Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removing XSLT for a more secure browser

developer.chrome.com

Post reply on HN
Print view View original

31–40 of 352 posts

Re: Removing XSLT for a more secure browser

#31

Post by righthand »

dfabulich wrote: post #12
righthand wrote: post #2

Destroying the open web instead of advocating to fix one of the better underutilized browser technologies for a more Profitable Google. I will not forget the name Mason Freed, destroyer of open collaborative technology.

Blame Apple and Mozilla, too, then. They all agreed to remove it. They all agreed because XSLT is extremely unpopular and worse than JS in every way. Performance/bloat? Worse. Security? MUCH worse. Language design? Unimaginably worse. EDIT: I wrote thousands of lines of XSLT circa 2005. I'm grateful that I'll never do that again.

They did not agree to remove it. This is a spun lie from the public posts I can see. They agreed to explore removing it but preferred to keep it for good reasons.

Only Google is pushing forward and twisting that message.

Re: Removing XSLT for a more secure browser

#32

Post by phendrenad2 »

Unquestionably the right move. From the various posts on HN about this, it's clear that (A) not many people use it (B) it increases security vulnerability surface area (C) the few people who do claim to use have nothing to back up the claim

The major downside to removing this seems to be that a lot of people LIKE it. But eh, you're welcome to fork Chromium or Firefox.

Re: Removing XSLT for a more secure browser

#33

Post by rhdunn »

sherinjosephroy wrote: post #18

Nice find — interesting to see browsers moving to drop XSLT support. I used XSLT once for a tiny site and it felt like magic—templating without JavaScript was freeing. But maybe it’s just niche now, and browser vendors see more cost than payoff. Curious: have any of you used XSLT in production lately?

Yes. It's used heavily in the publishing and standards industries that store the documents in JATS and other XML-based formats.

Because browsers only support XSLT 1.0 the transform to HTML is typically done server side to take advantage of XSLT 2.0 and 3.0 features.

It's also used by the US government:

1. https://www.govinfo.gov/bulkdata/BILLS

2. https://www.govinfo.gov/bulkdata/FR/resources

Re: Removing XSLT for a more secure browser

#34

Post by larusso »

Makes me kind of sad. I started my carrier back in days when XHTML and co were lauded as the next thing. I worked with SOAP and WDSLs. I loved that one can express nearly everything in XML. And namespaces… Then came json and apart from being easier to read for humans I wondered why we switch from this one great exchange format to this half baked one. But maybe I’m just nostalgic. But every time I deal with json parsers for type serialization and the question how to express HashMaps and sets, how to provide type information etc etc I think back to XML and the way that everything was available on board. Looked ugly as hell though :)

Re: Removing XSLT for a more secure browser

#35

Post by TingPing »

righthand wrote: post #28
sangeeth96 wrote: post #13

To those who saw a chrome.com link and got triggered: > The Firefox[^0] and WebKit[^1] projects have also indicated plans to remove XSLT from their browser engines. [^0]: https://github.com/mozilla/standards-positions/issues/1287#i... [^1]: https://github.com/whatwg/html/issues/11523#issuecomment-314...

In my opinion this is not “we agree lets remove it”. This is “we agree to explore the idea”. Google and Freed using this as a go ahead because the Mozilla guy pasted a pollyfill. However it is very clearly NOT an endorsement to remove it, even though bad actors are stating so. > Our position is that it would be good for the long-term health of the web platform and good for user security to remove XSLT, and we support…

Last I heard for WebKit removing it was the only outcome they saw.

Re: Removing XSLT for a more secure browser

#36

Post by cxr »

dfabulich wrote: post #12
righthand wrote: post #2

Destroying the open web instead of advocating to fix one of the better underutilized browser technologies for a more Profitable Google. I will not forget the name Mason Freed, destroyer of open collaborative technology.

Blame Apple and Mozilla, too, then. They all agreed to remove it. They all agreed because XSLT is extremely unpopular and worse than JS in every way. Performance/bloat? Worse. Security? MUCH worse. Language design? Unimaginably worse. EDIT: I wrote thousands of lines of XSLT circa 2005. I'm grateful that I'll never do that again.

> They all agreed to remove it.

All those people suck, too.

Were you counting on a different response?

> XSLT is extremely unpopular and worse than JS in every way

This isn't a quorum of folks torpedoing a proposed standard. This is a decades-old stable spec and an established part of the Web platform, and welching on their end of the deal will break things, contra "Don't break the Web".

Re: Removing XSLT for a more secure browser

#37

Post by righthand »

TingPing wrote: post #35
righthand wrote: post #28

Earlier quoted context omitted.

In my opinion this is not “we agree lets remove it”. This is “we agree to explore the idea”. Google and Freed using this as a go ahead because the Mozilla guy pasted a pollyfill. However it is very clearly NOT an endorsement to remove it, even though bad actors are stating so. > Our position is that it would be good for the long-term health of the web platform and good for user security to remove XSLT, and we support…

Last I heard for WebKit removing it was the only outcome they saw.

Yeah all these billion dollar corporations that can’t be bothered see it as the only path forward not because of technological or practical issues, but because none of them can be asked to give a shit and plan it into their budgets.

They’re MBAs who only know how to destroy and consolidate as trained.

Re: Removing XSLT for a more secure browser

#38

Post by gdulli »

I don't use XSLT and don't object to this, but seeing "security" cited made me realize how reflexively distrustful I've become of them using that justification for a given decision. Is this one actually about security? Who knows!

Re: Removing XSLT for a more secure browser

#39

Post by nolok »

socalgal2 wrote: post #6

Good, XSLT was crap. I wrote an RSS feed XSLT template. Worst dev experience ever. No one is/was using XSLT. Removing unused code is a win for browsers. Every anti bloat HNer should be cheering

> No one is/was using XSLT.

Ah, when ignorance leads to arrogance; It is massively utilised by many large entreprise or state administration in some countries.

Eg if you're american the library of congress uses it to show all legislative text.

Post reply on HN