3 ms·

>I've heard people quip that browsers should be less forgiving and enforce perfection. That allowing jank makes the web somehow 'bad'. Considering all the mise

by mrob 2y ago

>I've heard people quip that browsers should be less forgiving and enforce perfection. That allowing jank makes the web somehow 'bad'. Considering all the misery inflicted by computer crime that's enabled by the forgiving attitude, I 100% agree. And given the choice between "you can still visit the Space Jam website[0]" or "never worry about drive-by ransomware again", I'm pretty sure I'd be with the majority in choosing the latter. Security is a heavy price to pay for whimsy. Old-technology hobbyists could still run old web browsers in sandboxed VMs. [0] https://www.spacejam.com/1996/ https://www.spacejam.com/1996/

gizmo 2y ago
It's a false choice in any case. Web browsers can support backward compatibility and at the same time offer a strict mode that benefits correctness and performance. Some real opportunities were missed to clean up JS semantics when Modules got introduced, for instance.
- winternewt 2y ago
  And they did with XHTML, but unfortunately it didn't catch on.
josefx 2y ago
> Considering all the misery inflicted by computer crime that's enabled by the forgiving attitude, I 100% agree. Parsers should strictly adhere to a standard, if the standard says they should be "forgiving" and that "forgiving" is well defined then all parsers should act this way. Inconsistent behavior between implementations opens its own can of worms that may leave a system in an inconsistent or insecure state.
yread 2y ago
I think the choice is more "writing a browser is a weekend project" vs "writing a browser is years of toil and you'll need a local copy of the internet to test it comprehensively"
Thorrez 2y ago
I don't see how making browsers less forgiving would reduce drive-by ransomware. I don't think most browser vulnerabilities are related to the web being forgiving.
- mrob 2y ago
  Have you seen how big the HTML spec is? https://html.spec.whatwg.org/ https://html.spec.whatwg.org/ A huge part of this complexity exists because of the forgiving attitude. With a strict attitude the spec could be much simpler, and that means web browsers could be much smaller. The most secure code is no code.
- alexvitkov 2y ago
  Vulnerabilities are related to the web being complex, and just this one quirk involves a parsing algorithm with 6 transformations of a user-provided value.

by mrob 2y ago

gizmo 2y ago

It's a false choice in any case. Web browsers can support backward compatibility and at the same time offer a strict mode that benefits correctness and performance. Some real opportunities were missed to clean up JS semantics when Modules got introduced, for instance.

winternewt 2y ago
And they did with XHTML, but unfortunately it didn't catch on.

josefx 2y ago

> Considering all the misery inflicted by computer crime that's enabled by the forgiving attitude, I 100% agree. Parsers should strictly adhere to a standard, if the standard says they should be "forgiving" and that "forgiving" is well defined then all parsers should act this way. Inconsistent behavior between implementations opens its own can of worms that may leave a system in an inconsistent or insecure state.

yread 2y ago

I think the choice is more "writing a browser is a weekend project" vs "writing a browser is years of toil and you'll need a local copy of the internet to test it comprehensively"

Thorrez 2y ago

I don't see how making browsers less forgiving would reduce drive-by ransomware. I don't think most browser vulnerabilities are related to the web being forgiving.

mrob 2y ago
Have you seen how big the HTML spec is? https://html.spec.whatwg.org/ https://html.spec.whatwg.org/ A huge part of this complexity exists because of the forgiving attitude. With a strict attitude the spec could be much simpler, and that means web browsers could be much smaller. The most secure code is no code.
alexvitkov 2y ago
Vulnerabilities are related to the web being complex, and just this one quirk involves a parsing algorithm with 6 transformations of a user-provided value.