Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Would you build a pure client-side JavaScript App using Pageforest?

pageforest.com

Post reply on HN
Print view View original

31–40 of 43 posts

Re: Would you build a pure client-side JavaScript App using Pageforest?

#31

Post by drcode »

ktsmith wrote: post #29
drcode wrote: post #23

Earlier quoted context omitted.

For your survey app example, why can't you just allow the client to submit bogus data if they want, then filter out the junk when you collect the data for reporting at the end? (This is assuming that the pageforest server doesn't implode when someone does this, but I see no reason to assume this would happen from a theoretical standpoint.) For you second example, why the heck would you run javascript eval on the docu…

Why in the world would I want to collect garbage. Sure I can post process all of the survey data but it's trivial to do it on the front end so why not. In a significant number of other cases failing to validate input would simply be a non starter limiting this to toy apps. As to the second point: Who said anything about _me_ running a javascript eval on user supplied data. Go look at their wiki example click edit and…

You're absolutely right on the alert issue in the wiki: Displaying unsanitized text in this way is a security bug. However, I think the security bug is in the client app, which should sanitize any data it pulls from the server, if the server data may have originated from another user (if this is even possible in the current pageforest API) not in the inherent design of pageforest.

But that is indeed a good argument in your favor, ktsmith.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#32

Post by ktsmith »

mckoss wrote: post #24
ktsmith wrote: post #18

Earlier quoted context omitted.

Thanks for the answer, but my question isn't about user authentication/validation but validation of input from the user into my application. A simple example, I set up a survey app. Several of the questions contain user input in the form of dates or numbers such as, date of birth, number of years living in the united states, years employed, etc. To help weed out bogus answers I want the fields to be validated/filtere…

It is true that you'd need to write your app so that you either segregate user's input (the only one reading a document is the original user who created it), or sanitize user-entered data in the client before displaying it. I think this is pretty analogous to the traditional client/server model. The only difference is it all happens in the client. There ARE cases where you need to aggregate data from multiple users,…

Thanks for the quick replies. Given the additional information I can better answer your original question in the post of "would I use this." Due to the lack of a trusted agent anywhere in the stack I don't have any use cases that fit your model and so no I couldn't use it. Maybe a single player game or other toy. For the work that I typically do accessibility is also a huge factor and javascript can only be used for progressive enhancement so I couldn't create a 100% client side javascript application anyway.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#33

Post by mckoss »

ktsmith wrote: post #29
drcode wrote: post #23

Earlier quoted context omitted.

For your survey app example, why can't you just allow the client to submit bogus data if they want, then filter out the junk when you collect the data for reporting at the end? (This is assuming that the pageforest server doesn't implode when someone does this, but I see no reason to assume this would happen from a theoretical standpoint.) For you second example, why the heck would you run javascript eval on the docu…

Why in the world would I want to collect garbage. Sure I can post process all of the survey data but it's trivial to do it on the front end so why not. In a significant number of other cases failing to validate input would simply be a non starter limiting this to toy apps. As to the second point: Who said anything about _me_ running a javascript eval on user supplied data. Go look at their wiki example click edit and…

Yes - this app is not a good example of doing this "right" (my bad). It should instead sanitize the input before displaying it (especially to another user).

Re: Would you build a pure client-side JavaScript App using Pageforest?

#34

Post by ktsmith »

mckoss wrote: post #24
ktsmith wrote: post #18

Earlier quoted context omitted.

Thanks for the answer, but my question isn't about user authentication/validation but validation of input from the user into my application. A simple example, I set up a survey app. Several of the questions contain user input in the form of dates or numbers such as, date of birth, number of years living in the united states, years employed, etc. To help weed out bogus answers I want the fields to be validated/filtere…

It is true that you'd need to write your app so that you either segregate user's input (the only one reading a document is the original user who created it), or sanitize user-entered data in the client before displaying it. I think this is pretty analogous to the traditional client/server model. The only difference is it all happens in the client. There ARE cases where you need to aggregate data from multiple users,…

One other small note. I don't see where document management is handled. I see the document listing and can get back and forth between documents I've created, but I don't see any way to delete those documents.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#35

Post by ktsmith »

mckoss wrote: post #33
ktsmith wrote: post #29

Earlier quoted context omitted.

Why in the world would I want to collect garbage. Sure I can post process all of the survey data but it's trivial to do it on the front end so why not. In a significant number of other cases failing to validate input would simply be a non starter limiting this to toy apps. As to the second point: Who said anything about _me_ running a javascript eval on user supplied data. Go look at their wiki example click edit and…

Yes - this app is not a good example of doing this "right" (my bad). It should instead sanitize the input before displaying it (especially to another user).

