7 ms·

They've even eschewed the standard way to opt-in iframes to powerful, dangerous features like `alert` and `confirm` - you can't even `sandbox` the iframe to all

They've even eschewed the standard way to opt-in iframes to powerful, dangerous features like `alert` and `confirm` - you can't even `sandbox` the iframe to allow it. You have to enroll your website in a Chrome Origin Trial[0], which only lasts until December, and also requires you to create a Google account, agree to Google ToS, and you might be blessed with the ability for your perfectly-fine-before-Chromium-team-came-along web app to keep working. Who the hell is in charge over there, and what compels them to incessantly break the web? [0]: https://developer.chrome.com/origintrials/#/register_trial/2541156089743802369 https://developer.chrome.com/origintrials/#/register_trial/2...

userbinator 5y ago
Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.
- bawolff 5y ago
  Idk why everyone jumps to these paranoid conspiracy theories - alert() box to trick people has been a thing for decades, and its super rare for it to be used legitly outside of debugging.
  - akersten 5y ago
    How often is it that you have a malicious iframe on your website being used to trick people though? Why only remove it from iframe and not the entire browser if that is the concern? Why was this concern not alleviated with better UI for the standard alert dialogs? Alert dialogs and prompts are huge for accessibility - they're genuinely one of the best ways to get a screenreader's attention and have the user interact immediately with something. They are great for the web. They provide a standard interface and I think we should use them more often. To me, this is Chromium team doing one of two things: (1) Trying to fix a security concern and instead of improving the UI so it's clear where the dialog is coming from, being lazy and just turning the feature off, or (2) Boiling the frog: remove dialogs from iframe, wait a while, then remove them from top-most with the rationale that "hey, they're already not supported in iframes" because they think dialogs are so Web 1.0 I don't like it either way. Just let me opt-in via `sandbox` like I do for other iframe features. Honestly, even that's rude to make website developers have to do, but at least we're not left high and dry. I'll be irrationally angry if this all boils down to some UXD thinking that alert dialogs are "ugly" or something.
    - dheera 5y ago
      > How often is it that you have a malicious iframe on your website being used to trick people though? This is one of the most common phishing vectors.
    - throwaway2048 5y ago
      plenty of ads are malicious, and if you want to use an adbroker its super hard to control or address
    - deleted 5y ago
      [deleted]
    - ehsankia 5y ago
      > How often is it that you have a malicious iframe on your website being used to trick people though? Definitely more often than whatever hacky edge case websites relies on this behavior.
      - svieira 5y ago
        Such as a gaming website that hosts arbitrary JS games written to fit within a particular size limit? Code sample web IDEs that are designed to teach people how to code quickly? An iframed rich text editor? An embedded reporting widget that wants to remind users to save their changes before they navigate away on the parent page? An enterprise application that's using the strangler pattern to wall off greyfield parts of their application and those parts were written in 2004? These are not common-use-cases-for-average-websites-on-the-net, but for web _apps_ where third-party `iframe` is the quickest way to real isolation between divergent code, iframes are pretty common. And `alert`, `confirm`, and `prompt` are not common in such code either, but when they are used they're often used in code paths that expect blocking behavior and are therefore definitely not amenable to alterations. And the fact of the matter is that as the developer of a web application _I can still get this blocking behavior_. "All you need to do is have the parent and the child cooperate by sharing a TypedArray between the origins and use `Atomics.wait`" [1]. If by having the parent and the child cooperate I can get the blocking behavior, why not allow me to do it simply with a `sandbox` attribute, rather than having me publish a `@backcompat/alert` NPM module that both sides can pull in to polyfill a functioning `window.alert`? [1]: https://twitter.com/KekitoF/status/1420220292429926400 https://twitter.com/KekitoF/status/1420220292429926400
  - javajosh 5y ago
    > its super rare for it to be used legitly outside of debugging Simply false. This change broke several of my companies apps, and it broke Salesforce, and God knows what else. And it's not just a layout problem; it's material behavior which changed.
    - cratermoon 5y ago
      > it broke Salesforce take 1: Salesforce is already a broken heap of fertilizer take 2: Hmm, didn't Google try and fail to acquire Salesforce?
  - irrational 5y ago
    Who uses alert for debugging anymore?
  - TeMPOraL 5y ago
    It's not paranoid conspiracy theory, it's good ol' "fire and motion" - https://www.joelonsoftware.com/2002/01/06/fire-and-motion/ https://www.joelonsoftware.com/2002/01/06/fire-and-motion/. Google is absolutely doing this with the web. Everyone else is too busy either trying to catch up with Chrome or react to unending stream of Google's proposed changes to web standards - which keeps them pinned down, and gives Google the freedom of movement, allowing them to direct the evolution of the web as a platform.
  - gatlin 5y ago
    And I don't know why you have to smear beliefs that differ from yours and the people holding them as "paranoid conspiracy." You can present your case without name calling (if you have one).
