4 ms·

How is sending textual information for screen readers less secure? Isn't that just "speech instructions"?

graderjs 5y ago
I think in order to discuss this we'd need to be clear about the actual solutions we're discussing...I'm not right now I'm sorry, so I can say no more than, in general, any additional data you send opens up the attack surface. Tho I can say that, relevant to your idea, at least, in my RBI product[0], you can click somewhere in the viewport and say "Copy text" and then you get a HTML dialog open over the canvas viewport with the text. A screen-reader could potentially then read that. But I think actual accessibility tools need to do so much more...Forgive me, I'm no expert in them. Re the above tho, I don't see that as introducing a greater attack surface (tho I might be wrong) because on the server side we're just getting the innerText of the element the client clicked on, and sending that text back encoded in base64 (IIRC). [0]: https://github.com/i5ik/ViewFinder https://github.com/i5ik/ViewFinder
- sangnoir 5y ago
  > But I think actual accessibility tools need to do so much more Screen readers do more, but they are not rocket science. I am no expert either, but I've worked on adding accessibility to a project that had none. Screen readers have proactive & interactive modes. In proactive mode, they read whats visible on the page, perhaps just the high-level components, giving a lay of the land. In interactive mode, it gives more detail on the control/item that currently has focus and the actions available (follow link, expand/collapse section, etc), and one would tab to move focus between controls. I'm no expert on RBI, but I looked at your product and it appears to respond in real time to user interaction (hover over elements), perhaps what is missing is a standardized way to integrate Screen readers this "streaming" information; most accessible sites have plain-text ARIA tags/attributes meant for screen readers (with fall backs to 'title' or 'alt'[1]). However, this is just plain text, so sending text to the client adds an attack surface, but not a very large one, IMO. I believe every developer who makes user-facing software should be forced to sit down and use their app/site with the monitor off, interacting with just the screen reader in their headphones. www.a11yproject.com has really good information on how accessibility ('a11y') works, and how to implement it correctly on the web. 1. I'm simplifying by a lot here -screen readers do a lot of heavy lifting, especially for sites/software not designed with accessibility in mind
  - graderjs 5y ago
    I agree with much of your vibe and attitude here. But in general while SR may not be rocket science, solving the problem of accessibility in a general and scalable way is rocket science. It's a really important problem, and a good cause. Disabled people, for example blind people, have an awesome contribution to make to society and we need their voices to be heard, so to speak. In other words, we need their contributions to be made. They must have access. But the question is how to go about solving that? I think the posed solutions of getting every website to adopt a certain standard is not a good technical solution. I think pointing AI at the problem and working out how to parse accessibility hints, possibly in a personalized and contextual way relevant to the particular person as well, is one approach to the solution that's better. This part, I believe every developer who makes user-facing software should be forced to sit down and use their app/site with the monitor off, interacting with just the screen reader in their headphones No, just no. I appreciate the desire to do good, but I think your attitude here is in danger of falling into the trap in this topic of being abusive to others under the mere guise of a "righteous cause" -- and in the process hurting the very cause you pretend to stand for. The misuse of this issue by some bully-like people who want to abuse others by trying to dominate them with criticism and control is one reason I'm so scared to engage with this topic. They use the seriousness of the issue as a fake pretext to case the world in their own self-serving and ego-serving view of good vs bad, and go nuclear on anyone who disagrees with their stance. But this is just ape brain shit of bullying for compensation to make themselves feel better by pretending others are worse....Just avoid that. There is a serious issue here, and a good cause. And any statement that seeks to coerce or force or minimize the feelings of any group of people, who could just be working together on a solution, don't get suckered by the delusion that such things are somehow the right way, they're not. They're just people being bullies because their lives suck, and they take it out on others instead of fixing their own stuff. These abusive misusers of the issue give disabled people a bad name, and hinder the very cause they are pretending to stand for by, among other things, creating unnecessary friction to collaboration, and pushback. If you care about this topic, maybe you can do some AI work on it.
pjerem 5y ago
You could even add some markup to add formatting and boom ! You can display the page using a lot less bandwidth. Joke aside, you are 100% right.

