Live data from Hacker News

Show HN: I Built a XSLT Blog Framework

vgr.land

31–40 of 71 posts

Re: Show HN: I Built a XSLT Blog Framework

#31
Disclaimer: it's possible XSLT got better over time, although I doubt it.

I actually wrote a whole app that used XSLT back 25 years ago, even backed by an XML database! Super hip (tech stack wasn't my choice).

XSLT is bad tech and you shouldn't use it. The modern equivalent is React+JSON which implements many of the same ideas in a much better way. And I say that as someone who isn't a big React fan but who has used both. It's not a coincidence that this example is for a 1999-era static blog; it's about the limit of what you can do with this tech.

The core idea of XSLT is to provide a functional transform from an app-specific model to a view, where both are expressed in XML. It does that by asking you to supply templates that match patterns in the original data structure. This idea has some deep flaws:

1. The syntax and generic data model used to express your app's own model has to be XML, but XML is descended from a line of technologies intended to express views. XML-based languages are a competent enough way to express a view which is why React invented JSX, but they are less natural for expressing data structures. Modern apps use JSON for expressing data structures which is also far from ideal but it's still an improvement over XML.

2. Transforms from data to view can be arbitrarily complex. React uses a regular imperative programming language with some additional rules to make it "functional-ish", XSLT gives you XPath and what is basically an XML syntax for something a bit like Haskell. Expressing complex transforms is very awkward in this language. Something as simple as a for loop over a list - very easy in JS - requires you to think in pure functional terms in XSLT.

3. Modularity? Debugging? Nope. It's Web Tech, what do you expect? If you make a syntax error you might get a parse error if you're lucky, if you make a logic error you get to sit down with a pen and paper to work out what might be going wrong. Because it's a functional transform rather than a programming language there isn't even really printf style logging. And IIRC there's no such thing as XSLT libraries.

4. There is no solution for interactivity. Mutating the model might yield retransformation depending on implementation (I don't know for modern browsers, I think I mostly tested on IE6 back in the day). If it does, it'll be a retransform of the entire document that blows away any changes to the DOM. But if you want actual app-level state in UI components that efficiently re-render, then you're just out of luck, you have to mutate the generated HTML DOM directly as if XSLT didn't exist at all.

5. There is no functioning protocol for controlling server-side rendering or not (in practice most XSLT based apps give up on browser rendering pretty quickly). Soooooo the original motivation of exposing the app's data structures directly allowing machine-readable access to data, does not actually apply in practice, because there's no systematic way to ask the server to give you the raw XML. Sure a tiny number of servers might actually serve you something different if you use an Accept header with text/xml up front, but even when XSLT was hip apps that did that in the wild were unicorn poop. People claimed they saw one once, but I never actually tracked down a real server that did it.

This blog demo could have been implemented using Preact and the results would be better. The view logic would be much easier to read and write. The underlying data would be a JSON file, or perhaps a combination of JSON and Markdown, i.e. syntaxes designed for the convenient expression of data and marked up text. The browser would still take care of rendering, and the server could easily do the render work up front to make things snappy by avoiding extra roundtrips. The advantage would be that debugging, modularity and retransformation for interactivity all work well.

Re: Show HN: I Built a XSLT Blog Framework

#32

Nice one! Although it seems that the engineers at the different browser vendors are committed to remove XSLT due to reasons outlined here [1]. It's a shame these Discussions got so heated, but that's just the nature of the internet, I guess. [1]: https://github.com/whatwg/html/issues/11523#issuecomment-318... //Edit: Rephrased "PRs" to "Discussions".

Unfortunately a topic like this is perfect bait for a lot of the resentments folks have with the modern internet ecosystem.

There’s some rarely used tech that few have talked about in a long time. Tech giants have decided somewhat unilaterally to get rid of it because it’s barely used and has had security flaws.

There’s a discussion to be had about that specifically but most people didn’t care a jot about XSLT until it was threatened. What they do care about is tech giants controlling the fate of the internet. That’s a far bigger issue than can be solved in a GitHub discussion, but it doesn’t stop anyone trying.

Re: Show HN: I Built a XSLT Blog Framework

#33
post #30

Earlier quoted context omitted.

Not necessarily. The security issues are with the libxml implementation, a different one might be more secure even with JIT. That's part of what makes the whole situation so ridiculous.

Emphasis on might be . Finding out whether it actually is is not a trivial process.

There are multiple CVEs in multiple Chrome-only non-standards that Chrome spits out by the hundreds in the past few years. They have no issues releasing those, supporting them, and fixing them.

Somehow they have an issue with supporting, fixing (and updating to latest version) this particular one. Possibly because it doesn't result in promotions.

