5 ms·

This is what you get, when google has monopoly on the web platform. They will drop support for standards, because they want to and they can. And we won’t have a

This is what you get, when google has monopoly on the web platform. They will drop support for standards, because they want to and they can. And we won’t have any say in their decisions. I mean, the gall they have to shove their burden onto us, the developers. Google is a trillion dollar company. If they think, that alerts are confusing, they have all the money in the world to make them not confusing. But, I guess, dropping support is what google usually does.

encryptluks2 5y ago
This isn't about support, it is a sane security decision. Imagine finding that a door to your large shared office space is missing and people were coming in and stealing things. So you install a new door and suddenly people start saying... How dare you put a door there that people were using to steal things. The gall you must have to shove this burden onto us.
- vasachi 5y ago
  Here’s the thing. It is not our problem that google doesn't want to make alerts less confusing. They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. How are they a security problem?
  - encryptluks2 5y ago
    This is about CSRF. Ever heard the phrase blinded by hate or blind hatred?
    - minitech 5y ago
      How are alert and CSRF related at all?
      - encryptluks2 5y ago
        Because this is specifically in regarding to calling them from an iframe.
  - jeffchien 5y ago
    > They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. Can you cite this? Or is this just wild speculation?
    - vasachi 5y ago
      The Register cites this: https://github.com/whatwg/html/issues/6897#issuecomment-885773622 https://github.com/whatwg/html/issues/6897#issuecomment-8857... Also this: https://twitter.com/Rich_Harris/status/1422930436850860033 https://twitter.com/Rich_Harris/status/1422930436850860033
      - jeffchien 5y ago
        Thank you!
    - deleted 5y ago
      [deleted]
  - asddubs 5y ago
    not to mention not letting people enable them again in their iframes like other security features (although i guess this is somewhat of a moot point since they plan to get rid of them completely)
  - lmm 5y ago
    They make it very easy for a page to present information to the user in a way that looks like it's coming from their system rather than something under the page's control?
    - SahAssar 5y ago
      That's very much a browser interface design problem, not a problem of the feature itself. Having clear, simple ways to do things like alert(), confirm() and prompt() is incredibly valuable for doing simpler/quicker stuff on the web.
      - hulitu 5y ago
        Simple staff like: alert (Do you want to install Pegassus ?); prompt (yes).
        SahAssar 5y ago
        Do you think that prompting the user on a webpage is what is stopping the webpage from installing a rootkit? Pegasus wasn't even a browser bug, it was installed via text message IIRC.
    - CJefferson 5y ago
      Then just make the box look more like part of the webpage. They could even put a nasty warning message in the box, as they completely control it.
    - acdha 5y ago
      Consider that both Chrome and Firefox have already changed the UI to do things like make the dialog title indicate that this is content from a web page or, in Firefox's case, add an option to prevent a page from spewing repeated alerts. Why should the answer be to break correctly-functioning applications around the web rather than just continuing that process of making these dialogs distinct from the platform controls? There's no standard requiring that they be implemented as a Windows MessageBox() call. Consider what it'd look like as a polyfill which just slams a <dialog> block with inline styles (position:absolute, etc.) into the page — there's no reason why Chrome couldn't implement something better than that and doing so would avoid breaking 3 decades of currently running code chasing after a very minimal security improvement. I say minimal because while it's possible for an attacker now to use confirm() to install a Windows update, removing that function does not mean they'll give up and stop trying. It means that they will add a fraction of a percent to their existing development time making some JavaScript which pops up a dialog styled to look like the platform defaults for the OS your browser advertises. We know that because attackers already spend considerable amounts of time trying to look like legitimate sites and this is not going to be a prohibitive amount of additional work unless there's a sharp decline in the amount of money at play with ransomware and espionage.
lucideer 5y ago
> drop support for standards alert was never a W3C standard. It was a non-standard browser feature that happened to be widely implemented in the early days of the web. It was never part of any planned/agreed addition of well-thought-out features to the web. The only time it has been "standardized" is when the WHATWG recently decided it would be a good idea to describe the behaviour of all the legacy non-standard browser APIs that have been lying around in browser implementations since the early days of Javascript's existence. The WHATWG have strictly described this behaviour for alert within the "User Prompts" section of the HTML specification: a new section to describe an ancient function.
- 0x0nyandesu 5y ago
  It being part of every browser makes it a defacto standard.
  - lucideer 5y ago
    If it were only a defacto standard I'd say they'd be even more justified in deprecation. It is now an actual standard though; I was just pointing out the history and reasoning behind its addition to the current standard. Given its WHATWG policy to define and codify the behaviour of every feature ever added broadly, if we believe no standard should ever be deprecated we'll never be able to deprecate anything at all and be stuck with every bad decision ever made.
  - UncleMeat 5y ago
    Are you equally mad about moves to eliminate cross-origin cookies? That was part of every browser.
- BulgarianIdiot 5y ago
  W3C doesn't matter much, WHATWG is the spec we follow, W3C just chases after them. So don't equate "standards" with "W3C standards".
  - SahAssar 5y ago
roenxi 5y ago
> This is what you get, when google has monopoly on the web platform. This isn't even an obviously bad idea. It is bad for web developers, but I don't think it is easy to argue that web developers are the most important demographic for Google to cater to. If this is the sort of terror that monopolies are meant to be inflicting then the concept is barely important enough to get a mention. I don't like Google, and I remember the IE6 days. When Chrome is even a little comparable to what MS used to manage then maybe people should start complaining. This is nothing.
- vasachi 5y ago
  What? Why should we tolerate bad behavior? Only because it’s less bad than Microsoft’s? That is not a very high bar, you know.
  - roenxi 5y ago
    We shouldn't tolerate bad behaviour. But you'll have to make an argument that it is bad behaviour. Google thinks this is a good idea, and Google knows a lot more about the Chrome userbase than you do.
    - vasachi 5y ago
      Google thought Google+ was a very good idea. Didn’t mean that it was a good idea. Removing features from web platform is, at least for me, a very bad move. If only because that it will spawn millions of half-baked replacement libraries with a whole lot of other security problems.
      - roenxi 5y ago
        Yeah, you disagree with Google. They might be wrong and you might be right. That isn't important though. You need to make an argument about why you are right and why they are wrong. If your argument is you just don't like it, then Google has a multi-billion person user-base made up of people who trust Google's opinions on how to make a web browser more than literally anyone else. Even if every HN reader doesn't like what Google is doing here, that still doesn't mean anything except that the tech community doesn't like it. The tech community sometimes doesn't like things that are, nevertheless, good decisions. And, on the point at hand, I don't see why getting rid of an alert box is a bad idea. They are kind of annoying. I don't think removing them is a reasonable example of monopolistic excess.

