Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTML Form Validation is underused

expressionstatement.com

Post reply on HN
Print view View original

331–340 of 343 posts

Re: HTML Form Validation is underused

#331

Post by MaxBarraclough »

raxxorraxor wrote: post #325
MaxBarraclough wrote: post #305

Earlier quoted context omitted.

I'm not sure about that, plenty of HackerNews users see its minimal and functional UI as a feature not a bug. I wish there were more lightweight websites, none spring to mind other than HackerNews, SourceHut, and Pinboard.

I love that as well, I hate bloated sites just as the next one here. But for any more complex form with dynamic content, JS is still inevitable. I guess for HN the input form at the bottom is enough. But Algolia uses a custom input component already.

On reflection my earlier comment was a little off the mark - all 3 of those sites use JavaScript, but minimally.

Zero JavaScript is rarely practical when there's meant to be interactivity of any kind. The issue isn't the language, but the appalling bloat that is now the norm on the web. And, course, bad design in its various forms.

Re: HTML Form Validation is underused

#332

Post by Jerrrrrrry »

maxbond wrote: post #164
Jerrrrrrry wrote: post #39

Earlier quoted context omitted.

> (Also kinda anoying to have to duplicate this tho) Security and convenience are like space and time, you can't move one without transformation of the other.

I think it's a trilemma between security, convenience, and architectural sophistication (NB: I'm deliberately not saying complexity, because the code doesn't necessarily get more complex). It is usually physically possible to find a solution with equal security for a given level of convenience, but it will require an investment of creativity and possibly refactoring to realize. Both of those things are very expensive…

  > (NB: I'm deliberately not saying complexity, because the code doesn't necessarily get more complex)
the context was already lamenting the duplication of code, which in itself is a form of inconvenience, as you kinda admit; because generalizing it to "complexity" would be forgetting the possibility of adding resilience, and adding stuff doesn't necessarily mean anything gets more complex - just more entrophic, the stuff added may not be optimal.

  > But writing a .... is a huge lift.
And also the only way to minimize the security risk; by rewriting/auditing/formalizing.

Ultimately the risk transformation is exponential; don't roll your own crypto, don't DIY authentication/authorization, don't risk your own inconvenience and assume security.

However the opposite, to use all the "agreed"-upon code, introduces a near similar surface area of risk, simply spread across more vectors. And because the vectors are spread, and the system is more complex, the dissolution of responsibility leads to the opportune laziest option - patching code together, trusting it works.

it would be wise to question why this convention is so normalized.

Re: HTML Form Validation is underused

#333

Post by maxbond »

Jerrrrrrry wrote: post #332
maxbond wrote: post #164

Earlier quoted context omitted.

I think it's a trilemma between security, convenience, and architectural sophistication (NB: I'm deliberately not saying complexity, because the code doesn't necessarily get more complex). It is usually physically possible to find a solution with equal security for a given level of convenience, but it will require an investment of creativity and possibly refactoring to realize. Both of those things are very expensive…

> (NB: I'm deliberately not saying complexity, because the code doesn't necessarily get more complex) the context was already lamenting the duplication of code, which in itself is a form of inconvenience, as you kinda admit; because generalizing it to "complexity" would be forgetting the possibility of adding resilience, and adding stuff doesn't necessarily mean anything gets more complex - just more entrophic, the s…

Just to put it on the record I am happy to acknowledge that duplication is an inconvenience as well as a security issue.

Your point about trusting conventional code is well made and important. Once I repeated that I shouldn't roll my own crypto. A cryptographer shrugged and told me, I mean, somebody has to write it, and that person might be you. (That person isn't me. I don't roll my own crypto. I do roll my own auth, because I'm comfortable with my understanding of authn/authz attacks. Use my software at your peril.)

Regarding complexity what I was thinking is that, after a lot of clever reflection, you might realize the proper solution is actually to take something away. To give an illustrative though not very realistic example, you might realize you didn't actually need a web backend at all and that the app can function local-only. Thereby solving your UX and security issues - client side validation is now completely acceptable. This architecture is simpler (less complex) in that the diagram contains fewer elements, but more sophisticated in that it contains more baked-in wisdom about how your normally web-based application can fulfill all it's requirements locally.

Re: HTML Form Validation is underused

#334

Post by Gormo »

ozim wrote: post #128

Because it sucks. It does not translate with the application but with browsers settings, it doesn’t style or fit any design. It looks differently on different browsers and it is really hard to explain to stakeholders “this is from browser I don’t have control over it”.

> It does not translate with the application but with browsers settings, it doesn’t style or fit any design

Wait, which is it? Does not match any style or design, or is it matching the browser's?

And if your application isn't consistent with the browser and OS settings, shouldn't you fix your application?

Re: HTML Form Validation is underused

#335

Post by otherme123 »

poincaredisk wrote: post #226
otherme123 wrote: post #215

Earlier quoted context omitted.

