Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CSS is powerful, you can do a lot of things without JS

github.com

Post reply on HN
Print view View original

151–160 of 319 posts

Re: CSS is powerful, you can do a lot of things without JS

#151

Post by vroombaprime »

code_research wrote: post #86

I am missing one important argument in this discussion: CSS only design is an important piece of a future web with reduced security and privacy threads. The (interesting) model of allowing remote code execution per default was a beautiful, but naive vision. We have to make big advances in technology, politics and society to make this model work in a way that does not make internet users victims by default. We are not…

Browsers/webapps have only become this crazily successful because they allow seamless delivery of applications to run locally. I haven't seen anything to build "code-less" apps that can implement the complex features people want and isn't a complete nightmare to build and maintain. Until then everything you're talking about is just a pipe dream.

You can still make the apps you're talking about with html+css and enforce js=off in your user browsers, but there is a reason no one wants to do that these days.

And unless I'm not mistaken, there have been plenty of exploitable bugs in the core rendering engines that involve only html/css, so your utopian world STILL depends on a secure sandbox.

Re: CSS is powerful, you can do a lot of things without JS

#152

Post by lloyd-christmas »

kyriakos wrote: post #84
malydok wrote: post #78

Earlier quoted context omitted.

If you properly modularize your CSS the global scope no longer remains a concern.

the thing is that we don't always start working on sites from scratch. more often I have to clean up someone else's mess or my own that I made months or years ago. in that case I'd rather debug javascript than css.

Yeah, I think it's a lot easier to fix shitty JS than it is to fix shitty CSS. Every job I've had, I've fixed more than I build. If it's a 5 person startup, I'm iteratively fixing my own shit as the product pivots. If it's 30 people, I'm fixing code from that one idiot that interviewed well and turned out to be impressively terrible. If it's a 10,000 person company, I'm fixing shit from that entire division that wasn't properly managed.

Re: CSS is powerful, you can do a lot of things without JS

#154

Post by Jweb_Guru »

rtpg wrote: post #138
code_research wrote: post #100

Earlier quoted context omitted.

"remote-execution-by-default": web browsers execute code that was loaded from an untrusted source somewhere on the internet. Every (ok, most) browsers by default allow any website you visit to execute JavaScript code in your browser. "same origin" is about the source of that code, only of minor relevance here as long as no working signed code distribution mechanism and infrastructure exists - why not, btw, after all…

> the "sandboxing" approach has been exercised for many years now, mostly without success. My impression is that Javascript has basically been the most successful sandbox ever deployed on a large scale. All vulnerabilities I've seen that escape the sandbox are due to things like Flash. Does anybody know of any "JS-only" exploits that have happened?

Tons of JS-only exploits have happened. Every year at PwnToOwn, JS-only exploits happen.

Re: CSS is powerful, you can do a lot of things without JS

#155

Post by the_gastropod »

cptskippy wrote: post #143
achairapart wrote: post #54

Most of these are just clever CSS hacks. There is a website collecting these kind of experiments since the early '00: http://www.cssplay.co.uk/ There was a time when separation of concerns and the "Rule of Least Power"[0] where the foundation principles of web development. Today you have preprocessors, postprocessors, transpilers, content and style in JavaScript, behavior in CSS. Very powerful tools that can easily l…

> Ah! Also, nobody cares about unobtrusive JavaScript anymore. I do. I also care about graceful degradation. There are certain times (e.g. Web Apps like Gmail) where graceful degradation is almost impossible and unobtrusive JavaScript would be silly but those are the exception. Most sites on the web are just content and there's no reason to have excessive JavaScript or any reason why the page can't be perfectly funct…

I often hear rationalizations about how x couldn't be built with graceful degradation in mind. There certainly are _some_ examples (games, for example). But GMail doesn't strike me as a particularly compelling example. GMail is also _just content_. The fancy ajax interactions, though nice, are hardly required for an email client.