  - cratermoon 5y ago
    That's the not the real complaint. The real issue is this: Opting out requires signing up with Google and become a customer of theirs: https://developer.chrome.com/origintrials/#/register_trial/2541156089743802369 https://developer.chrome.com/origintrials/#/register_trial/2...
- HWR_14 5y ago
  In fairness, the constant change is because other organizations have the brute force to keep up. If everyone else gave up on a browser they would stop changing things.
- voidnullnil 5y ago
  The entire web does this, not just Google. Alert is pure garbage and should not have made it past the 90s. Also, basic auth popups need to go too. Not sure why browsers would ever make those focus stealing in the first place. There should not be one single way for a web application to steal focus. The current workaround is to download a buggy ad blocker (last time I used chrome, just like firefox it has no way to turn popups off). Edit: I just remembered alert no longer steals focus on modern browsers (IIRC). But basic auth still does (at least on my 50 year old fork of firefox).
  - jfoster 5y ago
    I would like to point out that stealing focus is part of the browser implementation. I don't think anyone would object to less stuff (if anything) stealing focus. If the problem is "this functionality steals focus", how about making it not steal focus rather than removing it entirely on short notice? Why don't the Chrome developers focus on fixing their browser?
  - dylan604 5y ago
    >(at least on my 50 year old fork of firefox). Since you're obviously from the future, can you give me tips on some stocks or sporting events to "invest"?
    - habibur 5y ago
      That's a way of saying "decades old". Not to count years literally.
      - dylan604 5y ago
        yes, and it's also understood that people are not really from the future with the information that I requested. Did you really think that was what I believed so that you needed to pedantically explain it to me?
        habibur 5y ago
deleted 5y ago
[deleted]
skywhopper 5y ago
Given their current market share, they have no incentive to behave otherwise. They will do what they wish. And since it’s Google paying the bills, if it doesn’t harm Google’s business then it’s not a problem for them.
judge2020 5y ago
> perfectly-fine-before-Chromium-team-came-along web app Sorry, I think you misspelt "years of tech debt on the brink of collapse, only held together with prayers and the liberty provided by cross-origin iframes to do whatever they want to the parent window".
- ajsnigrutin 5y ago
  But it works. And after, it wont.
- akersten 5y ago
  I'd encourage you to read some of the testimonials in the bug tracker - the applications this is breaking are not tech-debt-laden monstrosities, they're very simple examples like repl.it and educational coding websites where the IDE is hosted in an iframe and you can run your code in-browser. I can think of many more derelict features I'd have removed first if this was really about cleaning up code smells. And regardless of whether you think `window.alert` is a giant pile of tech debt: "we don't break userspace" is a mantra that web browser teams would benefit to heed.
  - geofft 5y ago
    It is a mantra that web browser teams heed. That's why the HTML living standard is the absolute mess it is. "We don't break userspace" is not an absolute rule, and has plenty of exceptions in practice, including security and things where no legitimate use case has been identified.
    - deleted 5y ago
      [deleted]
    - hitekker 5y ago
      Linus Torvald coined the phrase "We don't break userspace" and he has been less than nice to people who seek to undermine compatibility in the name of security: http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01701.html http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01701.html
modshatereality 5y ago
>Who the hell is in charge over there, and what compels them to incessantly break the web? What do you mean, the linked article is just a blank white page...
deleted 5y ago
[deleted]
madeofpalk 5y ago
> Who the hell is in charge over there, and what compels them to incessantly break the web? Well, to be fair, they went to the standards body and proposed it, and both Firefox and Webkit were in favour of the spec change.
- userbinator 5y ago
  and both Firefox and Webkit were in favour of the spec change. They could oppose, but then Google would just spread propaganda about how their browsers are "less secure" or whatever. There's really no choice for other browsers at this point. From the point of view of neutrality, the whole "origin trial" thing is seriously messed up. You are effectively having to ask for permission from one megacorp to treat your site differently from others in its browser.
  - floatingatoll 5y ago
    To try and restate this, in case I misunderstand: You believe that Apple and Mozilla are rubber-stamping anything Google asks for because they’re afraid of a Google marketing campaign. Have I accurately represented your beliefs?
    - userbinator 5y ago
      The situation is not so clear with Apple (but there is some evidence that it puts up at least some opposition: see hit-pieces like https://news.ycombinator.com/item?id=27968394 https://news.ycombinator.com/item?id=27968394 and note all the pro-Chrome/Google opinions there...) but Mozilla is funded by Google. ...and regardless of whether you're using Chrome, the immense power of Google's marketing abilities cannot be overstated. It is an ad company, after all. (If you're using Chrome, it's self-explanatory; if you're not, you should notice just how much you get "recommended" to.)
      - floatingatoll 5y ago
        Definitely report what you perceive as astroturfing to the mods using the footer Contact link; they will want to know more.

