution to make and their voice should be heard and they should have access. So there are important problems that need solutions but the solution proposed by a lot of these people being abusive is oh let's get every vendor to alter everything they do to make it conform to this standard...and agree the case of buildings it's important to have a disabled ramp or something... but in the case of software that's not a scalable solution. And it doesn't respect the developers. I think the better solution is something like a browser extension and I think the ultimate solution is to leverage The power of AI to direct that ability to create the accessibility trees and so on from websites without needing annotations surely that should be possible and I think that is the ultimate solution and you're only doing disabled people a disservice by focusing on these you know ineffective solutions when there are technologically much better and much more scalable and effective ones and then you're only doing developers or disservice by having this abusive attitude. I'm not saying you were exactly doing that but I did detect that antagonism so it seems like you could get caught up in that too but I'm making a larger point about a dynamic that I see in these types of discussions. so the short way of saying it is it's a really important topic so the most effective way to deal with that is to respect the developers, respectfully engage The stakeholders and try to leverage the most effective technology not to misuse the topic itself as an excuse to be abusive because you feel you need to do that.

jakelazaroff 5y ago

> I appreciate the importance of accessibility but the tone of that article strikes me as strident and demanding, acknowledging only the situation feelings and difficulty of accessibility users, but not of the developers, nor of the other user groups. Who cares about the “feelings and difficulty” of the developers? This isn’t a niche side project they’re building for free on nights and weekends. They’re being paid handsomely by a multi-billion dollar corporation selling the software for profit. And let’s be clear about what’s happening. The trade off isn’t about security. I’m sure you’re right that it’s not trivial, but problem is entirely solvable — it just costs money. Cloudflare has decided that accommodating visually impaired users is less important than their profit margins on this thing.

graderjs 5y ago
I think you always need to care about the feelings of the developers... Because that privileged and entitled attitude that I see prevalent in open source and even in complaints from customers to a company... I think it's a lacking in empathy thing and it's not a good thing to encourage at all... Also, I don't think you will achieve a good outcome for yourself or for anyone involved (and that's important) if you start from the point of view of let's just not care about the feelings of this group. But I can also see how you feel like the feelings of accessibility users are not being cared about by this decision...but I encourage you to take a step back and see things in less absolute terms because I...think the situation has a lot of nuance which when appreciated changes the the way you'd be likely to choose if you are in charge of this. [i edited out a whole bunch of stuff in the middle...go here, if you wanna see it: https://pastebin.com/YkcRgFFz https://pastebin.com/YkcRgFFz] Also in this specific category consider the idea that the isolation model is perforated by the need for accessibility so while you think you're getting simply a gain for accessibility users by opening the product up to be used by them you may be doing so in such a way that weakens the security model not only for all the other users, but for accessibility users as well... So, technically, or logically.. it very much is a trade-off about security, as much as you may wish to deny. I think if you weren't thinking in such absolute terms but more acquainted with the nuance of this technology you might see that as well. but hey i could be misreading you in my own strident and stupid way, so i'm sorry if that's the case and it's possible i haven't yet considered the nuance of your view and feelings on this.

howinteresting 5y ago

It is correct for the feelings of blind users to be prioritized over those of the developers. Blind and other disabled people have to deal with ableism in society every single day.

graderjs 5y ago
No that's not right, nor even correct. You can't just disregard their feelings, and put someone else above them no matter the issue. There's no justification for this. Disabled people have a valuable contribution to make and their voice should be heard. They should have access. But this good cause is often misused by people using it as a fake pretext for abusing others under the delusion they are absolutely right, and persecuting anyone who disagrees as absolutely wrong. This it is correct to prioritize feelings over bullshit is part of this. It's ape brain shit of trying to dominate others with criticism and control, and pretend they're holy warriors. That attitude is a contributor to why I'm so scared to engage with people about this topic. It's also sad for disabled people because these abusive crusaders give the cause a bad name, and generate counter productive resistance all for the sake of their own compensatory ego gyrations. But separating out how the topic is misused by some looking to criticize or control others...there is a real issue here and and it's an important and good cause. But the solutions posited, often by the same folks, are not I think the best technical solutions, they're not scalable or efficient. Asking every website to provide hints might be OK at a small scale, but at internet scale it doesn't work. I think the right solution is to direct AI at the problem and have these accessibility directives generated automatically. Intelligent accessibility is a feature that should be present in browsers (or screen readers) by way of AI. People who care about the topic and want change should get to work on that.
- mwcampbell 5y ago
  Original author here. I am taking your comments to heart. I'm not yet prepared to concede that we should give up on accessibility standards for platform and application developers and expect AI to solve the whole thing; I need to discuss this with others in the blind community. I appreciate that expecting every application and website to implement accessibility standards doesn't scale, but it's the best we have so far. You said the tone of my article was strident and demanding. Please note that it was addressed to the leader of a growing public company, calling on the company to live up to their own PR about their mission. I wouldn't take that tone with a solo developer like you. Even so, I don't believe I was abusive or persecuting. Still, it's likely that writing and promoting this article did make some part of my ape brain feel good about fighting for a righteous cause. So thanks for making me stop and think.