They ever heard of "security by default"? I guess no.
In the early to mid '90s, threat models on the web were quite a bit different from now.
I was implying "make it a default for everyone, now"
About rel=noopener
91–100 of 115 posts
Re: About rel=noopener
#92Re: About rel=noopener
#93Earlier quoted context omitted.
Yeah, except breaking 99% of the modern Web. NoScript has its place, for example in the Tor browser or in other high-security applications, but it's too much of a burden for everyday use.
If your website breaks without Javascript, then it's the website's fault for not properly implementing progressive enhancement. Javascript is useful to enhance the page with better features, but the page itself should work without it. If you tools/framework make this hard or generate output that incompatible with progressive enhancement, then I suggest you find (or write) better tools.
I do wonder for how many sites does this actually make sense to do. Take the number of users who use NoScript and are not willing to turn it off when the site doesn't work without JS, and then take the subset from those who would actually be willing to pay for using the website. [1] Do these niche users really generate enough revenue to pay for the toolchain & work culture changes necessary to have this progressive enhancement? What's more, this group of users doesn't even receive the charity boost that some other niche groups like the visually impaired might receive, that would lead to changes even without direct financial sense.
[1] Being NoScript users, they most likely also run some sort of ad blocker, so ad revenue from them is likely zero.
Re: About rel=noopener
#94Earlier quoted context omitted.
On the other hand, I almost never want to have a link open in the same tab. There's nothing more frustrating than being halfway down a page, forget to hold down ctrl when I click on a link, and have all of my state on the old page blown away and replaced with the new one. Probably this is a result of the internet already being broken, since the worst of it is in infite-scrolling type things where my confidence that I…
If you have a middle mouse button, you can middle click a link to open it in a new tab. Of course, that's if you didn't reprogram the middle button to do something else.
Reprogramming the meat behind the keyboard is often harder than reprogramming the machine.
Re: About rel=noopener
#95Earlier quoted context omitted.
probably window.opener.postMessage. Though that doesn't excuse window.opener.location not being blocked in the name of the Same-Origin Policy...
"location" is not blocked cross-origin, because that allows you to navigate windows you opened, or subframes of yourself, even if they happen to not be same-origin with you at the moment. And it's been this way for over 20 years, and sites commonly depend on it. :( So what you're suggesting is either some sort of asymmetric "same-origin" checks or .... something.
I don't really see the problem with making this asymmetrical. The security implications of a frame navigating its parent and a parent navigating its child frame seem very clearly different to my mind.
If you're suggesting it would be technically difficult, I'm extremely skeptical of that. The origin's relationship to the target frame should not be impossible to discern, and I'd be a little shocked if it isn't taken into account elsewhere.
Re: About rel=noopener
#96Earlier quoted context omitted.
On the other hand, I almost never want to have a link open in the same tab. There's nothing more frustrating than being halfway down a page, forget to hold down ctrl when I click on a link, and have all of my state on the old page blown away and replaced with the new one. Probably this is a result of the internet already being broken, since the worst of it is in infite-scrolling type things where my confidence that I…
If you have a middle mouse button, you can middle click a link to open it in a new tab. Of course, that's if you didn't reprogram the middle button to do something else.
With mice that don't have real middle buttons, trying to click the scroll-wheel without triggering a scroll event instead can be very trying...
Re: About rel=noopener
#97Earlier quoted context omitted.
"location" is not blocked cross-origin, because that allows you to navigate windows you opened, or subframes of yourself, even if they happen to not be same-origin with you at the moment. And it's been this way for over 20 years, and sites commonly depend on it. :( So what you're suggesting is either some sort of asymmetric "same-origin" checks or .... something.
I don't really see the problem with making this asymmetrical. The security implications of a frame navigating its parent and a parent navigating its child frame seem very clearly different to my mind. If you're suggesting it would be technically difficult, I'm extremely skeptical of that. The origin's relationship to the target frame should not be impossible to discern, and I'd be a little shocked if it isn't taken i…
The problem with making it asymmetrical is that in the case of two toplevel tabs (as opposed to frame and child) determining who's the "parent" and who's the "child" is a lot more complicated.
> If you're suggesting it would be technically difficult, I'm extremely skeptical of that.
I think it's technically difficult to establish parent/child relationships between toplevel windows, given opener disowning and so forth.
That's not even getting into the possible compat issues, of course, from the behavior change itself.
Re: About rel=noopener
#98Re: About rel=noopener
#99Earlier quoted context omitted.
It's a complicated situation. They owe me a bit of money and don't reply to any of my emails.
For future reference, IP transfer on final payment.
It's quite complicated really. I had been their lead developer, having worked my way up over a five year period with the company. My leaving was very cordial. I had been there a long time and they understood me wanting to grow. I started a project on the side for them almost immediately after I left because I knew they needed help.
I had a medical emergency (my tonsils swelled to the point where I could not breathe) and ended up needing surgery, so before the surgery I gave them the work that had been completed (By my estimate 80%) so they could finish the rest. They told me to get better and we would discuss how to handle the partial payment after my surgery.
While recovering, two of my former coworkers quit and took jobs at my current company. I had nothing to do with this. This is when my old company threatened to sue myself as well as them. Sigh. Our cooperate lawyer came back at them about them having no case and they soon dropped the whole thing.
I tried to pursue what I was owed, first emailing my contact and after receiving no response to a handful over several months beginning to loop in lower and lower managers I knew. I'm genuinely not sure if they had all been poisoned against me or if there was just some sort of email filter enacted, but I never heard a response from any of them.
Several years later they declared bankruptcy. I contacted their lawyer who informed me that only debts incurred within the last 6 months were perusable, and the money they owed me was not be perusable. Sigh. They are still in business now several years after the bankruptcy restructuring but on a skeleton crew. I don't believe I have any ability to pursue the money for the project now.
The whole ordeal was incredibly frustrating. It actually really saddens me as I LOVED that job and my coworkers there.
Re: About rel=noopener
#100Earlier quoted context omitted.
It's a complicated situation. They owe me a bit of money and don't reply to any of my emails.
Can't you sue them then? Or at the least threaten to sue?
If you see my story which I commented on a different post in the hierarchy, it's VERY complicated.