encryptluks2 5y ago

This isn't about support, it is a sane security decision. Imagine finding that a door to your large shared office space is missing and people were coming in and stealing things. So you install a new door and suddenly people start saying... How dare you put a door there that people were using to steal things. The gall you must have to shove this burden onto us.

vasachi 5y ago
Here’s the thing. It is not our problem that google doesn't want to make alerts less confusing. They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. How are they a security problem?
- encryptluks2 5y ago
  This is about CSRF. Ever heard the phrase blinded by hate or blind hatred?
  - minitech 5y ago
    How are alert and CSRF related at all?
    - encryptluks2 5y ago
      Because this is specifically in regarding to calling them from an iframe.
- jeffchien 5y ago
  > They are planning to drop support for alert, confirm and prompt. Not in iframes, but everywhere. Can you cite this? Or is this just wild speculation?
  - vasachi 5y ago
    The Register cites this: https://github.com/whatwg/html/issues/6897#issuecomment-885773622 https://github.com/whatwg/html/issues/6897#issuecomment-8857... Also this: https://twitter.com/Rich_Harris/status/1422930436850860033 https://twitter.com/Rich_Harris/status/1422930436850860033
    - jeffchien 5y ago
      Thank you!
  - deleted 5y ago
    [deleted]
- asddubs 5y ago
  not to mention not letting people enable them again in their iframes like other security features (although i guess this is somewhat of a moot point since they plan to get rid of them completely)
- lmm 5y ago
  They make it very easy for a page to present information to the user in a way that looks like it's coming from their system rather than something under the page's control?
  - SahAssar 5y ago
    That's very much a browser interface design problem, not a problem of the feature itself. Having clear, simple ways to do things like alert(), confirm() and prompt() is incredibly valuable for doing simpler/quicker stuff on the web.
    - hulitu 5y ago
      Simple staff like: alert (Do you want to install Pegassus ?); prompt (yes).
      - SahAssar 5y ago
        Do you think that prompting the user on a webpage is what is stopping the webpage from installing a rootkit? Pegasus wasn't even a browser bug, it was installed via text message IIRC.
  - CJefferson 5y ago
    Then just make the box look more like part of the webpage. They could even put a nasty warning message in the box, as they completely control it.
  - acdha 5y ago
    Consider that both Chrome and Firefox have already changed the UI to do things like make the dialog title indicate that this is content from a web page or, in Firefox's case, add an option to prevent a page from spewing repeated alerts. Why should the answer be to break correctly-functioning applications around the web rather than just continuing that process of making these dialogs distinct from the platform controls? There's no standard requiring that they be implemented as a Windows MessageBox() call. Consider what it'd look like as a polyfill which just slams a <dialog> block with inline styles (position:absolute, etc.) into the page — there's no reason why Chrome couldn't implement something better than that and doing so would avoid breaking 3 decades of currently running code chasing after a very minimal security improvement. I say minimal because while it's possible for an attacker now to use confirm() to install a Windows update, removing that function does not mean they'll give up and stop trying. It means that they will add a fraction of a percent to their existing development time making some JavaScript which pops up a dialog styled to look like the platform defaults for the OS your browser advertises. We know that because attackers already spend considerable amounts of time trying to look like legitimate sites and this is not going to be a prohibitive amount of additional work unless there's a sharp decline in the amount of money at play with ransomware and espionage.

