Live data from Hacker News

Maybe we could tone down the JavaScript (2016)

eev.ee

171–180 of 237 posts

Re: Maybe we could tone down the JavaScript (2016)

#171

I recently started to fork webkit to make it a Webview with a reduced attack surface. [2] The most interesting part was the Quirks.cpp file [1] that contains literally randomized css classnames inside the web browser code because a major website was so shitty and spec violating in their implementations. I mean, fixing a website in a browser source code...this shit got out of hand real quick yo. The problem with all t…

You would think that they would have at least have made it into a configuration file, instead of literally hard coding rules for specific website domains directly in the browser rendering engine C++ code?

But why would they make it a config file, when they can just add it to the code?

Config files are like code, but even more shit. You never get the full set of functionality that you get with code, the compiler doesn't check your work, code navigation can't help you, and there's no debugger.

Re: Maybe we could tone down the JavaScript (2016)

#173
post #73

Earlier quoted context omitted.

You and the parent are totally missing the point. Use the system tools. But make the look of the system tools customizable. System tool. Customizable look. That's what should be available. But even today you can't consistently change something as simple as a scroll bar or a checkbox. Which, even worse, are by default styled differently on different browsers.

I think the parents are _exactly_ getting the point. Separating look&feel from functionality isn't that easy. In any kind of UX, they are bound to various degrees, depending on the use-case.

Let's take windows. The scroll bar on the start-up screens looks different to the one in explorer, looks different to the one in Chrome, which looks different to the one in IE11, which looks different to the one in IE Edge, which looks different to the one in Firefox, which looks different to the one in excel, which looks different to the one in the control panel, which looks different to the one in visual studio, which looks different to the one in Visual Studio Code.

So if they're _exactly_ getting the point, they're pretty unobservant.

There already is no consistency.

Re: Maybe we could tone down the JavaScript (2016)

#174

I recently started to fork webkit to make it a Webview with a reduced attack surface. [2] The most interesting part was the Quirks.cpp file [1] that contains literally randomized css classnames inside the web browser code because a major website was so shitty and spec violating in their implementations. I mean, fixing a website in a browser source code...this shit got out of hand real quick yo. The problem with all t…

[deleted]

Re: Maybe we could tone down the JavaScript (2016)

#175
post #81
post #14

Earlier quoted context omitted.

I mean the product manager isn’t wrong, there is no good reason we shouldn’t be able to make custom components with the behavior of “native” widgets. The fact that the dev story is “build a widget from scratch out of divs” and not “extend the fully functional component with new styling and hooks and slight behavior modifications.” We created this problem ourselves by not having the tools to meet designer needs while…

The problem is, as always when talking about cross-platform development, is that you can have consistent widgets OR native widgets, because the native platforms have different look, feel, and interaction standards. Would it be great if everyone on the frontend could get together and agree what the native-to-browser widgets should look like and how they might be customized? Yes. Would the three warring browser manufac…

> Would it be great if everyone on the frontend could get together and agree what the native-to-browser widgets should look like and how they might be customized? Yes.

This would not be great at all. I want widgets on web pages to look like macOS system widgets on macOS, and to look like Windows system widgets on Windows. I want designers to lose the notion that it is their system style, and respect the fact that the browser is _my_ user agent, and therefore must respect _my_ preferences.

Re: Maybe we could tone down the JavaScript (2016)

#177

Finally. I am so happy someone else noticed how much of a garbage fire Twitter is when you limit (not even block ) JavaScript. I use uMatrix and a hardened Firefox profile so I notice pretty quickly if websites are poorly made. Spoiler: the vast majority are, and the big players like Twitter, Facebook, Google, etc. are absolutely the worst offenders. But Twitter is so frustrating because of exactly what the article's…

> when you limit (not even block) JavaScript

Speaking as a web developer, blocker of JavaScript by default, uMatrix user, and extensive user script writer: limiting is vastly harder to deal with than blocking; your “even” is unjust. “No JavaScript” is easy to detect and cope with (even if it’s just to respond “nah, dude; JavaScript me, bro”), but coping with blocking some JavaScript requires you to consider what could be blocked and what to do about it in each case.

