9 ms·

Google is killing the open web

193 points by thm 1y ago

Devasta 1y ago
Getting rid of XSLT from the browser would be a mistake, no doubt about it. You can see it clear as day in the github thread that they weren't asking permission, they were doing it no matter what, all their concerns about security just being the pretext. It would have been more honest of them to just tell everyone to go fuck themselves.
- simonw 1y ago
 What do you think their real reason for wanting to remove XSLT is, if not what they claim?
 - jacquesm 1y ago
 To increase the depth of their moat. XSLT would allow anybody with a minimum of effort to extract semantic information from the web.
 - jon-wood 1y ago
 I feel like this is overly conspiratorial. Likely they want to remove it because it's a pain to support, and used by an ever shrinking proportion of the internet. I don't even necessarily think removing support is a terrible thing, if you want to turn XML into HTML or whatever with XSLT you're still very welcome to do so, you just might have to do it server side rather than expecting every web browser to it for you.
 - mschuster91 1y ago
 > a minimum of effort That is not a combination of words that should be mentioned in the same sentence as the word XML or, even worse, XSLT. XML has its value in enterprise and reliable application development because the tooling is very old, very mature and very reliable. But it's not something taught in university any more, it's certainly not taught in "coding bootcamps", simply because it's orders of magnitude more complex than JSON to wrap your head around. Of course, JSON has jsonschema, but in practice most real-world usages of JSON just don't give a flying fuck.
 - JimDabell 1y ago
 > XSLT would allow anybody with a minimum of effort to extract semantic information from the web. XSLT has been around for decades so why are you speaking in hypotheticals, as if it’s an up-and-coming technology that hasn’t been given a fair chance yet? If it hasn’t achieved that by now, it never will.
 - jeroenhd 1y ago
 XSLT is a terrible tool for that job. RDF combined with something like SPARQL is much closer to that, and makes for one of the greatest knowledge processing tools nobody ever uses. XSLT is designed to work on XML while HTML documents are almost always SGML-based. The semantics don't work the same and applying XML engines on HTML often breaks things in weird and unexpected ways. basic HTML parsing rules like "a <head> tag doesn't need to be closed and can simply be auto-closed by a <body>" will seriously confuse XML engines. To effectively use XSLT to extract information from the web, you'd first need to turn HTML into XML.
 - oefrha 1y ago
 Hey, it works great on the dozens of XHTML websites lying around. Dozens!
 - aragilar 1y ago
 I think it's the other way round, it's XML -> HTML not HTML -> XML.
 - int_19h 1y ago
 XSLT is designed to work on the XML Infoset, which is basically just an abstract tree of elements with attributes. Which is why XSLT has e.g. HTML output method, even though you use XML snippets to generate it. If you already have logic to parse HTML into a tree, it's trivial to run XSLT on it. Indeed, most recent version of XSLT uses the same trick to process JSON even.
 - El_Camino_Real 1y ago
 Why side with the megacorps on every thread, even when it doesn't relate to the big hotness of large language models?
 - JumpCrisscross 1y ago
 > Why side with the megacorps Reflexively siding with the tech majors is about as dogmatic as reflexively siding against them.
 - simonw 1y ago
 https://news.ycombinator.com/item?id=44450812#44451491 https://news.ycombinator.com/item?id=44450812#44451491 - "Google's AI overviews is the single worst AI-driven experience in widespread use today" https://news.ycombinator.com/item?id=44778764#44778850 https://news.ycombinator.com/item?id=44778764#44778850 - "Meta AI gave people a "share" option with several levels of click though required to share a post and it was a fiasco" https://news.ycombinator.com/item?id=44752546#44755224 https://news.ycombinator.com/item?id=44752546#44755224 - "Claude Opus 4 is 5x the price of Claude Sonnet 4. I don't think it's 5x as good."
 - aragilar 1y ago
 They don't want to support it (because of their perceived cost-benefit ratio for what they're interested in developing/maintaining), and hence if it is removed from the browser standards then they aren't required to support it (as opposed to driving people to other browsers)? One could ask why do WebUSB and similar "standards" given those would seem (to me) to be a much greater security issue?
 - Devasta 1y ago
 There are other implementations of XSLT available besides libxslt, some even in Javascript. Security is something that could be overcome and they wouldn't need to break styling on RSS feeds or anything, it could be something like how FF has a js for dealing with PDFs. It doesn't need to be some big conspiracy: they see the web as an application runtime instead of being about documents and information, don't give a fuck about XML technologies, don't use them internally and don't feel anyone else needs to.
- JimDabell 1y ago
 > their concerns about security just being the pretext. It seems entirely reasonable to be concerned about XSLT’s effects on security: > Although XSLT in web browsers has been a known attack surface for some time, there are still plenty of bugs to be found in it, when viewing it through the lens of modern vulnerability discovery techniques. In this presentation, we will talk about how we found multiple vulnerabilities in XSLT implementations across all major web browsers. We will showcase vulnerabilities that remained undiscovered for 20+ years, difficult to fix bug classes with many variants as well as instances of less well-known bug classes that break memory safety in unexpected ways. We will show a working exploit against at least one web browser using these bugs. — https://www.offensivecon.org/speakers/2025/ivan-fratric.html https://www.offensivecon.org/speakers/2025/ivan-fratric.html — https://www.youtube.com/watch?v=U1kc7fcF5Ao https://www.youtube.com/watch?v=U1kc7fcF5Ao
 - youngtaff 1y ago
