About rel=noopener • Hacker News Board

Re: About rel=noopener

#111

Post by bzbarsky » Sun, Apr 24, 2016, 10:19 PM UTC

homakov wrote: post #109

bzbarsky wrote: post #106

Earlier quoted context omitted.

What makes you think this is unlikely? On the contrary, I think it's _very_ likely there are things depending on it. I don't expect there to be a huge number of them, but I also expect them to disproportionately be in things like intranet deployments where it's hard to even get measurements. :(

A link with _blank + expected to change/interact with opener? Maybe there's a few, but most cross domain transports would use window.open() manually.

Well, window.open() obviously has the same problem, with the same solution being proposed: the caller of window.open opts in to not allow the thing being opened to interact with it.

We could have different default behaviors for the two cases, of course: opt-in for links and opt-out for window.open.

But I still suspect that even just the link case is not as uncommon as one might wish. Happy to see data proving me wrong, though!

Re: About rel=noopener

#112

Post by __debug__ » Mon, Apr 25, 2016, 4:25 AM UTC

stormbrew wrote: post #26

> Note that this also works when index.html and malicious.html are on different origins — window.opener.location is accessible across origins! ... Why. Why would anyone (not maliciously) consider this desirable behaviour?

Agreed. And while rel=noopener works in newer browsers (Chrome 49, Opera 36), I've previously found a need to patch this behavior across the board. Here's a little library I wrote: https://github.com/danielstjules/blankshield I also highlight the impact of "reverse tabnabbing" here: http://danielstjules.github.io/blankshield/

Re: About rel=noopener

#113

Post by stormbrew » Mon, Apr 25, 2016, 6:04 AM UTC

bzbarsky wrote: post #110

stormbrew wrote: post #107

Earlier quoted context omitted.

If that relationship weren't clear you wouldn't have a window. opener attribute to begin with. That said, I'm also skeptical of legitimate uses for controlling the location of another top level window as well, so I'm fine with killing that option too. Of course, I don't expect them to actually fix this, but I'm still waiting for a convincing argument that it should have been that way in the first place.

My point was that window.opener can be nulled out. > I'm also skeptical of legitimate uses for controlling the location of another top level window as well Happens all the time: open a popup, then navigate it to places. Not on web pages much nowadays, though it was more common in the past, but in various intranet apps? All the time.

I'm sure it can. That does not mean the browser needs to forget it. The parent/child relationship of browser windows is not some massive technological feat.

That something is used does not mean it is legitimate. I am not disputing that it is used. I am not saying I think they'll fix it. I am questioning the validity of the decision to allow it in the first place. I have no doubt that other means would be found to achieve the same end goals if it were not available.

Re: About rel=noopener

#114

Post by lsaferite » Mon, Apr 25, 2016, 11:51 AM UTC

donatj wrote: post #99

lsaferite wrote: post #84

Earlier quoted context omitted.

For future reference, IP transfer on final payment.

It's quite complicated really. I had been their lead developer, having worked my way up over a five year period with the company. My leaving was very cordial. I had been there a long time and they understood me wanting to grow. I started a project on the side for them almost immediately after I left because I knew they needed help. I had a medical emergency (my tonsils swelled to the point where I could not breathe)…

Sorry to hear you had a rough time at it. My original point still stands though. Transfer of code is fine, but if the contract stipulate that IP rights are transferred upon final payment then you have the copyright stick to wield in your fight for payment as they don't actually have a valid license for the software. Obviously I am not a lawyer and you should pay one to draft a generic contract you can use for contract work.

Re: About rel=noopener

#115

Post by bzbarsky » Mon, Apr 25, 2016, 5:52 PM UTC

stormbrew wrote: post #113

bzbarsky wrote: post #110

Earlier quoted context omitted.

My point was that window.opener can be nulled out. > I'm also skeptical of legitimate uses for controlling the location of another top level window as well Happens all the time: open a popup, then navigate it to places. Not on web pages much nowadays, though it was more common in the past, but in various intranet apps? All the time.

I'm sure it can. That does not mean the browser needs to forget it. The parent/child relationship of browser windows is not some massive technological feat. That something is used does not mean it is legitimate. I am not disputing that it is used. I am not saying I think they'll fix it. I am questioning the validity of the decision to allow it in the first place. I have no doubt that other means would be found to ach…

> That something is used does not mean it is legitimate.

While I agree, in practice what this means is that either all browsers need to coordinate rollout precisely (and even then the result will be that many users just stay on insecure versions of browsers instead of updating) or you will have pages (or employers) telling users to switch to whatever browser lags in rolling this out.

We've seen this play out before. The result is that you end up with users picking whichever browser defects (which reduces the incentive for other browsers to do this) or being stuck on the equivalent of IE6.

The benefit of changes that do NOT break compat is that browsers can just roll them out without needing to worry about the above side-effects.