If it works for you, I guess it's OK. My apps usually deal with non-technical people (thus ISO in the browser input is out of the question), and sometimes spread at least between Europe and US (so people would enter MMDDYYYY and DDMMYYYY, and keep in mind that some dates work validate for both formats, namely every 12 first days for each month). Behind the scenes everything is ISO and UTC, but everyone gets their pre…

To be honest I would expect dates on a Dutch site to be shown in dutch format, just like I expect dates on American sites to be formatted in the US way.

Lets clarify a bit here. There are two different problems:

- Date display. I prefer to show it in the browser preferred format, but in the end what you say is also OK. It's a very minor issue.

- Date input. I would never force a format to the user, it there is any chance people from different locales can access the web. The correct way, IMO, is "input in the preferred browser format, send data as ISO". Any other combination would cause errors, e.g. "input in the preferred browser format, send data in that format" and you'll get wrong dates in the backend, or need to do a lot of gymnastics to avoid them. "input in server locale, send data in any format", and you'll get wrong dates from people used to any format that is not your server locale that happens to validate in multiple locales. "input in ISO, data send as ISO", you'll get users upset because "YYYY-MM-DD is stupid, use MY locale instead".

Re: HTML Form Validation is underused

#336

Post by Jerrrrrrry »

maxbond wrote: post #333
Jerrrrrrry wrote: post #332

Earlier quoted context omitted.

> (NB: I'm deliberately not saying complexity, because the code doesn't necessarily get more complex) the context was already lamenting the duplication of code, which in itself is a form of inconvenience, as you kinda admit; because generalizing it to "complexity" would be forgetting the possibility of adding resilience, and adding stuff doesn't necessarily mean anything gets more complex - just more entrophic, the s…

Just to put it on the record I am happy to acknowledge that duplication is an inconvenience as well as a security issue. Your point about trusting conventional code is well made and important. Once I repeated that I shouldn't roll my own crypto. A cryptographer shrugged and told me, I mean, somebody has to write it, and that person might be you. (That person isn't me. I don't roll my own crypto. I do roll my own auth…

  >To give an illustrative though not very realistic example, you might realize you didn't actually need a web backend at all and that the app can function local-only.
ssshhhh, don't give away the only secret that keeps us employed.

if they knew for certain our stuff wouldn't break, we wouldn't had been kept around.

Re: HTML Form Validation is underused

#337

Post by CRConrad »

One gets the feeling HTML in general is underused, since everything has been done in JavaScript for... How long now, at least over a decade?

It's gone so far that some peole claim React (and probably other frameworks too) is "a language"; they apparently don't even know it's just a JavaScript library.

Re: HTML Form Validation is underused

#338

Post by CRConrad »

tsimionescu wrote: post #279
ximm wrote: post #198

Earlier quoted context omitted.

I never really understood why people want to style stuff like this. I like how you can express yourself by using colors and layout and stuff like that. But at some point usability is more important than branding.

People want to style things to match their page, exactly because consistency is part of usability. Especially given the limitations of browser form validations, you will absolutely need your own validations in addition to any browser validations you use. But your own validations will look different from the browser-provided ones, at least on some browsers. Which will confuse users, hence decreasing usability. And thi…

> People want to style things to match their page, exactly because consistency is part of usability.

Consistency with industry standards is a lot more consistency than consistency just within one silly "app" webpage.

Re: HTML Form Validation is underused

#339

Post by CRConrad »

tsimionescu wrote: post #322
SoftTalker wrote: post #283

Earlier quoted context omitted.

News flash, every site doing things their own way is one of the core usability problems on the web. Designers love it. Users hate it.

I think consistency within an application is far more important than consistency across applications. And even if it were true that users hated the lack of consistency, it would fall on deaf ears: the web page developers can only influence their own page. They can't make Google or Mozilla or Apple come up with an actually usable error model, or any kind of good UI in general, so the only chance they have is to create…

> I think consistency within an application is far more important than consistency across applications.

And I think you're wrong.

Re: HTML Form Validation is underused

#340

Post by Jerrrrrrry »

maxbond wrote: post #333
Jerrrrrrry wrote: post #332

Earlier quoted context omitted.

> (NB: I'm deliberately not saying complexity, because the code doesn't necessarily get more complex) the context was already lamenting the duplication of code, which in itself is a form of inconvenience, as you kinda admit; because generalizing it to "complexity" would be forgetting the possibility of adding resilience, and adding stuff doesn't necessarily mean anything gets more complex - just more entrophic, the s…

Just to put it on the record I am happy to acknowledge that duplication is an inconvenience as well as a security issue. Your point about trusting conventional code is well made and important. Once I repeated that I shouldn't roll my own crypto. A cryptographer shrugged and told me, I mean, somebody has to write it, and that person might be you. (That person isn't me. I don't roll my own crypto. I do roll my own auth…

  >but more sophisticated in that it contains more baked-in wisdom
you can't beat Shannon's limit, or the 2nd law of thermodynamics, no matter how much you allow "sophistication" or "wisdom" to do the lifting.
Post reply on HN