 AFAIK browsers rely on an old version of xslt libraries and haven’t upgraded to newer versions They also seem to be putting pressure on the library maintainer resulting in them saying they’re not going to embargo security bugs
sharpfuryz 1y ago
The article is about intentional killing XSLT/XML in the browser. I think it is evolutionary: devs switched to JSON, AI agents don't care at all - they can handle anything; XML just lost naturally, like GOPHER
- _heimdall 1y ago
  The only reason AI agents don't care about XML is because the developers decided, yet again, to attempt to recreate the benefits of REST on top of JSON. That's been tried multiple times over the last two decades and it just ends up with a patchwork of conventions and rules defining how to jam a square peg into a round hole.
  - afavour 1y ago
    Many years ago I tried very hard to go all-in on XML. I loved the idea of serving XML files that contain the data and an XSLT file that defined the HTML templates that would be applied to that XML structure. I still love that idea. But the actual lived experience of developing that way was a nightmare and I gave up. "Developers keep making this bad choice over and over" is a statement worthy of deeper examination. Why? There's usually a valid reason for it. In this instance JSON + JS framework of the month is simply much easier to work with.
    - molteanu 1y ago
      "Choice" is a big word here. It would imply "we've weighted the alternatives, the pros and cons, we've tested and measured different strategies and implementations and we came out with this conclusion: [...]." You know, like science and engineering. While oftentimes what happens is is "oh, this thing seems to be working. And it looks easy. Great! Moving on.."
    - bilog 1y ago
      Most of the issues of using client-side XSLT is that browsers haven't updated their implementations since v1 nor their tooling to improve debugging. Both of these issues are resolved improving the implementations and tooling, as pointed out by several commenters on the GH issue.
gennarro 1y ago
Site not loading? Maybe the open web isn’t all it’s cracked up to be? /s
- andersmurphy 1y ago
  Loading fine for me.
- wltr 1y ago
  Might not load if you’re in Ukraine and the location of the server you’re trying to access is in Russia. Blocked on the country level. Works very well for me, I can easily distinguish someone trying to pretend they are in the EU, while being in Russia. Have no idea whether this is the case, but it does not load for me either.
  - cyberlimerence 1y ago
    It's hosted in Italy, as per the DNS record. I don't think you can register .eu domain if you're not based in Europe/EU.
    - wltr 1y ago
      As I’ve stated, have no idea if that’s the case. Might have been slashdotted. Having a .eu domain and Russian host are two different separate things, as you might knew. I was talking about the latter.
isodev 1y ago
I love the little historical overview in the post. With more than 25 years of hindsight, the push against user-centred standards is so obvious. W3C is always better than whatever coolaid-du-jour big corps wants you to drink because (at the very least), someone actually thinks "how is this going to affect people using it" as opposed to Google/Apple's approach "How is this going to affect our revenue".
- api 1y ago
  Nobody pays for anything with user centric standards. If software were free to produce and services were free to run this would work, but it doesn’t. Software in particular is incredibly time consuming and expensive, especially if you want to make it usable.
  - wobfan 1y ago
    > Nobody pays for anything with user centric standards. ??? Why do you think this?
    - api 1y ago
      Do people buy chat apps? Web browsers? Web servers? Web content? Clients or servers for other open standards? No, which means you’ll never see them get the level of polish or investment that closed stuff gets. Because when it’s closed you can make people pay or monetize it with advertising. I’m not cheering for this. Don’t shoot the messenger. I’m pointing out why things are this way. A major problem is that while free software efforts can build working software, it often takes orders of magnitude more work to make software mere mortals can use. That kind of UI/UX polish is also the work programmers hate doing, so you have to pay them to do it. Therefore closed stuff always wins on UI/UX. That means it always takes the network effect. UX polish is the moat that free has never been able to cross.
      - JumpCrisscross 1y ago
        > Do people buy chat apps? Web browsers? Web servers? Web content? Yes. (Slack. Orion. Since when were servers free?) The web basically fractures into people who watch ads and complain about paywalls and those who don’t.
gslin 1y ago
https://archive.ph/1Wn9v https://archive.ph/1Wn9v
ymolodtsov 1y ago
Coders have this tendency to value ideology over practicality. What matters is something that works and people use, not a theoretical picture of how it could have worked in an alternative timeline.
- isaacremuant 1y ago
  Actually, control means practicality. Linux won the server wars and that was a combination of ideology AND practicality. If a company breaks something so only their path works it's short term practicality to use it and long term practicality to fight for an alternative that keeps control in the developers hand. Monopolies are terrible for software developers. Quality and customisation tend to go down, which means less value for the Devs.
- Devasta 1y ago
  > Coders have this tendency to value ideology over practicality. It would be a horrible existence to value anything else. What reason is there to get up in the morning if you think things couldn't be better?
colesantiago 1y ago
What can we do to stop Google killing the open web other than complaining? One way is to tell everyone to use Firefox (uBlock origin works there) It is still an issue that the Mozilla Foundation is still 80% funded by Google though, so this needs to be solved first. Somehow Firefox needs to be moved away from Mozilla if they cannot find an alternative funding source other than Google.
- ymolodtsov 1y ago
  Firefox is used by 1% of users.