I wasn't trying to pick on your wiki app, it was just a readily available example where input/output sanitization wasn't happening. I'm not sure what your target demographic is, but I would be surprised if this wasn't a very common problem that your potential users encounter. One of the advantages of many of the server side frameworks is that they provide this type of sanitization for free.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#36

Post by mckoss »

ktsmith wrote: post #35
mckoss wrote: post #33

Earlier quoted context omitted.

Yes - this app is not a good example of doing this "right" (my bad). It should instead sanitize the input before displaying it (especially to another user).

I wasn't trying to pick on your wiki app, it was just a readily available example where input/output sanitization wasn't happening. I'm not sure what your target demographic is, but I would be surprised if this wasn't a very common problem that your potential users encounter. One of the advantages of many of the server side frameworks is that they provide this type of sanitization for free.

Yeah. In this app I used the (very nice) ShownDown.js as a MarkDown format generator. Which DOES properly sanitize most input. I then added the special evaluation stuff as a cool "hack".

As client-side JavaScript gets more mature, I do expect there to be more frameworks that will just "do the right thing" for developers who write code like this.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#37

Post by mckoss »

ktsmith wrote: post #32
mckoss wrote: post #24

Earlier quoted context omitted.

It is true that you'd need to write your app so that you either segregate user's input (the only one reading a document is the original user who created it), or sanitize user-entered data in the client before displaying it. I think this is pretty analogous to the traditional client/server model. The only difference is it all happens in the client. There ARE cases where you need to aggregate data from multiple users,…

Thanks for the quick replies. Given the additional information I can better answer your original question in the post of "would I use this." Due to the lack of a trusted agent anywhere in the stack I don't have any use cases that fit your model and so no I couldn't use it. Maybe a single player game or other toy. For the work that I typically do accessibility is also a huge factor and javascript can only be used for…

Thanks so much for the thoughtful feedback.

BTW, can you explain why you can't do page rendering in JavaScript for accessibility? Is there reason screen readers can deal with dynamically generated HTML?

Re: Would you build a pure client-side JavaScript App using Pageforest?

#38

Post by mckoss »

ktsmith wrote: post #34
mckoss wrote: post #24

Earlier quoted context omitted.

It is true that you'd need to write your app so that you either segregate user's input (the only one reading a document is the original user who created it), or sanitize user-entered data in the client before displaying it. I think this is pretty analogous to the traditional client/server model. The only difference is it all happens in the client. There ARE cases where you need to aggregate data from multiple users,…

One other small note. I don't see where document management is handled. I see the document listing and can get back and forth between documents I've created, but I don't see any way to delete those documents.

TBD feature...

Re: Would you build a pure client-side JavaScript App using Pageforest?

#39

Post by ktsmith »

mckoss wrote: post #36
ktsmith wrote: post #35

Earlier quoted context omitted.

I wasn't trying to pick on your wiki app, it was just a readily available example where input/output sanitization wasn't happening. I'm not sure what your target demographic is, but I would be surprised if this wasn't a very common problem that your potential users encounter. One of the advantages of many of the server side frameworks is that they provide this type of sanitization for free.

Yeah. In this app I used the (very nice) ShownDown.js as a MarkDown format generator. Which DOES properly sanitize most input. I then added the special evaluation stuff as a cool "hack". As client-side JavaScript gets more mature, I do expect there to be more frameworks that will just "do the right thing" for developers who write code like this.

Maybe your app could be the launching point for one of those frameworks as well, it might be a nice value added feature.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#40

Post by ktsmith »

mckoss wrote: post #37
ktsmith wrote: post #32

Earlier quoted context omitted.

Thanks for the quick replies. Given the additional information I can better answer your original question in the post of "would I use this." Due to the lack of a trusted agent anywhere in the stack I don't have any use cases that fit your model and so no I couldn't use it. Maybe a single player game or other toy. For the work that I typically do accessibility is also a huge factor and javascript can only be used for…

Thanks so much for the thoughtful feedback. BTW, can you explain why you can't do page rendering in JavaScript for accessibility? Is there reason screen readers can deal with dynamically generated HTML?

It's not that page rendering can't be done with JavaScript and still be accessible. My experience with it via testing is that due to the large number of screen readers, and then differences within versions of the even the most common screen readers (JAWS for example) is that you can't really expect a consistent experience for your users where you get much more consistency with vanilla HTML. The single largest complaint we received while testing with screen readers on our latest app was related to how the user was informed by their software about dynamically changed content, something I have no control over. The compromise that we implemented was to try to detect screen readers and offer to disable all JavaScript content since the site was designed to degrade gracefully anyway.

This is going to be less of a problem for some companies than others, I just happen to be working on software that's designed to help HR departments with their hiring process and specifically with the accurate completion of certain federal forms. Getting complaints about violating the ADA could lead to lawsuits against my employer or our clients. Similar to the complaints that Google is receiving about accessibility problems in Google Apps and specifically gmail.

Here's a pretty good survey that has some more information if you are interested in the topic: http://webaim.org/projects/screenreadersurvey2/

Post reply on HN