userbinator 5y ago

Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.

bawolff 5y ago
Idk why everyone jumps to these paranoid conspiracy theories - alert() box to trick people has been a thing for decades, and its super rare for it to be used legitly outside of debugging.
- akersten 5y ago
  How often is it that you have a malicious iframe on your website being used to trick people though? Why only remove it from iframe and not the entire browser if that is the concern? Why was this concern not alleviated with better UI for the standard alert dialogs? Alert dialogs and prompts are huge for accessibility - they're genuinely one of the best ways to get a screenreader's attention and have the user interact immediately with something. They are great for the web. They provide a standard interface and I think we should use them more often. To me, this is Chromium team doing one of two things: (1) Trying to fix a security concern and instead of improving the UI so it's clear where the dialog is coming from, being lazy and just turning the feature off, or (2) Boiling the frog: remove dialogs from iframe, wait a while, then remove them from top-most with the rationale that "hey, they're already not supported in iframes" because they think dialogs are so Web 1.0 I don't like it either way. Just let me opt-in via `sandbox` like I do for other iframe features. Honestly, even that's rude to make website developers have to do, but at least we're not left high and dry. I'll be irrationally angry if this all boils down to some UXD thinking that alert dialogs are "ugly" or something.
  - dheera 5y ago
    > How often is it that you have a malicious iframe on your website being used to trick people though? This is one of the most common phishing vectors.
  - throwaway2048 5y ago
    plenty of ads are malicious, and if you want to use an adbroker its super hard to control or address
  - deleted 5y ago
    [deleted]
  - ehsankia 5y ago
    > How often is it that you have a malicious iframe on your website being used to trick people though? Definitely more often than whatever hacky edge case websites relies on this behavior.
    - svieira 5y ago
      Such as a gaming website that hosts arbitrary JS games written to fit within a particular size limit? Code sample web IDEs that are designed to teach people how to code quickly? An iframed rich text editor? An embedded reporting widget that wants to remind users to save their changes before they navigate away on the parent page? An enterprise application that's using the strangler pattern to wall off greyfield parts of their application and those parts were written in 2004? These are not common-use-cases-for-average-websites-on-the-net, but for web _apps_ where third-party `iframe` is the quickest way to real isolation between divergent code, iframes are pretty common. And `alert`, `confirm`, and `prompt` are not common in such code either, but when they are used they're often used in code paths that expect blocking behavior and are therefore definitely not amenable to alterations. And the fact of the matter is that as the developer of a web application _I can still get this blocking behavior_. "All you need to do is have the parent and the child cooperate by sharing a TypedArray between the origins and use `Atomics.wait`" [1]. If by having the parent and the child cooperate I can get the blocking behavior, why not allow me to do it simply with a `sandbox` attribute, rather than having me publish a `@backcompat/alert` NPM module that both sides can pull in to polyfill a functioning `window.alert`? [1]: https://twitter.com/KekitoF/status/1420220292429926400 https://twitter.com/KekitoF/status/1420220292429926400
- javajosh 5y ago
  > its super rare for it to be used legitly outside of debugging Simply false. This change broke several of my companies apps, and it broke Salesforce, and God knows what else. And it's not just a layout problem; it's material behavior which changed.
  - cratermoon 5y ago
    > it broke Salesforce take 1: Salesforce is already a broken heap of fertilizer take 2: Hmm, didn't Google try and fail to acquire Salesforce?
- irrational 5y ago
  Who uses alert for debugging anymore?
- TeMPOraL 5y ago
  It's not paranoid conspiracy theory, it's good ol' "fire and motion" - https://www.joelonsoftware.com/2002/01/06/fire-and-motion/ https://www.joelonsoftware.com/2002/01/06/fire-and-motion/. Google is absolutely doing this with the web. Everyone else is too busy either trying to catch up with Chrome or react to unending stream of Google's proposed changes to web standards - which keeps them pinned down, and gives Google the freedom of movement, allowing them to direct the evolution of the web as a platform.
- gatlin 5y ago
  And I don't know why you have to smear beliefs that differ from yours and the people holding them as "paranoid conspiracy." You can present your case without name calling (if you have one).
- cratermoon 5y ago
  That's the not the real complaint. The real issue is this: Opting out requires signing up with Google and become a customer of theirs: https://developer.chrome.com/origintrials/#/register_trial/2541156089743802369 https://developer.chrome.com/origintrials/#/register_trial/2...
HWR_14 5y ago
In fairness, the constant change is because other organizations have the brute force to keep up. If everyone else gave up on a browser they would stop changing things.
voidnullnil 5y ago
The entire web does this, not just Google. Alert is pure garbage and should not have made it past the 90s. Also, basic auth popups need to go too. Not sure why browsers would ever make those focus stealing in the first place. There should not be one single way for a web application to steal focus. The current workaround is to download a buggy ad blocker (last time I used chrome, just like firefox it has no way to turn popups off). Edit: I just remembered alert no longer steals focus on modern browsers (IIRC). But basic auth still does (at least on my 50 year old fork of firefox).
- jfoster 5y ago
  I would like to point out that stealing focus is part of the browser implementation. I don't think anyone would object to less stuff (if anything) stealing focus. If the problem is "this functionality steals focus", how about making it not steal focus rather than removing it entirely on short notice? Why don't the Chrome developers focus on fixing their browser?
- dylan604 5y ago
  >(at least on my 50 year old fork of firefox). Since you're obviously from the future, can you give me tips on some stocks or sporting events to "invest"?
  - habibur 5y ago
    That's a way of saying "decades old". Not to count years literally.
    - dylan604 5y ago
      yes, and it's also understood that people are not really from the future with the information that I requested. Did you really think that was what I believed so that you needed to pedantically explain it to me?
      - habibur 5y ago