  - MrVandemar 1y ago
    The top 1% of users :-)
- andersmurphy 1y ago
  That would have been true pre Mozilla implosion.
- pjmlp 1y ago
  Stop using Chrome and Electron, but of course no one will, it was devs that made them what they are today.
- izacus 1y ago
  You need to admit to yourself that maintaining a critical piece of software like a web browser costs a lot in work and finance and start figuring where and how you'll fund people that do more than complain. Developing software is hard - and OSS hasn't found a way to do hard things yet.
- ozgrakkurt 1y ago
  You can donate to some project like ladybird or servo if they take donations. Or contribute.
  - colesantiago 1y ago
pjmlp 1y ago
It is already ChromeOS Application Platform for quite some time now. Every Chrome installation or related fork, plus Electron shippments, counts.
EVa5I7bHFq9mnYK 1y ago
-
- JumpCrisscross 1y ago
  > here is ChatGpt summary Please don’t do this.
stackedinserter 1y ago
Google is evil, but man, I never missed XSLT. I'm old enough to remember it and it gives me war flashbacks. The good thing is that it makes you strong and resilient to pain over time. It's painfully unreadable. It's verbose (ask chatgpt to write a simple if statement). Loops? - here's your foreach and that's all we have. Debugging is for weak, stdout is your debugger. It's just shit tech, period. I hope devs that write soul harvesting surveillance software at Google go to hell where they are forced to write endless xslt's. Maybe that's the reason they want to remove it from Chrome.
- jeroenhd 1y ago
 I don't really get the hatred for XSLT. It's not the most beautiful language, I'll give you that, but it's really not as bad as people make it out to be. I can't imagine wanting to use anything more complex than a for-each loop in XSLT. You can hack your way into doing different loops but that's like trying to implement do/while in Haskell. Is it that I've grown too comfortable with thinking in terms of functional programming? Because the worst part of XSLT I can think of is the visual noise of closing brackets.
 - stackedinserter 1y ago
 Probably you never _worked_ with XSLT (which is good for you). Very simple things quickly become 1K of unreadable text. E.g. showing the last element of the list with different something ``` <xsl:for-each select="items/item"> <xsl:choose> <xsl:when test="position() = last()"> <xsl:value-of select="."/> </xsl:when> <xsl:otherwise> <xsl:value-of select="."/> </xsl:otherwise> </xsl:choose> </xsl:for-each> ``` Or ask chatgpt to count total weight of a shipping based on xml with items that have weights. I did and it's too long to paste here. > It's not the most beautiful language, I'll give you that, but it's really not as bad as people make it out to be. TBH I can say that about any language or platform that I ever touched. ZX Spectrum is not that bad, although has its limits. That 1960x 29-bit machine is not that bad, just takes time to get used to it. C++ is not that bad for web development, it's totally doable too. The thing is that some technologies are more suitable for modern tasks then others, you'll just do much, much more (and better) with JSON model and JS code than XSLT.
myfonj 1y ago
Coincidentally spotted this source code in some Microsoft Windows Server® 2022 Remote Desktop Web Access thingy yesterday: <?xml version="1.0" encoding="UTF-8"?> <?xml-stylesheet type="text/xsl" href="../Site.xsl"?> <?xml-stylesheet type="text/css" href="../RenderFail.css"?> <RDWAPage helpurl="http://go.microsoft.com/fwlink/?LinkId=141038" (…) So I doubt XSLT is going away any time soon.
lifeinthevoid 1y ago
Google is a corporation maximizing shareholder value. That this goal is not aligned with serving the greater good and freedom should come as no surprise.
ants_everywhere 1y ago
> in 2023, Google renames their chatbot from Bard to [Gemini][gemini] thereby completely eclipsing the 4-year-old independent protocol by the same name; this is possibly coincidental, which would make it the only unintentional attack on the open web by Google in the last 15 or so years —and at this point even that is doubtful; So the theory is that Google chose the name of its AI -- easily one of the hardest and most revenue-impacting naming decisions it's made in years -- in order to create a name collision with a protocol nobody's heard of that's trying to revive GOPHER? This is so obviously false that you have to re-read the rest of the article with the knowledge that the author is misunderstanding what they're seeing. Much of what the author describes is increasing security and not wanting to work with XML.
- owebmaster 1y ago
  Did you at least read the excerpt you posted? It says the opposite of your conclusion, this is not even the worse interpretation of what was said, it's plain false.
- fooqux 1y ago
  I suppose the definition of intentional is a bit murky here. Yeah, you're right that Google probably didn't look at a list of open web technologies that they disagree with and choose one for their new tool. I guess I'll call that "malicious intention". I'm sure that, however the name was picked, Google's lawyers looked for prior uses of the name. I'm sure it came up, and Google shrugged its shoulders in indifference. Maybe someone brought up the fact this would hurt some open standard or whatever, but nobody in power cared. Is this the same kind of malicious? Probably not, but it still shows that Google doesn't care about the open web and the collateral damage they cause.
  - ants_everywhere 1y ago
    surely the lawyers found far more name clashes with Bard than Gemini https://books.google.com/ngrams/graph?content=gemini%2Cbard&year_start=1970&year_end=2022&corpus=en&smoothing=3&case_insensitive=false https://books.google.com/ngrams/graph?content=gemini%2Cbard&...
ozgrakkurt 1y ago
“The reason implementations are riddled with CVEs is neglect” Imo this misses the point a bit. If it is neglected and is going to keep producing bugs and not many people are developing on it, then it maybe makes sense to kill it. This also means new browsers won’t have to implement it maybe?
- bilog 1y ago
