6 ms·

I seriously thought that implementing some site specific custom rendering behaviour was meant as a joke. Why change html/css for a website when you can just imp

by tda 2y ago

I seriously thought that implementing some site specific custom rendering behaviour was meant as a joke. Why change html/css for a website when you can just implement some hardcoded site specific behaviour straight in the rendering engine? What could possibly go wrong? But after having a closer look at the PR, the 1900 LOC monstrosity Quirks.cpp actually seems to exist with lots of things like if (host == "tripadvisor.com"_s || host.endsWith(".tripadvisor.com"_s)) m_needsRelaxedCorsMixedContentCheckQuirk = true; Fixing CORS issues has never been easier

thepra 2y ago
That's messed up, why should I put up with CORS when others have a special treatment...
- its-summertime 2y ago
  Its used here: https://github.com/WebKit/WebKit/blob/dc1354a1d26db54d17f7d3989a81036a46ee2d60/Source/WebCore/loader/MixedContentChecker.cpp#L170C27-L170C55 https://github.com/WebKit/WebKit/blob/dc1354a1d26db54d17f7d3... Seems to be specifically for (not) upgrading images and videos from http to https, nothing else.
- jorlow 2y ago
  If a browser has too many compatibility issues, users will switch away. Outreach to the sites in question takes time and is often unsuccessful. Quirks is the pragmatic answer.
  - lye 2y ago
    WebKit is used by the second most popular browser after Chrome. Don't forget iOS users. https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share
    - tyho 2y ago
      That's an odd way of saying the third most popular browser.
      - Terretta 2y ago
        If you click link, look at chart, you'll see they mean second.
        stavros 2y ago
        That's always confusing. They should have said "the second most popular browser (after Chrome)", or something like that.
        DANmode 2y ago
        "blah blah blah, *second only to Chrome."
    - knallfrosch 2y ago
      My iOS/Safari is so bad, I have both Firefox and Chrome installed as a backup in case it doesn't work. They should start fixing Safari for real instead of adding Quirks.
      - hhh 2y ago
        what’s wrong with ios/safari? i don’t really ever have issues
        flessner 2y ago
        Safari on MacOS is really nice, fast and offers everything I need... but every 3 months or so I stumble on a website that refuses to work at all - rendering looks off, buttons don't work etc... Switching to Chrome usually fixes it - but I always question my sanity for about 10 minutes until I try it in Chrome.
  - lapcat 2y ago
    I don't know about quirks specifically, but often it takes many, many months before a WebKit commit actually ships to end users in Safari. Anyway, Apple engineers aren't known for their outreach.
easyThrowaway 2y ago
I wonder if any of those rules could be (mis)used to workaround or defeat iOs/macOs security features?
deleted 2y ago
[deleted]
orphea 2y ago
I guess a similar thing is happening with GPU drivers and games.
- CapsAdmin 2y ago
  yes, and drivers (used to at least) check the filename of the exe causing unexpected behaviour like performance degradation or even gains in some cases
  - jamesfinlayson 2y ago
    Still now I'd say - Counter-Strike 2's release was foreshadowed by nvidia or ATI having cs2.exe in some config files last year.
  - wruza 2y ago
    In cases like benchmarking software, I guess.
mort96 2y ago
I hate CORS. Garbage like this is a large reason why. CORS works differently in every browser and every website. I don't hate CORS when writing my own stuff, to be clear. Adding Access-Control-Allow-Origin: * to my own website's headers is easy enough. I hate when I'm using a website and something doesn't work and I look at the console and see CORS errors. Opening the same website in Chrome usually works. I hate CORS.
- upheaval7276 2y ago
  >CORS works differently in every browser and every website. Do you have some examples of this?
  - mort96 2y ago
    Not anything concrete, just memories of things not working, me looking at the JS console, seeing CORS errors, and seeing it work in Chrome, as I described. And the comment I replied to showed that it works differently between websites, namely: if (host == "tripadvisor.com"_s || host.endsWith(".tripadvisor.com"_s)) m_needsRelaxedCorsMixedContentCheckQuirk = true;
    - upheaval7276 2y ago
      That's a site-specific partial exemption from the same origin policy, as far as i can tell (without further context at the moment). Not a difference in how CORS works generally across Safari. CORS is frustrating for a lot of developers as it can be tough to gain a complete understanding of the spec, and an understanding of the same origin policy is required. But implementation of the CORS spec(s) isn't notably different across modern browsers, now that IE is out of the picture. CORS was a real nightmare in IE. Microsoft even introduced an XHR cousin named XDR in IE10 to handle cross-origin requests, and it wasn't even a complete implementation of CORS. This is a great resource to gain a more comprehensive understanding: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
      - 2y ago

by tda 2y ago

thepra 2y ago

That's messed up, why should I put up with CORS when others have a special treatment...

