Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removing XSLT for a more secure browser

developer.chrome.com

Post reply on HN
Print view View original

131–140 of 352 posts

Re: Removing XSLT for a more secure browser

#131

Post by SoftTalker »

logifail wrote: post #107
arandr0x wrote: post #55

It's encouraging to see browsers actually deprecate APIs, when I think a lot of problems with the Web and Web security in particular is people start using new technologies too fast but don't stop using old ones fast enough. That said, it's also pretty sad. I remember back in the 2000s writing purely XML websites with stylesheets for display, and XML+XSLT is more powerful, more rigorous, and arguably more performant n…

> I remember back in the 2000s writing purely XML websites with stylesheets for display Yup, "been there, done that" - at the time I think we were creating reports in SQL Server 2000, hooked up behind IIS. It feels this is being deprecated and removed because it's gone out of fashion, rather than because it's actually measurably worse than whatever's-in-fashion-today... (eg React/Node/ )

Yeah it was great. You could sort/filter/summarize in different ways all without a server round-trip. At the time it seemed magical to users.

Re: Removing XSLT for a more secure browser

#132

Post by SoftTalker »

sroussey wrote: post #117
chuckadams wrote: post #97

Earlier quoted context omitted.

The issue in question is just one of the several long-unfixed vulnerabilities we know about, from a library that doesn't have that many hands or eyes on it to begin with.

And why doesn’t Google contribute to fixing and maintaining code they use?

Because in this case it doesn't contribute to their ability to deliver ads.

Re: Removing XSLT for a more secure browser

#133

Post by kccqzy »

sroussey wrote: post #117
chuckadams wrote: post #97

Earlier quoted context omitted.

The issue in question is just one of the several long-unfixed vulnerabilities we know about, from a library that doesn't have that many hands or eyes on it to begin with.

And why doesn’t Google contribute to fixing and maintaining code they use?

Because they don't want to use the code. They begrudgingly use it to support XSLT and now they don't use it.

Re: Removing XSLT for a more secure browser

#134

Post by basscomm »

eddd-ddde wrote: post #114
RogBogTog wrote: post #93

I think that's sad. XSLT is in my point a view a very misunderstood technology. It gets hated on a lot. I wonder if this hate is by people who actually used and understood it, though. In any case, more often than not this is by people who in the same sentence endorse JavaScript (which, by any objective way of measuring is just a language far more poorly designed).

What does XSLT provide that you cannot achieve with plain JS?

I'm not much of a programmer, but XSLT being declarative means that I can knock out a decent-looking template without having to do a whole lot of programming work.

Re: Removing XSLT for a more secure browser

#135

Post by basscomm »

DonHopkins wrote: post #123
RogBogTog wrote: post #93

I think that's sad. XSLT is in my point a view a very misunderstood technology. It gets hated on a lot. I wonder if this hate is by people who actually used and understood it, though. In any case, more often than not this is by people who in the same sentence endorse JavaScript (which, by any objective way of measuring is just a language far more poorly designed).

Au contraire: the more you understand and use XSLT, the more you hate it. People who don't understand it and haven't used it don't have enough information and perspective to truly hate it properly. I and many other people don't hate XSLT out of misunderstanding at all: just the opposite. XSLT is like programming with both hands tied behind your back, or pedaling a bicycle with only one leg. For any non-trivial task,…

Counterpoint: the more I used XSLT, the more I liked it, and the more I was frustrated that the featureset that ships in browsers is frozen in 1999

Re: Removing XSLT for a more secure browser

#136

Post by bawolff »

wswope wrote: post #115
bawolff wrote: post #75

Earlier quoted context omitted.

Didn't this come pretty directly after someone found some security vulns? I think the logic was, this is a huge chunk of code that is really complex which almost nobody uses outside of toy examples (and rss feeds). Sure, we fixed the issue just reported, but who knows what else is lurking here, it doesn't seem worth it. As a general rule, simplifying and removing code is one of the best things you can do for security…

> As a general rule, simplifying and removing code is one of the best things you can do for security. Sure, but that’s not what they’re doing in the big picture. XSLT is a tiny drop in the bucket compared to all the surface area of the niche, non-standard APIs tacked onto Chromium. It’s classic EEE. https://developer.chrome.com/docs/web-platform/

My understanding is that contrary to popular opinion it is firefox not chrome that originally pushed for the removal, so i dont know how relavent that is. It seems like all browser vendors are in agreement on xslt.

that said, xslt is a bit of a weird api in how it interacts with everything. Not all apis are equally risky and i suspect xslt is pretty high up there on the risk vs reward ratio.

Re: Removing XSLT for a more secure browser

#137

Post by DonHopkins »

basscomm wrote: post #135
DonHopkins wrote: post #123

Earlier quoted context omitted.