  Because those neglecting it are the same that want to remove it. So it's not “we want to remove it because it's neglected”, but “we want to remove it so we'll neglect it”. This is a pretty standard M.O. for the destruction of the commons. If you look at the WHATWG GH issue, you'll see that two distinct, modern, maintained implementations of XSLT, one of which in Rust (so considerably less likely to be affected by memory bugs) have been proposed as alternatives to what's currently used in WebKit and Blink. The suggestions has been ignored without a motivation, because the neglect is the point.
jmclnx 1y ago
To me, when google rename Bard to Gemini, they should have been dragged into court. But the Gemini people have no funds for this, so big money wins. But at the least a trademark complaint could have been filed. In any case, I do not use google at all unless forced. My old gmail address is a "dump" where if a site asks for am email, they get that one. I only long into to gmail to delete the "spam" I get.
myfonj 1y ago
Other anecdotal experiences with Google and their specific attitude towards user/developer needs: - Stable Array.sort (2008 – 2018): Of course it doesn't have to be stable, spec does not dictate it right now, it is good for performance, and some other browser even started to do this like we do: http://crbug.com/v8/90 http://crbug.com/v8/90 . - Users don't userstyle (2015– ) Of course we absolutely can an will remove this feature from the core, despite it is mandated by several specifications: https://bugs.chromium.org/p/chromium/issues/detail?id=347016 https://bugs.chromium.org/p/chromium/issues/detail?id=347016 . - SMIL murder attempt was addressed in the OP article (I think they keep similar sentiment towards MathML either) but luckily was eventually retracted. I guess/hope this XSLT will have similar "storm in the teacup" trajectory.
billy99k 1y ago
They have been killing open anything for a long time. Very similar to Microsoft. As an example, they have the power to block emails for a large portion of the Internet. This is used for good, like spam and scams, but also bad, like political viewpoints they don't like. The same can be said about their search engine. This most likely has already altered the outcomes of elections and should have been investigated years ago.
SEOCurmudgeon 1y ago
It was named Gemini because it was developed by the twin teams at Google, Google Brain and DeepMind. That's the only reason.
zzo38computer 1y ago
I also think Google is doing many bad things with it (although many of the things are not specific to Google, they are doing most of it). Removing stuff, and also adding stuff that just makes it worse, as well. Many of the things they add, or that other things are replaced with, are seems to just mostly benefit Google (and sometimes Cloudflare), rather than actually helping you. This is true of the new Web Authentication systems as much as with other things. (And, they seem to want to make you use bloated JavaScripts even if neither the author nor reader want to do.) > in 2025 Google announces a change in their Chrome Root Program Policy that within 2026 they will stop supporting certificate with an Extended Key Usage that includes any usage other than server I agree that Google should not have done that, but it is often more useful to use different certificates for clients anyways. While I think XML is generally not as good as other formats (I think DER is generally better), it works better than some other formats for some things. This is not a reason to get rid of XSLT though; it is useful. There are other reasons to not require it (e.g. to simplify implementations, but they are currently too complicated mainly due to the newer stuff instead anyways), but that does not mean that it cannot be used, that it cannot be implemented, etc. (For example, a static site generator might convert XML+XSLT to HTML if you need it while also providing the original XML+XSLT files to anyone who wants them, therefore making server-side and client-side working.)
- simultsop 1y ago
  I find it really interesting the amount of effort everyone putting in nagging a bad thing rather than ignoring and working on alternatives. I guess everyone is doing a favor to the bad decision maker. People are attracted to negative phenomens and here you go another one, and its rewarding the op.
  - zzo38computer 1y ago
    Yes, it would be better to work on alternatives, and I have done some of these things (and so have some other people). However, that won't fix WWW (or Chrome or Google), it just means it is an alternative (which is still a good thing to have, though). However, sometimes they even try to (or sometimes just does as a consequence of existing specifications, rather than deliberatley trying to) prevent any alternative that is actually good.
jaredcwhite 1y ago
XML for document content (like, the whole point of markup) = awesome. XML for app configuration or basic data transfer formats = horrible. Unfortunately I fear so many people got burned by the latter issues they forgot (or missed entirely) all the greatness of the first.
- jaredcwhite 1y ago
  P.S. Google has a bazillion dollars but can't figure out how to maintain a new secure XSLT library or update to a newer one which exists already? The usage argument is dumb…maybe a lot more sites would find good uses for XML/XSLT if this stuff was actually maintained and promoted properly!
  - AgentME 1y ago
    Why would Google want to bother? Who actually uses XSLT today for making webpages? Why should browsers spend effort on supporting XML+XSLT-based pages in addition to HTML+CSS-based pages?
- zzo38computer 1y ago
  I agree that XML is much better for document content and markup than for configuration and other stuff. I think still there are problems with XML, although that problem can be avoided (and often is, now, since JSON is often used instead, but JSON has its own problems, too).
scotty79 1y ago
When XSLT revival happens, don't let them forget to implement this: https://en.m.wikipedia.org/wiki/Efficient_XML_Interchange https://en.m.wikipedia.org/wiki/Efficient_XML_Interchange It's XML of the size of brotli compressed Json.
deleted 1y ago
[deleted]