its-summertime 2y ago
Its used here: https://github.com/WebKit/WebKit/blob/dc1354a1d26db54d17f7d3989a81036a46ee2d60/Source/WebCore/loader/MixedContentChecker.cpp#L170C27-L170C55 https://github.com/WebKit/WebKit/blob/dc1354a1d26db54d17f7d3... Seems to be specifically for (not) upgrading images and videos from http to https, nothing else.
jorlow 2y ago
If a browser has too many compatibility issues, users will switch away. Outreach to the sites in question takes time and is often unsuccessful. Quirks is the pragmatic answer.
- lye 2y ago
  WebKit is used by the second most popular browser after Chrome. Don't forget iOS users. https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share
  - tyho 2y ago
    That's an odd way of saying the third most popular browser.
    - Terretta 2y ago
      If you click link, look at chart, you'll see they mean second.
      - stavros 2y ago
        That's always confusing. They should have said "the second most popular browser (after Chrome)", or something like that.
        DANmode 2y ago
        "blah blah blah, *second only to Chrome."
  - knallfrosch 2y ago
    My iOS/Safari is so bad, I have both Firefox and Chrome installed as a backup in case it doesn't work. They should start fixing Safari for real instead of adding Quirks.
    - hhh 2y ago
      what’s wrong with ios/safari? i don’t really ever have issues
      - flessner 2y ago
        Safari on MacOS is really nice, fast and offers everything I need... but every 3 months or so I stumble on a website that refuses to work at all - rendering looks off, buttons don't work etc... Switching to Chrome usually fixes it - but I always question my sanity for about 10 minutes until I try it in Chrome.
- lapcat 2y ago
  I don't know about quirks specifically, but often it takes many, many months before a WebKit commit actually ships to end users in Safari. Anyway, Apple engineers aren't known for their outreach.

easyThrowaway 2y ago

I wonder if any of those rules could be (mis)used to workaround or defeat iOs/macOs security features?

deleted 2y ago

[deleted]

orphea 2y ago

I guess a similar thing is happening with GPU drivers and games.

CapsAdmin 2y ago
yes, and drivers (used to at least) check the filename of the exe causing unexpected behaviour like performance degradation or even gains in some cases
- jamesfinlayson 2y ago
  Still now I'd say - Counter-Strike 2's release was foreshadowed by nvidia or ATI having cs2.exe in some config files last year.
- wruza 2y ago
  In cases like benchmarking software, I guess.

mort96 2y ago

I hate CORS. Garbage like this is a large reason why. CORS works differently in every browser and every website. I don't hate CORS when writing my own stuff, to be clear. Adding Access-Control-Allow-Origin: * to my own website's headers is easy enough. I hate when I'm using a website and something doesn't work and I look at the console and see CORS errors. Opening the same website in Chrome usually works. I hate CORS.

upheaval7276 2y ago
>CORS works differently in every browser and every website. Do you have some examples of this?
- mort96 2y ago
  Not anything concrete, just memories of things not working, me looking at the JS console, seeing CORS errors, and seeing it work in Chrome, as I described. And the comment I replied to showed that it works differently between websites, namely: if (host == "tripadvisor.com"_s || host.endsWith(".tripadvisor.com"_s)) m_needsRelaxedCorsMixedContentCheckQuirk = true;
  - upheaval7276 2y ago
    That's a site-specific partial exemption from the same origin policy, as far as i can tell (without further context at the moment). Not a difference in how CORS works generally across Safari. CORS is frustrating for a lot of developers as it can be tough to gain a complete understanding of the spec, and an understanding of the same origin policy is required. But implementation of the CORS spec(s) isn't notably different across modern browsers, now that IE is out of the picture. CORS was a real nightmare in IE. Microsoft even introduced an XHR cousin named XDR in IE10 to handle cross-origin requests, and it wasn't even a complete implementation of CORS. This is a great resource to gain a more comprehensive understanding: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
    - 2y ago