4 ms·
> This works because document.querySelector tolerates malformed selectors Of course it does. Is there a single web API that doesn't intentionally enable exploi
by josefx 5y ago
> This works because document.querySelector tolerates malformed selectors
Of course it does. Is there a single web API that doesn't intentionally enable exploit smuggling by allowing malformed input?
- mads_ravn 5y agoI personally blame the robustness principle[1], which I think explains a lot of the accidental complexity in web programming. [1] https://en.m.wikipedia.org/wiki/Robustness_principle https://en.m.wikipedia.org/wiki/Robustness_principle
- derf_ 5y agohttps://datatracker.ietf.org/doc/html/draft-iab-protocol-maintenance https://datatracker.ietf.org/doc/html/draft-iab-protocol-mai...
- Spivak 5y agoOver the years I've switched my philosophy to "be paranoid about what you accept, normalize inputs, randomize outputs, and fail loud and on purpose." Make it so that if the caller/client works at all then it must work correctly. Force them to handle errors and retry on things that might fail, values that might change, and if the result is something that must be parsed send it back in varying formats so they have to parse it.
- BiteCode_dev 5y agoI understand the benefit of randomize output, but that's very costly.
- Anthony-G 5y agoAgreed. That’s why I liked XHTML when it came out – it’s hard to believe that’s more than two decades ago! While HTML5 had lots of goodies, I liked the rigour that XHTML imposed on web authors.
- badsectoracula 5y agoIn theory XHTML was nice as it allowed easier parsing of pages, but in practice it was doomed to fail from the moment a single bracket off made entire sites to stop working. That W3C put their hands in their ears going all lalalalala while ignoring how the world actually used HTML is what led to their irrelevance in defining HTML and essentially giving control to Google, et al. IMO the "robustness principle" is a good thing because it realizes that people make mistakes and their goal isn't to make something correct but something that produces the results they want to see. Even if browsers started with XHTML-like strictness with no alternative, that strictness would quickly have eroded during the first browser wars.
- aaaaaaaaaaab 5y agoDelete a semicolon from a C/C++/Java/C# program, and it won’t compile. Delete a byte from a zip file, and it won’t unzip. I don’t see why HTML should be different…
- FridgeSeal 5y agoYeah I don’t see how that is supposed to be a benefit? Why _shouldn’t_ people have to make actually-valid-html? We don’t tolerate “only sort of correct JSON” tightening the acceptable requirements for valid HTML and CSS would likely make using those formats in more places _easier_.
- deleted 5y ago[deleted]
- badsectoracula 5y agoCompiling is something that happens locally and is static - it either compiles now or it doesn't and once you have the final executable you can distribute to your users the syntactical errors or whatever of your source code doesn't matter after that. HTML is different because it is parsed by the browser the end user is using when it is using it. If a site completely broke like, f.e. how Mozilla treated bad XHTML sites (instead of showing the site itself you'd get some yellow page with the error) when you got a tiny syntax error then anything with user generated content (forums, blogs, etc) or even just generated could be a potential minefield. Especially as websites started adding code from external sources (be it for ads or for things like youtube embeds or whatever).
- rplnt 5y agoThat's basically mantra of one of the most popular technologies of the past - php. And javascript to a degree. > Do anything, even the wrong thing, just work.
- secondcoming 5y agoOn Error Resume Next
- Sohcahtoa82 5y agoIt's so bad that this ever existed. It's even worse than PHP and JS were built around it. Errors should never pass silently unless explicitly silenced.
- josefx 5y ago> unless explicitly silenced. Which is what "On Error Resume Next" was doing by overwriting the current error handler. Seems to me that it was simply overused. Implicitly ignoring errors is more a C thing.
- Sohcahtoa82 5y agoI suppose you're technically right. It's just the worst way to do it.
- technobabbler 5y agoWhy? Very little on the web is critical. If it mostly renders, it's mostly good enough. shrug It's not like the big vendors with fancy programmers and difficult types release without bugs and security issues. But so what? Life goes on.
- Akronymus 5y agoIMO, if someone is trying to use an API in a malformed way, they just should get a message back saying it is malformed. Possibly with potential causes. I prefer endpoints to shout at me, rather than accepting it and trying their best.
- brundolf 5y agoThat’s a pretty big leap to malice you just made there.
- kingcharles 5y agoDon't think poster meant the APIs were designed to maliciously allow exploits. He meant they were intentionally developed to allow rotten code to work (because, sadly, rotten code is everywhere), and a by-product of that lax attitude unintentionally allows exploits.
- brundolf 5y ago“intentionally enable exploit smuggling” seemed pretty clear to me, but happy to be wrong
- josefx 5y agoIt may not be malice, but it is a design decision often made for robustness or future proofing that seems to backfire every time it ends up in a security critical context.