193 points by thm 1y ago

Getting rid of XSLT from the browser would be a mistake, no doubt about it. You can see it clear as day in the github thread that they weren't asking permission, they were doing it no matter what, all their concerns about security just being the pretext. It would have been more honest of them to just tell everyone to go fuck themselves.

simonw 1y ago
What do you think their real reason for wanting to remove XSLT is, if not what they claim?
- jacquesm 1y ago
 To increase the depth of their moat. XSLT would allow anybody with a minimum of effort to extract semantic information from the web.
 - jon-wood 1y ago
 I feel like this is overly conspiratorial. Likely they want to remove it because it's a pain to support, and used by an ever shrinking proportion of the internet. I don't even necessarily think removing support is a terrible thing, if you want to turn XML into HTML or whatever with XSLT you're still very welcome to do so, you just might have to do it server side rather than expecting every web browser to it for you.
 - mschuster91 1y ago
 > a minimum of effort That is not a combination of words that should be mentioned in the same sentence as the word XML or, even worse, XSLT. XML has its value in enterprise and reliable application development because the tooling is very old, very mature and very reliable. But it's not something taught in university any more, it's certainly not taught in "coding bootcamps", simply because it's orders of magnitude more complex than JSON to wrap your head around. Of course, JSON has jsonschema, but in practice most real-world usages of JSON just don't give a flying fuck.
 - JimDabell 1y ago
 > XSLT would allow anybody with a minimum of effort to extract semantic information from the web. XSLT has been around for decades so why are you speaking in hypotheticals, as if it’s an up-and-coming technology that hasn’t been given a fair chance yet? If it hasn’t achieved that by now, it never will.
 - jeroenhd 1y ago
 XSLT is a terrible tool for that job. RDF combined with something like SPARQL is much closer to that, and makes for one of the greatest knowledge processing tools nobody ever uses. XSLT is designed to work on XML while HTML documents are almost always SGML-based. The semantics don't work the same and applying XML engines on HTML often breaks things in weird and unexpected ways. basic HTML parsing rules like "a <head> tag doesn't need to be closed and can simply be auto-closed by a <body>" will seriously confuse XML engines. To effectively use XSLT to extract information from the web, you'd first need to turn HTML into XML.
 - oefrha 1y ago
 Hey, it works great on the dozens of XHTML websites lying around. Dozens!
 - aragilar 1y ago
 I think it's the other way round, it's XML -> HTML not HTML -> XML.
 - int_19h 1y ago
 XSLT is designed to work on the XML Infoset, which is basically just an abstract tree of elements with attributes. Which is why XSLT has e.g. HTML output method, even though you use XML snippets to generate it. If you already have logic to parse HTML into a tree, it's trivial to run XSLT on it. Indeed, most recent version of XSLT uses the same trick to process JSON even.
- El_Camino_Real 1y ago
 Why side with the megacorps on every thread, even when it doesn't relate to the big hotness of large language models?
 - JumpCrisscross 1y ago
 > Why side with the megacorps Reflexively siding with the tech majors is about as dogmatic as reflexively siding against them.
 - simonw 1y ago
 https://news.ycombinator.com/item?id=44450812#44451491 https://news.ycombinator.com/item?id=44450812#44451491 - "Google's AI overviews is the single worst AI-driven experience in widespread use today" https://news.ycombinator.com/item?id=44778764#44778850 https://news.ycombinator.com/item?id=44778764#44778850 - "Meta AI gave people a "share" option with several levels of click though required to share a post and it was a fiasco" https://news.ycombinator.com/item?id=44752546#44755224 https://news.ycombinator.com/item?id=44752546#44755224 - "Claude Opus 4 is 5x the price of Claude Sonnet 4. I don't think it's 5x as good."
- aragilar 1y ago
 They don't want to support it (because of their perceived cost-benefit ratio for what they're interested in developing/maintaining), and hence if it is removed from the browser standards then they aren't required to support it (as opposed to driving people to other browsers)? One could ask why do WebUSB and similar "standards" given those would seem (to me) to be a much greater security issue?
- Devasta 1y ago
 There are other implementations of XSLT available besides libxslt, some even in Javascript. Security is something that could be overcome and they wouldn't need to break styling on RSS feeds or anything, it could be something like how FF has a js for dealing with PDFs. It doesn't need to be some big conspiracy: they see the web as an application runtime instead of being about documents and information, don't give a fuck about XML technologies, don't use them internally and don't feel anyone else needs to.
JimDabell 1y ago
> their concerns about security just being the pretext. It seems entirely reasonable to be concerned about XSLT’s effects on security: > Although XSLT in web browsers has been a known attack surface for some time, there are still plenty of bugs to be found in it, when viewing it through the lens of modern vulnerability discovery techniques. In this presentation, we will talk about how we found multiple vulnerabilities in XSLT implementations across all major web browsers. We will showcase vulnerabilities that remained undiscovered for 20+ years, difficult to fix bug classes with many variants as well as instances of less well-known bug classes that break memory safety in unexpected ways. We will show a working exploit against at least one web browser using these bugs. — https://www.offensivecon.org/speakers/2025/ivan-fratric.html https://www.offensivecon.org/speakers/2025/ivan-fratric.html — https://www.youtube.com/watch?v=U1kc7fcF5Ao https://www.youtube.com/watch?v=U1kc7fcF5Ao
- youngtaff 1y ago
  AFAIK browsers rely on an old version of xslt libraries and haven’t upgraded to newer versions They also seem to be putting pressure on the library maintainer resulting in them saying they’re not going to embargo security bugs

sharpfuryz 1y ago

The article is about intentional killing XSLT/XML in the browser. I think it is evolutionary: devs switched to JSON, AI agents don't care at all - they can handle anything; XML just lost naturally, like GOPHER