If you’re talking third-party scripts, then sure, developers should handle failure to load scripts/XHR/fetch, simply for normal people’s sake; for analytics especially there are well-trodden paths, though certainly occasionally you encounter sites that don’t tread them. (Note that when I say “third party” I mean the social concept of third party, not “different origin”, because it’s common to load first-party scripts from different origins—CDNs, &c.)

If you’re blocking things at a finer grain than first-party/third-party divide, then you should expect things will often blow up. It’s not particularly reasonable for them to detect and work with your meddling.

A few years ago I had to use Dropbox from time to time. It was always fun whenever it dropped my session (never for any obvious reason) and forced me to log in again, as I had to tweak my whitelists almost every time as they’d have shifted their CAPTCHA thing around or added a new CAPTCHA service (they had three or four going at once!) or something. It would take literally twenty seconds after pressing the submit button before it would decide to actually let me in, even with no intercepted requests. Not sure what was going on with that. And if anything was blocked, then it’d probably just hang indefinitely, often even without any exception ever being thrown in the console! Definitely not a good experience, and they should detect that a necessary script failed to load and notify you, but eh, I reckon I brought it on myself by using fine-grained blocking.

Re: Maybe we could tone down the JavaScript (2016)

#178

Finally. I am so happy someone else noticed how much of a garbage fire Twitter is when you limit (not even block ) JavaScript. I use uMatrix and a hardened Firefox profile so I notice pretty quickly if websites are poorly made. Spoiler: the vast majority are, and the big players like Twitter, Facebook, Google, etc. are absolutely the worst offenders. But Twitter is so frustrating because of exactly what the article's…

Imagine going into a board meeting with the senior leadership of any one of these companies and saying "we need a major initiative to make our site more accessible to 20 people who block all Javascript and probably have contempt for us." Then tell them how much it will cost.

This is exactly it - by limiting javascript you are choosing to be in a minority of users and then demanding to be catered to. You're just setting yourself up for disappointment.

These are businesses - they write code to generate profit. Their support of limited javascript has no impact on profit, so they won't do it.

Re: Maybe we could tone down the JavaScript (2016)

#179
post #164

I recently started to fork webkit to make it a Webview with a reduced attack surface. [2] The most interesting part was the Quirks.cpp file [1] that contains literally randomized css classnames inside the web browser code because a major website was so shitty and spec violating in their implementations. I mean, fixing a website in a browser source code...this shit got out of hand real quick yo. The problem with all t…

this looks like a bug? [0] || domain.endsWith("hulu.com"); should be ".hulu.com", since anyone can register a hulu.com [0] https://github.com/WebKit/WebKit/blob/ce237483d034e41eff8cc5...

https://news.ycombinator.com/item?id=26166497

Re: Maybe we could tone down the JavaScript (2016)

#180

Now that it's 2021, most of the concessions the author makes are possible with CSS. You can change the styling of an element using hyperlinks with the `target` pseudo selector: #dropdown { display: none; } #dropdown:target { display: block; } Show dropdown Dropped down! Close This works for dropdowns, tooltips, modals, even navigation if you're navigating to known places (or if you use JS to pre-insert the destinatio…

:target has been a possibility for many, many years, but is a poor choice for this sort of thing because it’s rather fragile (other things touch the fragment too) and messes with history.

The better hack that has been long available is invisible checkboxes, :checked and a sibling selector. That’s almost certainly what “you could fake it with CSS too” was describing back then.

But the proper solution now would be . As an example of this, many dropdowns on GitHub work without JavaScript, by using .

I would note that with all of these alternatives, you tend to want a little JavaScript to enhance the functionality, e.g. manage ARIA states and focus.

Post reply on HN