Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About rel=noopener

mathiasbynens.github.io

Post reply on HN
Print view View original

81–90 of 115 posts

Re: About rel=noopener

#81

Post by gkya »

etatoby wrote: post #68
adrianN wrote: post #28

NoScript saves the day again.

Yeah, except breaking 99% of the modern Web. NoScript has its place, for example in the Tor browser or in other high-security applications, but it's too much of a burden for everyday use.

> NoScript [is] too much of a burden for everyday use.

No it is not. It actually removes most of the burden from my daily browsing. Modern web is mostly a bunch of obstacles between the user and the information, and with NoScript (or xombrero in my case) the user skips over that. I believe most of the users don't care about layouts, transitions, syncing between tabs, etc, it's all designers' and marketers' caprice.

Re: About rel=noopener

#82

Post by [deleted] »

PinguTS wrote: post #63
epidemian wrote: post #43

Earlier quoted context omitted.

Good call! I guess i haven't seen any of those. But i've seen some internal web based systems that relied too heavily on popup windows and started breaking when tabbed browsing became a thing and brosers started blocking popup windows by default, so i don't doubt that there are probably systems out there relying on this weird behavior of target=_blank. For those systems, though, i'd imagine most of them would have th…

For example Typo3 is using that, when you need to select something to be inserted/referenced into the current record. So any, Typo3 based website would break.

[deleted]

Re: About rel=noopener

#83

Post by pdkl95 »

etatoby wrote: post #68
adrianN wrote: post #28

NoScript saves the day again.

Yeah, except breaking 99% of the modern Web. NoScript has its place, for example in the Tor browser or in other high-security applications, but it's too much of a burden for everyday use.

If your website breaks without Javascript, then it's the website's fault for not properly implementing progressive enhancement. Javascript is useful to enhance the page with better features, but the page itself should work without it.

If you tools/framework make this hard or generate output that incompatible with progressive enhancement, then I suggest you find (or write) better tools.

Re: About rel=noopener

#84

Post by lsaferite »

donatj wrote: post #31
knowtheory wrote: post #20

Earlier quoted context omitted.

Maybe you could send them a note? Do you know anybody who's still working on the project?

It's a complicated situation. They owe me a bit of money and don't reply to any of my emails.

For future reference, IP transfer on final payment.

Re: About rel=noopener

#85

Post by eli »

teej wrote: post #13

This is the new pop-under. Sites trying to serve as many ads as possible will open links with target=_blank and redirect the old window to an ad.

But doing what you describe doesn't rely on this window.opener security issue, right? Of course any site that can open popups can open popups and then also redirect somewhere else.

(Also, I'm not sure I've personally seen that)

Re: About rel=noopener

#86

Post by acdha »

nsgi wrote: post #78
krastanov wrote: post #38

Earlier quoted context omitted.

Example: Google Slides where one tab has the presentation and another tab has the speaker notes. You want those to be in sync.

There are plenty of other ways to do this e.g. web sockets or localStorage.

Now, yes, but a lot of precedent was set before then. Even now both of the technologies you mentioned would add significant complexity – needing to start running an otherwise unnecessary WebSocket server, having to debug and workaround client bugs or network issues like large organizations blocking WebSockets.

Re: About rel=noopener

#87

Post by bzbarsky »

dgoldstein0 wrote: post #77
bigblind wrote: post #70

Earlier quoted context omitted.

Most of these use postMessage.

probably window.opener.postMessage. Though that doesn't excuse window.opener.location not being blocked in the name of the Same-Origin Policy...

"location" is not blocked cross-origin, because that allows you to navigate windows you opened, or subframes of yourself, even if they happen to not be same-origin with you at the moment. And it's been this way for over 20 years, and sites commonly depend on it. :(

So what you're suggesting is either some sort of asymmetric "same-origin" checks or .... something.

Re: About rel=noopener

#88

Post by bzbarsky »

epidemian wrote: post #52
panic wrote: post #47

Earlier quoted context omitted.

There are more than 1 billion websites. If just 0.1% of sites use target=_blank like that, you'd be breaking a million sites with your change. You can't use arguments like "I haven't seen any of those" or it "seems like a sensible idea" when making decisions like this.

The "I haven't seen any of those" was just as a comment on why i couldn't think of possible uses for this target=_blank behavior, not a justification for the proposed change (what a lame justification that would be! :) That being said, i don't see how the proposal of browsers blocking popup windows from redirecting the parent window (if it's cross-origin) by default is any different from, for instance, them blocking…

Should the parent window be able to navigate the popup window, even if it's cross origin?

If not, now you're suggesting some sort of asymmetric security checks that depend on something that's not just the origins. Security checks that, chances are, will be easy to evade by malicious actors. At least I haven't thought of a non-evadable one here yet.

Re: About rel=noopener

#89

Post by gorhill »

happyslobro wrote: post #71
teej wrote: post #13

This is the new pop-under. Sites trying to serve as many ads as possible will open links with target=_blank and redirect the old window to an ad.

So that's what's happening! With uBlock, all I see is a flicker on the browser's tab bar, and my history is gone. It's still annoyingly retarded.

I did try to provide a fix for the history-lost case for when a popunder is blocked, but in the end I had to give up because there was no way to make it work reliably (using current extensions API).

[1] https://github.com/gorhill/uBlock/issues/1028

Re: About rel=noopener

#90

Post by MichaelApproved »

douche wrote: post #59
wtbob wrote: post #57

Earlier quoted context omitted.

> What is the correct way to force a link to open in a new tab, then? What is the correct way to stalk, hunt, kill, stuff and mount the user? Answer: there is no correct way to do something which is fundamentally incorrect. > Unfortunately "let the user decide" is not the best answer if you want to link to something like "terms and conditions" in the middle of a sign up flow or something. If the user doesn't know how…

On the other hand, I almost never want to have a link open in the same tab. There's nothing more frustrating than being halfway down a page, forget to hold down ctrl when I click on a link, and have all of my state on the old page blown away and replaced with the new one. Probably this is a result of the internet already being broken, since the worst of it is in infite-scrolling type things where my confidence that I…

If you have a middle mouse button, you can middle click a link to open it in a new tab. Of course, that's if you didn't reprogram the middle button to do something else.
Post reply on HN