Re: CSS is powerful, you can do a lot of things without JS

#156

Post by zeveb »

harryf wrote: post #81
achairapart wrote: post #54

Most of these are just clever CSS hacks. There is a website collecting these kind of experiments since the early '00: http://www.cssplay.co.uk/ There was a time when separation of concerns and the "Rule of Least Power"[0] where the foundation principles of web development. Today you have preprocessors, postprocessors, transpilers, content and style in JavaScript, behavior in CSS. Very powerful tools that can easily l…

Hmmm... .accordion .content { padding:0 10px; overflow:hidden; border:1px solid #fff; -webkit-transition: all .5s ease-out; -moz-transition: all .5s ease-out; } -webkit-transition, -moz-transition... it's like we're at 180 degrees to where the web was in the days of IE4-6

I think we learned from X- headers and x- media types that vendor prefixes are a mistake: inevitably one must support vendor-prefixed keys forever. That's why that practice is no longer recommended: just use the right key, and specify it properly so others may support it as well.

Re: CSS is powerful, you can do a lot of things without JS

#157

Post by ZanyProgrammer »

JoeAltmaier wrote: post #150
inanutshellus wrote: post #148

Earlier quoted context omitted.

My current-favorite problem with modern web development is mobile-specific redirection. e.g. you click a link in your email and it takes you to "www.foo.com/somethingWithParametersAndImportantStuff", foo.com detects you're on a phone and redirects you to their mobile homepage at "m.foo.com", blowing away your URL or even better not supporting your particular URL's page in the mobile site... where... your mobile brows…

Digression: 'clicking on a link' may become an obscure reference soon, like dialing a phone. How many young people ever use a mouse?

Any young person ( please define) who has ever used a desktop computer?

Re: CSS is powerful, you can do a lot of things without JS

#158

Post by afarrell »

the_gastropod wrote: post #155
cptskippy wrote: post #143

Earlier quoted context omitted.

> Ah! Also, nobody cares about unobtrusive JavaScript anymore. I do. I also care about graceful degradation. There are certain times (e.g. Web Apps like Gmail) where graceful degradation is almost impossible and unobtrusive JavaScript would be silly but those are the exception. Most sites on the web are just content and there's no reason to have excessive JavaScript or any reason why the page can't be perfectly funct…

I often hear rationalizations about how x couldn't be built with graceful degradation in mind. There certainly are _some_ examples (games, for example). But GMail doesn't strike me as a particularly compelling example. GMail is also _just content_. The fancy ajax interactions, though nice, are hardly required for an email client.

I think doing what they do, having a less-fancy separate client, is less complex.

Re: CSS is powerful, you can do a lot of things without JS

#159

Post by afarrell »

zuxfer wrote: post #103

And here I am, trying for past 10 years to centre align a div, both horizontally and vertically.

Yea, I share your pain. However, for this specific problem, you are best off using flexbox because there is a good tutorial for it: http://flexboxfroggy.com/

Re: CSS is powerful, you can do a lot of things without JS

#160

Post by zeveb »

rtpg wrote: post #138
code_research wrote: post #100

Earlier quoted context omitted.

"remote-execution-by-default": web browsers execute code that was loaded from an untrusted source somewhere on the internet. Every (ok, most) browsers by default allow any website you visit to execute JavaScript code in your browser. "same origin" is about the source of that code, only of minor relevance here as long as no working signed code distribution mechanism and infrastructure exists - why not, btw, after all…

> the "sandboxing" approach has been exercised for many years now, mostly without success. My impression is that Javascript has basically been the most successful sandbox ever deployed on a large scale. All vulnerabilities I've seen that escape the sandbox are due to things like Flash. Does anybody know of any "JS-only" exploits that have happened?

> Does anybody know of any "JS-only" exploits that have happened?

This was used to win a contest: https://securityevaluators.com/knowledge/papers/engineeringh...

Then there's this: http://arstechnica.com/security/2015/08/dram-bitflipping-exp...

And this looks to execute some shellcode (but maybe it doesn't work): http://stackoverflow.com/questions/381171/help-me-understand...

Regardless, the bottom line is clear: if you value security and privacy, you disable JavaScript.

Post reply on HN