Ask HN: Why do browsers still support pop up dialogs and other bad behavior? • Hacker News Board

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#51

Post by robbrown451 » Sat, May 21, 2016, 9:32 PM UTC

twshoopboop wrote: post #11

BjoernKW wrote: post #2

Quite simply because browsers are not just used for websites but as an application platform as well. Depending on the design and the requirements of an application modal dialogues and in rare cases even disabling leaving via the back button absolutely make sense. It might not amount to good UX practices but it's not malware or a dark pattern either. Besides, if at all possible most browser vendors try to be backward…

>Depending on the design and the requirements of an application modal dialogues and in rare cases even disabling leaving via the back button absolutely make sense. Sorry, I disagree with you. On a typical non-web application, a modal dialog doesn't prevent me from accessing other applications. It doesn't prevent me from forcefully killing crapware either. The idea that web applications should be able to break user ex…

I'm not sure I agree that no one should be able to disable the back button, but....there should be a user option to override it. A "no really I mean it I want to GTF off of this page now" button or option.

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#52

Post by mavhc » Sat, May 21, 2016, 10:01 PM UTC

JohnTHaller wrote: post #9

> There are also sites that will kill your page history by going through a bunch of redirects to prevent you from leaving with the back button. It's 2016 and Microsoft is incapable of creating a reliable cross-site login system. Instead, we still have the disastrous mess that is live.com. Minimum 2 redirects - at least 1 of which is Javascript (seriously?) - to handle a simple login. And when your cookies go a bit wo…

And if you're in some half logged in state it'll try to log you in to read public documentation, fail, and tell me a kb article is 404. I just use incognito mode, but have to go back to the google search first, as the new url is also broken. I swear they do stuff to make Chrome screw up, used to be that MS support pages didn't scroll properly in other browsers.

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#53

Post by joshuak » Sat, May 21, 2016, 10:12 PM UTC

sklogic wrote: post #44

Why only web? Modal dialogs should be forbidden everywhere.

Oh god yes! Worst invention EVER.

Modal dialogue boxes are for lazy programming not for UI. Almost nothing in real life is modal. Don't break a user's flow! We just built a full application platform (i.e. dev kit, apps, application environment, etc.) and nothing is model, not one thing. Errors are added to a notification list that a user can look at at any time. Data merge conflicts are resolved via automatic default branching that the user can override later. Data is copy on write, and versions are retained. Login is handled with PKI.

Modal is forbidden on our platform period. If an app breaks this some how and finds a way to hack a modal event, we will treat this as a DOS attack and remove the app and ban the developer. We believe the user is the final authority, not the programmer, or the platform.

(obviously this is a bit of a pet peeve for me)

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#54

Post by Confiks » Sat, May 21, 2016, 10:25 PM UTC

aaronharnly wrote: post #38

JohnTHaller wrote: post #9

> There are also sites that will kill your page history by going through a bunch of redirects to prevent you from leaving with the back button. It's 2016 and Microsoft is incapable of creating a reliable cross-site login system. Instead, we still have the disastrous mess that is live.com. Minimum 2 redirects - at least 1 of which is Javascript (seriously?) - to handle a simple login. And when your cookies go a bit wo…

Meanwhile, Google authentication -- which begins at accounts.google.com -- often bounces through appengine.google.com, accounts.youtube.com, and other domains. Making apps for schools, it can be a bit dodgy explaining that the school needs to whitelist a YouTube url in order to use Google SSO.

Yes, I have always wondered why this happens the way it does. I haven't experiences being redirected through them, but it seems that on logon one is being randomly selected. They all are in the same 216.58.212.* subnet (now and here) but each have distinct IP-pairs.

Might it be some attempt to disspel censorship, such as the scenario you're describing?

On a slightly related note, I really hate that we Internet Citizens are convicted to using plaintext server name indication.

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#55

Post by userbinator » Sat, May 21, 2016, 11:09 PM UTC

JohnTHaller wrote: post #9

> There are also sites that will kill your page history by going through a bunch of redirects to prevent you from leaving with the back button. It's 2016 and Microsoft is incapable of creating a reliable cross-site login system. Instead, we still have the disastrous mess that is live.com. Minimum 2 redirects - at least 1 of which is Javascript (seriously?) - to handle a simple login. And when your cookies go a bit wo…

I believe that's because they use some variant of OAuth for authentication, which necessarily involves "a bunch of redirects".

https://en.wikipedia.org/wiki/OAuth

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#56

Post by IvanK_net » Sat, May 21, 2016, 11:26 PM UTC

There are much worse things that a website can do to your computer. Website can run Javascript, which drains your CPU (drains your battery), it can use your hardware e.g. to mine bitcoins while you are reading an article.