Re: Show HN: I Built a XSLT Blog Framework

#34
post #31

Disclaimer: it's possible XSLT got better over time, although I doubt it. I actually wrote a whole app that used XSLT back 25 years ago, even backed by an XML database! Super hip (tech stack wasn't my choice). XSLT is bad tech and you shouldn't use it. The modern equivalent is React+JSON which implements many of the same ideas in a much better way. And I say that as someone who isn't a big React fan but who has used…

Agreed, having worked with a few people who thought xslt is the bee knees it's just not very good at all for this type of thing. In fact I'd say it's not very good at anything really.

My thoughts:

1) It's fragile. As xml is so dynamic small changes in the data can mean your transform doesn't work or worse that it does run but doesn't transform to the correct thing anymore

2) Hard to actually make xslt work. Like there are no decent debugging tools the best you'll get is a site you can plug in data and it will auto run the transformation. The devex here is really really poor which is why I'm baffled anyone would build this. As you say it's a transform language so you can't really step through it you just have to run it and see

3) Very hard to test properly. The amount of times something small would change in the data and then the transforms wouldn't work was awful. The "unit testing" we done was produce a bunch of XML and then run the transforms and check the XML. Like I couldn't actually test parts of the transform as I was going

4) Most importantly was maintenance. XSLT seemed to be a write only language as in hardly anyone as able to pickup someone elses transform and figure it out.

The people who liked it normally only used it for toy applications.

Re: Show HN: I Built a XSLT Blog Framework

#36
post #10
post #6

The core concept behind XSLT is evergreen: Being able to programmatically transform the results of a HTTP request into a document with native tools is still useful. I don't foresee any equivalent native framework for styling JSON ever coming into being though.

> I don't foresee any equivalent native framework for styling JSON ever coming into being though. Well yeah I hope not! That's what a programming language is for, to turn data into documents.

Having something declarative is good here, and XSL fills that.

Re: Show HN: I Built a XSLT Blog Framework

#37

A few HN posts ago I commented this > I want to see XSL import an XML. I want to see the reverse. XSL will be the view. XML will be the model. And the browser will be the controller. MVC paradigm. It then dawned on me that the MVC framework for XML is where XML is the model (or data or database table). And XSLT is the viewer in the rear. Meaning the web browser can browse database information. I never appreciated thi…

It would not make sense to start from an XSLT. An XSLT is only a set of transformation rules (a transformation stylesheet). If there is nothing to transform, then the stylesheet produces nothing.

But you can kind of achieve what you want by treating the initial XML as a "view definition/configuration", and the referenced XSLT as a "view builder", and referencing your "model" as an external document via XPath document and applying to the XSLT template(s). i.e. you create configurations of your view that apply external data.

Re: Show HN: I Built a XSLT Blog Framework

#38
I wonder why everybody want's to use XSLT on the client side. On te Server side it is so powerful and works like a charme with PHP: // XML $xml_doc = new DOMDocument(); $xml_doc->load("file1.xml");

// XSL $xsl_doc = new DOMDocument(); $xsl_doc->load("file.xsl");

// Proc $proc = new XSLTProcessor(); $proc->importStylesheet($xsl_doc); $newdom = $proc->transformToDoc($xml_doc);

// Output print $newdom->saveXML();

Re: Show HN: I Built a XSLT Blog Framework

#39
post #13

Earlier quoted context omitted.

I think it would be very unlikely browsers would use a jit engine for xslt. They are removing it because they are afraid of the security footprint. A JIT engine would make that footprint much worse.

Not necessarily. The security issues are with the libxml implementation, a different one might be more secure even with JIT. That's part of what makes the whole situation so ridiculous.

Still, from a security perspective considering the low amount of sites that use it I think a better solution would be to implement it with a JS shim like PDF.js.

JS is already required to have a XML DOM parser, an universal XSLT engine in JS should be a low-effort web to continue supporting XSLT, as for performance the transform could probably be eval'ed and cached to JS snippets so that they in turn become JIT-compiled.

https://developer.mozilla.org/en-US/docs/Web/API/DOMParser

Re: Show HN: I Built a XSLT Blog Framework

#40
post #25
post #4

Haven't seen this much interest in XML/XSLT in 20 years.

Fortunately! It was cool to do the easy things, but then you had monstruous path expressions, and all sort of programmatical drama.. Pfff... did you know that XSLT was shown to be Turing complete ? https://staff.emu.edu.tr/zekibayram/Documents/papers/XSLT_Tu... On the other side, I find XML/XSD still much better than JSON. JSON is way too simple...

Depends on the task, JSON won because it was so simple whilst XML is waaay to complex. Maybe an alternative to JSON with just a tad more complexity for sanity could have won 20 years ago, but alas it never happened.
Post reply on HN