_heimdall 1y ago
The only reason AI agents don't care about XML is because the developers decided, yet again, to attempt to recreate the benefits of REST on top of JSON. That's been tried multiple times over the last two decades and it just ends up with a patchwork of conventions and rules defining how to jam a square peg into a round hole.
- afavour 1y ago
  Many years ago I tried very hard to go all-in on XML. I loved the idea of serving XML files that contain the data and an XSLT file that defined the HTML templates that would be applied to that XML structure. I still love that idea. But the actual lived experience of developing that way was a nightmare and I gave up. "Developers keep making this bad choice over and over" is a statement worthy of deeper examination. Why? There's usually a valid reason for it. In this instance JSON + JS framework of the month is simply much easier to work with.
  - molteanu 1y ago
    "Choice" is a big word here. It would imply "we've weighted the alternatives, the pros and cons, we've tested and measured different strategies and implementations and we came out with this conclusion: [...]." You know, like science and engineering. While oftentimes what happens is is "oh, this thing seems to be working. And it looks easy. Great! Moving on.."
  - bilog 1y ago
    Most of the issues of using client-side XSLT is that browsers haven't updated their implementations since v1 nor their tooling to improve debugging. Both of these issues are resolved improving the implementations and tooling, as pointed out by several commenters on the GH issue.

gennarro 1y ago

Site not loading? Maybe the open web isn’t all it’s cracked up to be? /s

andersmurphy 1y ago
Loading fine for me.
wltr 1y ago
Might not load if you’re in Ukraine and the location of the server you’re trying to access is in Russia. Blocked on the country level. Works very well for me, I can easily distinguish someone trying to pretend they are in the EU, while being in Russia. Have no idea whether this is the case, but it does not load for me either.
- cyberlimerence 1y ago
  It's hosted in Italy, as per the DNS record. I don't think you can register .eu domain if you're not based in Europe/EU.
  - wltr 1y ago
    As I’ve stated, have no idea if that’s the case. Might have been slashdotted. Having a .eu domain and Russian host are two different separate things, as you might knew. I was talking about the latter.

isodev 1y ago

I love the little historical overview in the post. With more than 25 years of hindsight, the push against user-centred standards is so obvious. W3C is always better than whatever coolaid-du-jour big corps wants you to drink because (at the very least), someone actually thinks "how is this going to affect people using it" as opposed to Google/Apple's approach "How is this going to affect our revenue".

api 1y ago
Nobody pays for anything with user centric standards. If software were free to produce and services were free to run this would work, but it doesn’t. Software in particular is incredibly time consuming and expensive, especially if you want to make it usable.
- wobfan 1y ago
  > Nobody pays for anything with user centric standards. ??? Why do you think this?
  - api 1y ago
    Do people buy chat apps? Web browsers? Web servers? Web content? Clients or servers for other open standards? No, which means you’ll never see them get the level of polish or investment that closed stuff gets. Because when it’s closed you can make people pay or monetize it with advertising. I’m not cheering for this. Don’t shoot the messenger. I’m pointing out why things are this way. A major problem is that while free software efforts can build working software, it often takes orders of magnitude more work to make software mere mortals can use. That kind of UI/UX polish is also the work programmers hate doing, so you have to pay them to do it. Therefore closed stuff always wins on UI/UX. That means it always takes the network effect. UX polish is the moat that free has never been able to cross.
    - JumpCrisscross 1y ago
      > Do people buy chat apps? Web browsers? Web servers? Web content? Yes. (Slack. Orion. Since when were servers free?) The web basically fractures into people who watch ads and complain about paywalls and those who don’t.

gslin 1y ago

https://archive.ph/1Wn9v https://archive.ph/1Wn9v

ymolodtsov 1y ago

Coders have this tendency to value ideology over practicality. What matters is something that works and people use, not a theoretical picture of how it could have worked in an alternative timeline.

isaacremuant 1y ago
Actually, control means practicality. Linux won the server wars and that was a combination of ideology AND practicality. If a company breaks something so only their path works it's short term practicality to use it and long term practicality to fight for an alternative that keeps control in the developers hand. Monopolies are terrible for software developers. Quality and customisation tend to go down, which means less value for the Devs.
Devasta 1y ago
> Coders have this tendency to value ideology over practicality. It would be a horrible existence to value anything else. What reason is there to get up in the morning if you think things couldn't be better?

colesantiago 1y ago

What can we do to stop Google killing the open web other than complaining? One way is to tell everyone to use Firefox (uBlock origin works there) It is still an issue that the Mozilla Foundation is still 80% funded by Google though, so this needs to be solved first. Somehow Firefox needs to be moved away from Mozilla if they cannot find an alternative funding source other than Google.

ymolodtsov 1y ago
Firefox is used by 1% of users.
- MrVandemar 1y ago
  The top 1% of users :-)
andersmurphy 1y ago
That would have been true pre Mozilla implosion.
pjmlp 1y ago
Stop using Chrome and Electron, but of course no one will, it was devs that made them what they are today.
izacus 1y ago
You need to admit to yourself that maintaining a critical piece of software like a web browser costs a lot in work and finance and start figuring where and how you'll fund people that do more than complain. Developing software is hard - and OSS hasn't found a way to do hard things yet.
ozgrakkurt 1y ago
You can donate to some project like ladybird or servo if they take donations. Or contribute.
- colesantiago 1y ago

pjmlp 1y ago

It is already ChromeOS Application Platform for quite some time now. Every Chrome installation or related fork, plus Electron shippments, counts.

