Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome breaks the Web

tonsky.me

Post reply on HN
Print view View original

341–350 of 473 posts

Re: Chrome breaks the Web

#341

Post by jhasse »

jarym wrote: post #211
ko27 wrote: post #179

Earlier quoted context omitted.

> The balance needs to be somewhere It might be a controversial opinion, but I think that the balance should always lean closer to the user's side, not developer's.

I agree with you on 'lean'. But say I'm building a web-app that accesses medical records and I don't want sensitive fields being auto-completed by a browser. Forcing autocomplete in this instance does a dis-service to both users and developers.

Why not? The user knows that the browser remembers field inputs, he wouldnt expect it to be different for your website. So if he really wanted the browser not to remember anything he typed in, he would use private mode or clear his recent history afterwards.

Because then there's the teacher who has to put in medical data for a whole class where everyone got the flu. The teacher is happy the browser does it job like always and that you couldn't dictate what is best for him.

Re: Chrome breaks the Web

#342

Post by user5994461 »

linza wrote: post #112
bluGill wrote: post #89

Earlier quoted context omitted.

You don't necessarily have to convince IT. If you instead convince their legal department that by not following the NIST standards for passwords they are opening their company to a lawsuit, that could get results a lot faster. When IT is convinced they have to decide when to put it into the budget. If they think their policy is not okay, just not perfect the fix will probably be buried in the bottom of the budget pil…

Not all websites are operated by US companies. Would that still work for, say UBS (a big bank) in Switzerland?

NIST is recognized worldwide in a similar vein to the IEEE, IETF or ISO. It's a regulation organization important enough to get to move banks, large companies and outsourcing firms.

A recommendation won't allow you to sue a company contrary to what the other commenters seem to think, but it's enough for any internal employee who works on something to call for and justify a change.

Re: Chrome breaks the Web

#343

Post by chris_wot »

CydeWeys wrote: post #110
mcv wrote: post #67

Earlier quoted context omitted.

So the question becomes what's less bad: for website developers to break their own site, or for Chrome to break other people's site. I'm all for empowering browsers to override abusive behaviour from websites, but using bad defaults and breaking innocent websites as a result is not the solution.

Chrome is a program that I run on my computer. It protects my interests, not the interests of random crappy website developers doing horrible things like hijacking clipboard events. I'm all for the defaults being whatever is best for me. The browser is the agent of the user.

So it's best to autocomplete bits that shouldn't autocomplete? You've got an interesting idea about protection of end user interests...

Re: Chrome breaks the Web

#344

Post by user5994461 »

sinxoveretothex wrote: post #92
cmurf wrote: post #62

Earlier quoted context omitted.

The market should sort it out is deeply naive wishful thinking. Numerous sites block copy/paste, block password managers from functioning well, still have password rules from the Pleistocene let alone the most recent NIST recommendations. And those companies are worth more today than 10 years ago. So no, it really doesn't get sorted out. To the market, this is a detail it simply doesn't care about.

Because it is a detail virtually nobody cares about. How insane would the password rules have to be for anyone to travel 1 hour more to go to a different university? How insane for them to stop playing a given video game? To change banking institutions? I don't have the answer for others, but for me, the answer to all of those is "pretty insane". Except for the banking case, password security is a minor concern (and…

Banking institutions follow the NIST regulations, they are already changing.

Re: Chrome breaks the Web

#345

Post by user5994461 »

agentultra wrote: post #268
danaliv wrote: post #241

Earlier quoted context omitted.

> Regulatory compliance. > there are plenty of regulations in certain setting that require us to disallow client applications from auto-filling form fields. And which regulations would those be, specifically?

If I recall in Part 11 compliance (which is how the FDA regulates software in the US) one is required to ensure that "Passwords are not remembered by [browsers] and applications." From an ISO/IEC/IEEE 29148 perspective the language might be "shall not remember passwords" which would imply a legally binding requirement for compliance purposes. This doesn't preclude applications from using autocomplete on form entry fr…

Good thing that the NIST published updated recommendation on passwords, it supersedes all these previous regulations.

Re: Chrome breaks the Web

#346

Post by robryan »

comatose wrote: post #340
nashashmi wrote: post #326

Earlier quoted context omitted.

Adblock is opt-in. If the browser misbehaves because of an extension, the browser nor website is to be blamed. Chrome cannot decide on a whim that old websites should be broken. It is not how the web moves forward. Take for example Firefox that kept breaking extensions with every update, now they have few compatible extensions.

it's a little reductio ad absurdum but what about defaulting to popup blocking? blink? marquee? It's not the same thing but maybe worth considering when defending web author's intent being ignored.

At least popup blocking has an opt out if you need it.

Re: Chrome breaks the Web

#347

Post by fiatjaf »

The highlighted comments from the Google agent are very jerkish, but to be honest,

    > But in Chrome we’re fundamentally unwilling to allow the mobile web to continue to die from performance bankruptcy. Other browsers are less aggressive, and people who prefer to be more conservative (preferring maximal compatibility over being part of moving the web forward aggressively) should prefer to use a more conservative browser.
is very true.

The mobile web is dying. Native apps are obscuring it while it is made irrelevant by very poor website performance.

Now I don't know how to solve it.

Re: Chrome breaks the Web

#348

Post by magicalist »

laumars wrote: post #319
hinkley wrote: post #296

Earlier quoted context omitted.

If we don’t want to repeat the 90’s we have to complain a lot sooner. If your litmus test is “as bad as Microsoft” then that’s exactly what we will get.

> If we don’t want to repeat the 90’s we have to complain a lot sooner. Complaining wouldn't change anything. Corporations don't change their policies because a few nerds moan on a few message boards. > If your litmus test is “as bad as Microsoft” then that’s exactly what we will get. It wasn't my litmus test. I feel you're missing my point because others are making that comparison and I'm saying the two don't compar…

FWIW, only the second bullet point applies here

> both are a free product that locks users into the company's revenue stream (ads in AMP for Google, Windows for MS)

Ads on AMP sites don't have to be from google

> both onboarded developers with promises to better user experience while locking them into a non-standard platform.

AMP, while a particular subset of HTML/JS, is still just a subset, aka part of the standard platform and can run in any browser. Calling it non-standard would be like calling it non-standard to use React. It's just a library/framework.

Re: Chrome breaks the Web

#349

Post by robryk »

will_hughes wrote: post #338
CydeWeys wrote: post #110

Earlier quoted context omitted.

Chrome is a program that I run on my computer. It protects my interests, not the interests of random crappy website developers doing horrible things like hijacking clipboard events. I'm all for the defaults being whatever is best for me. The browser is the agent of the user.

That's certainly one view of the world. Come work tech support for a company/product with a web-based form that has a password field in it (like a CRM or other administrative system). Now explain to users why we can't stop their browser filling in their password in the field that's asking for the other user's password. I've had situations where I'm configuring a VPN connection on the web interface for a router... the…

> asking for the other user's password

What? Why would the other user ever provide their password to this user?

Re: Chrome breaks the Web

#350

Post by zlynx »

optimuspaul wrote: post #11
Sir_Cmpwn wrote: post #4

I side with Google on this one. IMO we should be breaking JavaScript more often, especially in the name of performance, to make people use less JS and simpler JS on their websites.

except now I encounter broken sites all the time because Chrome is not my preferred browser. I think google is in the wrong and doing everyone a disservice. This is a step backwards.

I generally use Firefox myself. What I think is hilarious is that a lot of sites are half-broken by my NoScript settings, but I never realized they had a preference for Chrome because that code doesn't even run.
Post reply on HN