At the end of the day, I think it is not that easy to say, what is a "bad behavior". Somebody can consider showing advertisment as a bad behavior. In many cases you can communicate with authors of a website and tell them your opinions, or stop wisiting that website (which is also a form of communication, authors will know that something is wrong when they lose visitors).

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#57

Post by morganvachon » Sun, May 22, 2016, 12:31 AM UTC

r3bl wrote: post #43

douche wrote: post #29

Earlier quoted context omitted.

Flying Spaghetti Monster help you if you have both a personal and an organizational (Office 365) Microsoft account with the same email address.

For those of you who don't know, the process basically goes like this: Input your email / password -> select if you want to use your personal or business profile -> enter your login info again (because, reasons) -> go through two redirects.

Until very recently, Comcast/Xfinity did something similar. On their landing page and logged out, one would click log in and enter their credentials, and the top bar shows you logged in. Click on the email link and you have to log in again. Click on the "My Account" link and log in again not once but twice, for a total of three logins to finally get there.

I think they fixed it about a month ago. I have my Comcast email forwarded to a real account on a domain I own so I never have to use their insane email system again, but I still have to log in to pay my bill. It's down to one login session now, but it's still a nightmare of a site to navigate.

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#58

Post by DonHopkins » Sun, May 22, 2016, 1:29 AM UTC

evmar wrote: post #15

The other answers given give the high-level view, but one technical detail to add: the semantics of alert() are that it blocks the execution of JavaScript. In old browsers that means across all tabs because that was how they were implemented. Modern browsers are capable of running separate JS contexts, but doing so breaks backwards compatibility in a corner case: if you have the same domain open in two tabs, an alert…

Since when did two different tabs opened on the same site share any JavaScript interpreter state, or block each other when showing modal dialogs?

They share cookies, sure, but that's a very different thing that JS interpreter state.

But I've never heard anything about an alert in one tab blocking the JS interpreter of another tab on the same site, as that would certainly break the principle of least astonishment. Where is that behavior documented?

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#59

Post by caylus » Sun, May 22, 2016, 1:43 AM UTC

DonHopkins wrote: post #58

evmar wrote: post #15

The other answers given give the high-level view, but one technical detail to add: the semantics of alert() are that it blocks the execution of JavaScript. In old browsers that means across all tabs because that was how they were implemented. Modern browsers are capable of running separate JS contexts, but doing so breaks backwards compatibility in a corner case: if you have the same domain open in two tabs, an alert…

Since when did two different tabs opened on the same site share any JavaScript interpreter state, or block each other when showing modal dialogs? They share cookies, sure, but that's a very different thing that JS interpreter state. But I've never heard anything about an alert in one tab blocking the JS interpreter of another tab on the same site, as that would certainly break the principle of least astonishment. Whe…

Different tabs that share an origin can get references to each other using the return value of "window.open" or the value of "window.opener". There might be other ways as well. From there all bets are off as they can execute arbitrary code on each other's global scope.

Re: Ask HN: Why do browsers still support pop up dialogs and other bad behavior?

#60

Post by libeclipse » Sun, May 22, 2016, 1:50 AM UTC

morganvachon wrote: post #57

r3bl wrote: post #43

Earlier quoted context omitted.

For those of you who don't know, the process basically goes like this: Input your email / password -> select if you want to use your personal or business profile -> enter your login info again (because, reasons) -> go through two redirects.

Until very recently, Comcast/Xfinity did something similar. On their landing page and logged out, one would click log in and enter their credentials, and the top bar shows you logged in. Click on the email link and you have to log in again. Click on the "My Account" link and log in again not once but twice, for a total of three logins to finally get there. I think they fixed it about a month ago. I have my Comcast em…

HSBC's internet banking website is complete shit too. At least 2 redirects to login, and if you change your mind, the back button breaks the site completely until you manually go to the root again.