Au contraire: the more you understand and use XSLT, the more you hate it. People who don't understand it and haven't used it don't have enough information and perspective to truly hate it properly. I and many other people don't hate XSLT out of misunderstanding at all: just the opposite. XSLT is like programming with both hands tied behind your back, or pedaling a bicycle with only one leg. For any non-trivial task,…

Counterpoint: the more I used XSLT, the more I liked it, and the more I was frustrated that the featureset that ships in browsers is frozen in 1999

You should really try some of the modern alternatives. Don't let Angular and React's templating systems poison you, give Svelte a try!

Even just plain JavaScript is much better and more powerful and easier to use than XSLT. There are many JavaScript libraries to help you with templates. Is there even any such thing as an XSLT library?

Is there some reason you would prefer to use XSLT than JavaScript? You can much more easily get a job yourself or hire developers who know JavaScript. Can you say the same thing for XSLT, and would anyone in their right mind hire somebody who knows XSLT but refuses to use JavaScript?

XSLT is so clumsy and hard to modularize, only good for messy spaghetti monoliths, no good for components and libraries and modules and frameworks, or any form of abstraction.

And then there's debugging. Does a good XSLT debugger even exist? Can it hold a candle to all the off-the-shelf built-in JavaScript debuggers that every browser includes? How do you even debug and trace through your XSLT?

Re: Removing XSLT for a more secure browser

#138

Post by dpark »

davisr wrote: post #130
dpark wrote: post #127

Earlier quoted context omitted.

Then you misheard me. I’m not saying change is not possible. I’m saying the change you propose is misguided. I do not believe the entire world should abandon JS to accommodate your unusual preferences nor should everyone be obliged to build two versions of their site, one for the masses and one for those with JS turned off. Yes, JS is overused. But JS also brings significant real value to the web. JS is what has allo…

Did I say abandon? No. I said it should not be required. JavaScript should be supplementary to a page, but not necessary to view it. This was its original intent. > JS is what has allowed websites to replace desktop apps in many cases. Horribly at that, with poorer accessibility features, worse latency, abused visual style that doesn't match the host operating system, unusable during times of net outages, etc, etc.

> JavaScript should be supplementary to a page, but not necessary to view it.

I’m curious. Do Google Maps, YouTube, etc even work with JS off?

> This was its original intent.

Original intent is borderline irrelevant. What matters is how it is actually used and what value it brings.

> Horribly at that

I disagree. You say you turn JS off for security but JS has made billions of people more secure by creating a sandbox for these random apps to run in. I can load up a random web app and have high confidence that it can’t muck with my computer. I can’t do the same with random desktop apps.

Re: Removing XSLT for a more secure browser

#139

Post by bawolff »

jerf wrote: post #84
Fileformat wrote: post #56

One extremely important XSLT use-case is for RSS/Atom feeds. Right now, clicking on a link to feed brings up a wall of XML (or worse, a download link). If the feed has an XSLT stylesheet, it can be presented in a way that a newcomer can understand and use. I realize that not that many feeds are actually doing this, but that's because feed authors are tech-savvy and know what to do with an RSS/Atom link. But someone w…

I've been involved in the RSS world since the beginning and I've never clicked on an RSS link and expected it to be rendered in a "nice" way, nor have I seen one. "XSLT is currently the only way to make feeds into something that can still be viewed." You could use content negotiation just fine. I just hit my personal rss.xml file, and the browser sent this as the Accept header: text/html,application/xhtml+xml,applica…

I think it used to be more popular in early days. At one point i think firefox was styling rss feeds by default so people stopped using xslt as much.

You can still style them with css if you want. I dont really see the point. RSS is for machines to read not humans.

Re: Removing XSLT for a more secure browser

#140

Post by stickfigure »

dfabulich wrote: post #128
stickfigure wrote: post #92

Earlier quoted context omitted.

It is an unfortunate fact about our industry that all build tools suck. Tell me what your favorite build tool is and I can point at hundreds of HN threads ripping it to shreds. Maybe it's NPM? Cue the screams... I agree though, "XML is not a programming language" and attempts to use it that way have produced poor results. You should have seen the `ant` era! But this is broader than XML - look at pretty much every pop…

But, that's what XSL is! XSL is a Turing-complete programming language in XML for processing XML documents. Being in XML is a big part of what makes XSL so awful to write.

XSL may be Turing-complete but it's not a programming language and wasn't intended to be one. It's a declarative way to transform XML. When used as such I never found it awful to write... it's certainly much easier than doing the equivalent in general purpose programming languages.

Maybe by analogy: There are type systems that are Turing complete. People sometimes abuse them to humorous effect to write whole programs (famously, C++ templates). That doesn't mean that type systems are bad.

Post reply on HN