4 ms·

Browser makers should straight up remove the JS API for interacting with history. There are legitimate uses for it, but the malicious actors far outweigh the go

by bigstrat2003 2y ago

Browser makers should straight up remove the JS API for interacting with history. There are legitimate uses for it, but the malicious actors far outweigh the good ones at this point. Just remove it.

Dracophoenix 2y ago
Ditto for unprompted redirects.
- bonzini 2y ago
  Redirects are used for stuff like POST->GET or canonicalizing URLs (adding slashes on directories), would you get rid of that too?
  - Calavar 2y ago
    That's done with HTTP headers though, right? Not JavaScript.
    - bonzini 2y ago
      Ah, I see what you mean. The canonicalization is, whereas redirects after processing forms could be done in JavaScript from and on click or on submit handler.
spookie 2y ago
same for clipboard events.
panzi 2y ago
I mean, without `history.pushState()` and `window.onpopstate` things wouldn't be as nice. Ok, I guess one could do about everything with `location.hash = ...` and `window.onhashchange`, like in the before times. But the server will not get the hash part of the URL so a link to such an page can't be server side rendered and has to fetch the actual page content in JavaScript, evaluating the hash. When I browse things like image search it is really handy that you can use the browsers back button to close an opened image without loosing any dynamic state of the page and that the x button on the page will close the image and remove the history entry just the same way, so a later back won't re-open that image. For me the back button wasn't hijacked. But I am for disallowing the use of `history.go()` or any kind of navigation inside of `onpopstate`, `onhashchange`, `onbeforeunload` or similar or from a timer started from one of those.
- mort96 2y ago
  How about we just navigate to new pages by .. navigating to new pages? Browsers have perfectly functional history without javascript shenanigans
- bigstrat2003 2y ago
  Like I said: I recognize there are legitimate uses. But unfortunately, they are majorly outnumbered by people doing things like overwriting my history so that when I hit "back", it stays on the site instead of going back to my search engine. I would love to live in the world where malicious dark patterns didn't exist, and we could have nice things. But we don't, and so I would rather not have the functionality at all.
nightfly 2y ago
This type of thinking is what doomed uBlock Origin. I strongly disagree.
- jenadine 2y ago
  The difference is that uBlock Origin is an extension you intentionally trust and install, while the JS API we talk about are something any websites (untrusted) can use.
- PaulDavisThe1st 2y ago
  How is uBlock Origin "doomed" ?
  - nightfly 2y ago
    https://ublockorigin.com/#:~:text=Understanding%20Manifest%20V3%20and%20the%20Future%20of%20uBlock%20Origin https://ublockorigin.com/#:~:text=Understanding%20Manifest%2...
    - PaulDavisThe1st 2y ago
      So UBO isn't doomed, just UBO on Chrome. While that's significant given Chrome's market share, I and everyone else on the planet have the option to use something else, and will continue to do so.
      - orlylol 2y ago
        [flagged]
  - encom 2y ago
    An advertising company controls the user agent everyone uses to access the internet, and wants to shove more ads into your eyeballs. uBlock exists as long as they allow it. Anyone who disagrees with this, works for them or own shares in the company.
- goku12 2y ago
nullc 2y ago
Ditto for rewriting anchor destinations onclick, allowing sites to show one destination for hover but send you somewhere else.
jart 2y ago
That's a biased thing to say, since you're never going to notice the times when the history api is being used appropriately. Just as often I find myself raging when a webpage doesn't rewrite history at times when it should. Good taste is hard to come by.
TZubiri 2y ago
But wouldn't you be able to replicate the same issue by using a redirect?

Browser makers should straight up remove the JS API for interacting with history. There are legitimate uses for it, but the malicious actors far outweigh the good ones at this point. Just remove it.

Dracophoenix 2y ago

Ditto for unprompted redirects.

bonzini 2y ago
Redirects are used for stuff like POST->GET or canonicalizing URLs (adding slashes on directories), would you get rid of that too?
- Calavar 2y ago
  That's done with HTTP headers though, right? Not JavaScript.
  - bonzini 2y ago
    Ah, I see what you mean. The canonicalization is, whereas redirects after processing forms could be done in JavaScript from and on click or on submit handler.

spookie 2y ago

same for clipboard events.

panzi 2y ago

I mean, without `history.pushState()` and `window.onpopstate` things wouldn't be as nice. Ok, I guess one could do about everything with `location.hash = ...` and `window.onhashchange`, like in the before times. But the server will not get the hash part of the URL so a link to such an page can't be server side rendered and has to fetch the actual page content in JavaScript, evaluating the hash. When I browse things like image search it is really handy that you can use the browsers back button to close an opened image without loosing any dynamic state of the page and that the x button on the page will close the image and remove the history entry just the same way, so a later back won't re-open that image. For me the back button wasn't hijacked. But I am for disallowing the use of `history.go()` or any kind of navigation inside of `onpopstate`, `onhashchange`, `onbeforeunload` or similar or from a timer started from one of those.

mort96 2y ago
How about we just navigate to new pages by .. navigating to new pages? Browsers have perfectly functional history without javascript shenanigans
bigstrat2003 2y ago
Like I said: I recognize there are legitimate uses. But unfortunately, they are majorly outnumbered by people doing things like overwriting my history so that when I hit "back", it stays on the site instead of going back to my search engine. I would love to live in the world where malicious dark patterns didn't exist, and we could have nice things. But we don't, and so I would rather not have the functionality at all.

nightfly 2y ago

This type of thinking is what doomed uBlock Origin. I strongly disagree.

jenadine 2y ago
The difference is that uBlock Origin is an extension you intentionally trust and install, while the JS API we talk about are something any websites (untrusted) can use.
PaulDavisThe1st 2y ago
How is uBlock Origin "doomed" ?
- nightfly 2y ago
  https://ublockorigin.com/#:~:text=Understanding%20Manifest%20V3%20and%20the%20Future%20of%20uBlock%20Origin https://ublockorigin.com/#:~:text=Understanding%20Manifest%2...
  - PaulDavisThe1st 2y ago
    So UBO isn't doomed, just UBO on Chrome. While that's significant given Chrome's market share, I and everyone else on the planet have the option to use something else, and will continue to do so.
    - orlylol 2y ago
      [flagged]
- encom 2y ago
  An advertising company controls the user agent everyone uses to access the internet, and wants to shove more ads into your eyeballs. uBlock exists as long as they allow it. Anyone who disagrees with this, works for them or own shares in the company.
goku12 2y ago

nullc 2y ago

Ditto for rewriting anchor destinations onclick, allowing sites to show one destination for hover but send you somewhere else.

jart 2y ago

That's a biased thing to say, since you're never going to notice the times when the history api is being used appropriately. Just as often I find myself raging when a webpage doesn't rewrite history at times when it should. Good taste is hard to come by.

TZubiri 2y ago

But wouldn't you be able to replicate the same issue by using a redirect?