deleted 5y ago

[deleted]

skywhopper 5y ago

Given their current market share, they have no incentive to behave otherwise. They will do what they wish. And since it’s Google paying the bills, if it doesn’t harm Google’s business then it’s not a problem for them.

judge2020 5y ago

> perfectly-fine-before-Chromium-team-came-along web app Sorry, I think you misspelt "years of tech debt on the brink of collapse, only held together with prayers and the liberty provided by cross-origin iframes to do whatever they want to the parent window".

ajsnigrutin 5y ago
But it works. And after, it wont.
akersten 5y ago
I'd encourage you to read some of the testimonials in the bug tracker - the applications this is breaking are not tech-debt-laden monstrosities, they're very simple examples like repl.it and educational coding websites where the IDE is hosted in an iframe and you can run your code in-browser. I can think of many more derelict features I'd have removed first if this was really about cleaning up code smells. And regardless of whether you think `window.alert` is a giant pile of tech debt: "we don't break userspace" is a mantra that web browser teams would benefit to heed.
- geofft 5y ago
  It is a mantra that web browser teams heed. That's why the HTML living standard is the absolute mess it is. "We don't break userspace" is not an absolute rule, and has plenty of exceptions in practice, including security and things where no legitimate use case has been identified.
  - deleted 5y ago
    [deleted]
  - hitekker 5y ago
    Linus Torvald coined the phrase "We don't break userspace" and he has been less than nice to people who seek to undermine compatibility in the name of security: http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01701.html http://lkml.iu.edu/hypermail/linux/kernel/1711.2/01701.html

modshatereality 5y ago

>Who the hell is in charge over there, and what compels them to incessantly break the web? What do you mean, the linked article is just a blank white page...

deleted 5y ago

[deleted]

madeofpalk 5y ago

> Who the hell is in charge over there, and what compels them to incessantly break the web? Well, to be fair, they went to the standards body and proposed it, and both Firefox and Webkit were in favour of the spec change.

userbinator 5y ago
and both Firefox and Webkit were in favour of the spec change. They could oppose, but then Google would just spread propaganda about how their browsers are "less secure" or whatever. There's really no choice for other browsers at this point. From the point of view of neutrality, the whole "origin trial" thing is seriously messed up. You are effectively having to ask for permission from one megacorp to treat your site differently from others in its browser.
- floatingatoll 5y ago
  To try and restate this, in case I misunderstand: You believe that Apple and Mozilla are rubber-stamping anything Google asks for because they’re afraid of a Google marketing campaign. Have I accurately represented your beliefs?
  - userbinator 5y ago
    The situation is not so clear with Apple (but there is some evidence that it puts up at least some opposition: see hit-pieces like https://news.ycombinator.com/item?id=27968394 https://news.ycombinator.com/item?id=27968394 and note all the pro-Chrome/Google opinions there...) but Mozilla is funded by Google. ...and regardless of whether you're using Chrome, the immense power of Google's marketing abilities cannot be overstated. It is an ad company, after all. (If you're using Chrome, it's self-explanatory; if you're not, you should notice just how much you get "recommended" to.)
    - floatingatoll 5y ago
      Definitely report what you perceive as astroturfing to the mods using the footer Contact link; they will want to know more.