Implement window.{alert, prompt, confirm} removal from cross-origin iframes

Post by fomine3 » Wed, Aug 04, 2021, 7:03 AM UTC

gzer0 wrote: post #81

phillipseamore wrote: post #23

Earlier quoted context omitted.

Switch to Mozilla? They are positive to this, and Webkit also. That is often the case, Chromium just has a faster turn-around then the others so usually are first to implement. The discussion about this started a year ago with the individual browsers and WHATWG. https://bugzilla.mozilla.org/show_bug.cgi?id=1624978

Microsoft Edge released 92.0.902.62 today which now re-allows the dialogs in cross domain iFrames. We are suggesting that our user base moves from Chrome to Edge.

Post by TeMPOraL » Wed, Aug 04, 2021, 7:58 AM UTC

bawolff wrote: post #9

userbinator wrote: post #4

Earlier quoted context omitted.

Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.

Idk why everyone jumps to these paranoid conspiracy theories - alert() box to trick people has been a thing for decades, and its super rare for it to be used legitly outside of debugging.

Post by seba_dos1 » Wed, Aug 04, 2021, 8:21 AM UTC

mdaniel wrote: post #129

TheRealPomax wrote: post #29

Here's waiting for when we finally rip out document.write because it's one of the most damaging functions to have been kept on life support "because we don't remove things from JS, it would break the internet". Except of course for all those times we already did by not "removing it from the spec", just either removing support in all browsers, or by changing the security policies so that "the code is still accepted" i…

As a counter-point to this, `document.write` is (currently) a render blocking action, and thus allows one to load assets without a bunch of `document.addEventListener("DOMContentReady", (ohgawd) => {})` business to ensure a `window.__whatever__` is initialized before 10 quadrillion megs of JS run Maybe in some pseudofuture there will be a less heinous way to schedule the order of JS evaluation, but until that future…

Post by sofixa » Wed, Aug 04, 2021, 9:21 AM UTC

userbinator wrote: post #134

floatingatoll wrote: post #128

Earlier quoted context omitted.

To try and restate this, in case I misunderstand: You believe that Apple and Mozilla are rubber-stamping anything Google asks for because they’re afraid of a Google marketing campaign. Have I accurately represented your beliefs?

The situation is not so clear with Apple (but there is some evidence that it puts up at least some opposition: see hit-pieces like https://news.ycombinator.com/item?id=27968394 and note all the pro-Chrome/Google opinions there...) but Mozilla is funded by Google. ...and regardless of whether you're using Chrome, the immense power of Google's marketing abilities cannot be overstated. It is an ad company, after all. (I…

Post by gatlin » Wed, Aug 04, 2021, 1:06 PM UTC

bawolff wrote: post #9

userbinator wrote: post #4

Earlier quoted context omitted.

Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.

Idk why everyone jumps to these paranoid conspiracy theories - alert() box to trick people has been a thing for decades, and its super rare for it to be used legitly outside of debugging.