EVa5I7bHFq9mnYK 1y ago

JumpCrisscross 1y ago
> here is ChatGpt summary Please don’t do this.

stackedinserter 1y ago

Google is evil, but man, I never missed XSLT. I'm old enough to remember it and it gives me war flashbacks. The good thing is that it makes you strong and resilient to pain over time. It's painfully unreadable. It's verbose (ask chatgpt to write a simple if statement). Loops? - here's your foreach and that's all we have. Debugging is for weak, stdout is your debugger. It's just shit tech, period. I hope devs that write soul harvesting surveillance software at Google go to hell where they are forced to write endless xslt's. Maybe that's the reason they want to remove it from Chrome.

jeroenhd 1y ago
I don't really get the hatred for XSLT. It's not the most beautiful language, I'll give you that, but it's really not as bad as people make it out to be. I can't imagine wanting to use anything more complex than a for-each loop in XSLT. You can hack your way into doing different loops but that's like trying to implement do/while in Haskell. Is it that I've grown too comfortable with thinking in terms of functional programming? Because the worst part of XSLT I can think of is the visual noise of closing brackets.
- stackedinserter 1y ago
 Probably you never _worked_ with XSLT (which is good for you). Very simple things quickly become 1K of unreadable text. E.g. showing the last element of the list with different something ``` <xsl:for-each select="items/item"> <xsl:choose> <xsl:when test="position() = last()"> <xsl:value-of select="."/> </xsl:when> <xsl:otherwise> <xsl:value-of select="."/> </xsl:otherwise> </xsl:choose> </xsl:for-each> ``` Or ask chatgpt to count total weight of a shipping based on xml with items that have weights. I did and it's too long to paste here. > It's not the most beautiful language, I'll give you that, but it's really not as bad as people make it out to be. TBH I can say that about any language or platform that I ever touched. ZX Spectrum is not that bad, although has its limits. That 1960x 29-bit machine is not that bad, just takes time to get used to it. C++ is not that bad for web development, it's totally doable too. The thing is that some technologies are more suitable for modern tasks then others, you'll just do much, much more (and better) with JSON model and JS code than XSLT.

myfonj 1y ago

Coincidentally spotted this source code in some Microsoft Windows Server® 2022 Remote Desktop Web Access thingy yesterday: <?xml version="1.0" encoding="UTF-8"?> <?xml-stylesheet type="text/xsl" href="../Site.xsl"?> <?xml-stylesheet type="text/css" href="../RenderFail.css"?> <RDWAPage helpurl="http://go.microsoft.com/fwlink/?LinkId=141038" (…) So I doubt XSLT is going away any time soon.

lifeinthevoid 1y ago

Google is a corporation maximizing shareholder value. That this goal is not aligned with serving the greater good and freedom should come as no surprise.

ants_everywhere 1y ago

> in 2023, Google renames their chatbot from Bard to [Gemini][gemini] thereby completely eclipsing the 4-year-old independent protocol by the same name; this is possibly coincidental, which would make it the only unintentional attack on the open web by Google in the last 15 or so years —and at this point even that is doubtful; So the theory is that Google chose the name of its AI -- easily one of the hardest and most revenue-impacting naming decisions it's made in years -- in order to create a name collision with a protocol nobody's heard of that's trying to revive GOPHER? This is so obviously false that you have to re-read the rest of the article with the knowledge that the author is misunderstanding what they're seeing. Much of what the author describes is increasing security and not wanting to work with XML.

owebmaster 1y ago
Did you at least read the excerpt you posted? It says the opposite of your conclusion, this is not even the worse interpretation of what was said, it's plain false.
fooqux 1y ago
I suppose the definition of intentional is a bit murky here. Yeah, you're right that Google probably didn't look at a list of open web technologies that they disagree with and choose one for their new tool. I guess I'll call that "malicious intention". I'm sure that, however the name was picked, Google's lawyers looked for prior uses of the name. I'm sure it came up, and Google shrugged its shoulders in indifference. Maybe someone brought up the fact this would hurt some open standard or whatever, but nobody in power cared. Is this the same kind of malicious? Probably not, but it still shows that Google doesn't care about the open web and the collateral damage they cause.
- ants_everywhere 1y ago
  surely the lawyers found far more name clashes with Bard than Gemini https://books.google.com/ngrams/graph?content=gemini%2Cbard&year_start=1970&year_end=2022&corpus=en&smoothing=3&case_insensitive=false https://books.google.com/ngrams/graph?content=gemini%2Cbard&...