lucideer 5y ago

> drop support for standards alert was never a W3C standard. It was a non-standard browser feature that happened to be widely implemented in the early days of the web. It was never part of any planned/agreed addition of well-thought-out features to the web. The only time it has been "standardized" is when the WHATWG recently decided it would be a good idea to describe the behaviour of all the legacy non-standard browser APIs that have been lying around in browser implementations since the early days of Javascript's existence. The WHATWG have strictly described this behaviour for alert within the "User Prompts" section of the HTML specification: a new section to describe an ancient function.

0x0nyandesu 5y ago
It being part of every browser makes it a defacto standard.
- lucideer 5y ago
  If it were only a defacto standard I'd say they'd be even more justified in deprecation. It is now an actual standard though; I was just pointing out the history and reasoning behind its addition to the current standard. Given its WHATWG policy to define and codify the behaviour of every feature ever added broadly, if we believe no standard should ever be deprecated we'll never be able to deprecate anything at all and be stuck with every bad decision ever made.
- UncleMeat 5y ago
  Are you equally mad about moves to eliminate cross-origin cookies? That was part of every browser.
BulgarianIdiot 5y ago
W3C doesn't matter much, WHATWG is the spec we follow, W3C just chases after them. So don't equate "standards" with "W3C standards".
- SahAssar 5y ago

roenxi 5y ago

> This is what you get, when google has monopoly on the web platform. This isn't even an obviously bad idea. It is bad for web developers, but I don't think it is easy to argue that web developers are the most important demographic for Google to cater to. If this is the sort of terror that monopolies are meant to be inflicting then the concept is barely important enough to get a mention. I don't like Google, and I remember the IE6 days. When Chrome is even a little comparable to what MS used to manage then maybe people should start complaining. This is nothing.

vasachi 5y ago
What? Why should we tolerate bad behavior? Only because it’s less bad than Microsoft’s? That is not a very high bar, you know.
- roenxi 5y ago
  We shouldn't tolerate bad behaviour. But you'll have to make an argument that it is bad behaviour. Google thinks this is a good idea, and Google knows a lot more about the Chrome userbase than you do.
  - vasachi 5y ago
    Google thought Google+ was a very good idea. Didn’t mean that it was a good idea. Removing features from web platform is, at least for me, a very bad move. If only because that it will spawn millions of half-baked replacement libraries with a whole lot of other security problems.
    - roenxi 5y ago
      Yeah, you disagree with Google. They might be wrong and you might be right. That isn't important though. You need to make an argument about why you are right and why they are wrong. If your argument is you just don't like it, then Google has a multi-billion person user-base made up of people who trust Google's opinions on how to make a web browser more than literally anyone else. Even if every HN reader doesn't like what Google is doing here, that still doesn't mean anything except that the tech community doesn't like it. The tech community sometimes doesn't like things that are, nevertheless, good decisions. And, on the point at hand, I don't see why getting rid of an alert box is a bad idea. They are kind of annoying. I don't think removing them is a reasonable example of monopolistic excess.