I think in order to discuss this we'd need to be clear about the actual solutions we're discussing...I'm not right now I'm sorry, so I can say no more than, in general, any additional data you send opens up the attack surface. Tho I can say that, relevant to your idea, at least, in my RBI product[0], you can click somewhere in the viewport and say "Copy text" and then you get a HTML dialog open over the canvas viewport with the text. A screen-reader could potentially then read that. But I think actual accessibility tools need to do so much more...Forgive me, I'm no expert in them. Re the above tho, I don't see that as introducing a greater attack surface (tho I might be wrong) because on the server side we're just getting the innerText of the element the client clicked on, and sending that text back encoded in base64 (IIRC). [0]: https://github.com/i5ik/ViewFinder https://github.com/i5ik/ViewFinder

sangnoir 5y ago
> But I think actual accessibility tools need to do so much more Screen readers do more, but they are not rocket science. I am no expert either, but I've worked on adding accessibility to a project that had none. Screen readers have proactive & interactive modes. In proactive mode, they read whats visible on the page, perhaps just the high-level components, giving a lay of the land. In interactive mode, it gives more detail on the control/item that currently has focus and the actions available (follow link, expand/collapse section, etc), and one would tab to move focus between controls. I'm no expert on RBI, but I looked at your product and it appears to respond in real time to user interaction (hover over elements), perhaps what is missing is a standardized way to integrate Screen readers this "streaming" information; most accessible sites have plain-text ARIA tags/attributes meant for screen readers (with fall backs to 'title' or 'alt'[1]). However, this is just plain text, so sending text to the client adds an attack surface, but not a very large one, IMO. I believe every developer who makes user-facing software should be forced to sit down and use their app/site with the monitor off, interacting with just the screen reader in their headphones. www.a11yproject.com has really good information on how accessibility ('a11y') works, and how to implement it correctly on the web. 1. I'm simplifying by a lot here -screen readers do a lot of heavy lifting, especially for sites/software not designed with accessibility in mind
- graderjs 5y ago
  I agree with much of your vibe and attitude here. But in general while SR may not be rocket science, solving the problem of accessibility in a general and scalable way is rocket science. It's a really important problem, and a good cause. Disabled people, for example blind people, have an awesome contribution to make to society and we need their voices to be heard, so to speak. In other words, we need their contributions to be made. They must have access. But the question is how to go about solving that? I think the posed solutions of getting every website to adopt a certain standard is not a good technical solution. I think pointing AI at the problem and working out how to parse accessibility hints, possibly in a personalized and contextual way relevant to the particular person as well, is one approach to the solution that's better. This part, I believe every developer who makes user-facing software should be forced to sit down and use their app/site with the monitor off, interacting with just the screen reader in their headphones No, just no. I appreciate the desire to do good, but I think your attitude here is in danger of falling into the trap in this topic of being abusive to others under the mere guise of a "righteous cause" -- and in the process hurting the very cause you pretend to stand for. The misuse of this issue by some bully-like people who want to abuse others by trying to dominate them with criticism and control is one reason I'm so scared to engage with this topic. They use the seriousness of the issue as a fake pretext to case the world in their own self-serving and ego-serving view of good vs bad, and go nuclear on anyone who disagrees with their stance. But this is just ape brain shit of bullying for compensation to make themselves feel better by pretending others are worse....Just avoid that. There is a serious issue here, and a good cause. And any statement that seeks to coerce or force or minimize the feelings of any group of people, who could just be working together on a solution, don't get suckered by the delusion that such things are somehow the right way, they're not. They're just people being bullies because their lives suck, and they take it out on others instead of fixing their own stuff. These abusive misusers of the issue give disabled people a bad name, and hinder the very cause they are pretending to stand for by, among other things, creating unnecessary friction to collaboration, and pushback. If you care about this topic, maybe you can do some AI work on it.

pjerem 5y ago

You could even add some markup to add formatting and boom ! You can display the page using a lot less bandwidth. Joke aside, you are 100% right.