ozgrakkurt 1y ago

“The reason implementations are riddled with CVEs is neglect” Imo this misses the point a bit. If it is neglected and is going to keep producing bugs and not many people are developing on it, then it maybe makes sense to kill it. This also means new browsers won’t have to implement it maybe?

bilog 1y ago
Because those neglecting it are the same that want to remove it. So it's not “we want to remove it because it's neglected”, but “we want to remove it so we'll neglect it”. This is a pretty standard M.O. for the destruction of the commons. If you look at the WHATWG GH issue, you'll see that two distinct, modern, maintained implementations of XSLT, one of which in Rust (so considerably less likely to be affected by memory bugs) have been proposed as alternatives to what's currently used in WebKit and Blink. The suggestions has been ignored without a motivation, because the neglect is the point.

jmclnx 1y ago

To me, when google rename Bard to Gemini, they should have been dragged into court. But the Gemini people have no funds for this, so big money wins. But at the least a trademark complaint could have been filed. In any case, I do not use google at all unless forced. My old gmail address is a "dump" where if a site asks for am email, they get that one. I only long into to gmail to delete the "spam" I get.

myfonj 1y ago

Other anecdotal experiences with Google and their specific attitude towards user/developer needs: - Stable Array.sort (2008 – 2018): Of course it doesn't have to be stable, spec does not dictate it right now, it is good for performance, and some other browser even started to do this like we do: http://crbug.com/v8/90 http://crbug.com/v8/90 . - Users don't userstyle (2015– ) Of course we absolutely can an will remove this feature from the core, despite it is mandated by several specifications: https://bugs.chromium.org/p/chromium/issues/detail?id=347016 https://bugs.chromium.org/p/chromium/issues/detail?id=347016 . - SMIL murder attempt was addressed in the OP article (I think they keep similar sentiment towards MathML either) but luckily was eventually retracted. I guess/hope this XSLT will have similar "storm in the teacup" trajectory.

billy99k 1y ago

They have been killing open anything for a long time. Very similar to Microsoft. As an example, they have the power to block emails for a large portion of the Internet. This is used for good, like spam and scams, but also bad, like political viewpoints they don't like. The same can be said about their search engine. This most likely has already altered the outcomes of elections and should have been investigated years ago.

SEOCurmudgeon 1y ago

It was named Gemini because it was developed by the twin teams at Google, Google Brain and DeepMind. That's the only reason.

zzo38computer 1y ago

I also think Google is doing many bad things with it (although many of the things are not specific to Google, they are doing most of it). Removing stuff, and also adding stuff that just makes it worse, as well. Many of the things they add, or that other things are replaced with, are seems to just mostly benefit Google (and sometimes Cloudflare), rather than actually helping you. This is true of the new Web Authentication systems as much as with other things. (And, they seem to want to make you use bloated JavaScripts even if neither the author nor reader want to do.) > in 2025 Google announces a change in their Chrome Root Program Policy that within 2026 they will stop supporting certificate with an Extended Key Usage that includes any usage other than server I agree that Google should not have done that, but it is often more useful to use different certificates for clients anyways. While I think XML is generally not as good as other formats (I think DER is generally better), it works better than some other formats for some things. This is not a reason to get rid of XSLT though; it is useful. There are other reasons to not require it (e.g. to simplify implementations, but they are currently too complicated mainly due to the newer stuff instead anyways), but that does not mean that it cannot be used, that it cannot be implemented, etc. (For example, a static site generator might convert XML+XSLT to HTML if you need it while also providing the original XML+XSLT files to anyone who wants them, therefore making server-side and client-side working.)

simultsop 1y ago
I find it really interesting the amount of effort everyone putting in nagging a bad thing rather than ignoring and working on alternatives. I guess everyone is doing a favor to the bad decision maker. People are attracted to negative phenomens and here you go another one, and its rewarding the op.
- zzo38computer 1y ago
  Yes, it would be better to work on alternatives, and I have done some of these things (and so have some other people). However, that won't fix WWW (or Chrome or Google), it just means it is an alternative (which is still a good thing to have, though). However, sometimes they even try to (or sometimes just does as a consequence of existing specifications, rather than deliberatley trying to) prevent any alternative that is actually good.

jaredcwhite 1y ago

XML for document content (like, the whole point of markup) = awesome. XML for app configuration or basic data transfer formats = horrible. Unfortunately I fear so many people got burned by the latter issues they forgot (or missed entirely) all the greatness of the first.

jaredcwhite 1y ago
P.S. Google has a bazillion dollars but can't figure out how to maintain a new secure XSLT library or update to a newer one which exists already? The usage argument is dumb…maybe a lot more sites would find good uses for XML/XSLT if this stuff was actually maintained and promoted properly!
- AgentME 1y ago
  Why would Google want to bother? Who actually uses XSLT today for making webpages? Why should browsers spend effort on supporting XML+XSLT-based pages in addition to HTML+CSS-based pages?
zzo38computer 1y ago
I agree that XML is much better for document content and markup than for configuration and other stuff. I think still there are problems with XML, although that problem can be avoided (and often is, now, since JSON is often used instead, but JSON has its own problems, too).

scotty79 1y ago

When XSLT revival happens, don't let them forget to implement this: https://en.m.wikipedia.org/wiki/Efficient_XML_Interchange https://en.m.wikipedia.org/wiki/Efficient_XML_Interchange It's XML of the size of brotli compressed Json.

deleted 1y ago

[deleted]