Live data from Hacker News

Building the most inaccessible site with a perfect Lighthouse score (2019)

matuzo.at

41–50 of 81 posts

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#41

One of the "philosophers' stone" goals of the software industry is to completely replace human testing with automated testing. Basically, I think automated testing is a very good thing, and we should definitely try to do as much of it as possible. So we can clear the way for more useful and meaningful human testing. I've always thought that the engineers in QC should be just as skilled and qualified as the ones build…

>I've always thought that the engineers in QC should be just as skilled and qualified as the ones building the product. I agree, but then they need to be equally well payed... and I don't think it is possible to find a manager willing to pay them as much

I worked for a Japanese company that was renowned for Quality (with a capital "Q").

In the US, having "Quality" in your title often means that you are in a dead-end job.

In that company, it meant that you were an elite, and that you had considerable power over Engineering.

It also meant that you were a completely anal-retentive S.O.B.

They had spreadsheets with 3,000 rows (each row was a test -usually "monkey" test).

If even one of those rows got a red "X," the whole shooting match would come to a screeching halt, with heads rolling around like foozballs.

It also meant that they double-checked every bug report six ways to Sunday. If they reported a bug, It. Was. A. Bug. No ifs, ands, or buts. If you questioned it, they would get quite huffy; which was not a good thing (see "power," above).

Management kept the QC organization quite separate from Engineering, and they often had an adversarial relationship; which was sometimes encouraged.

This led to engineering departments having some very large testing teams; often outnumbering the engineers. The engineering departments would be penalized for bugs found by the official QC organization, so having large in-house testing teams was worth it.

Their QC doesn't work especially well for software. They would get frowny faces, when I'd suggest automated testing, or process quality best practices.

Quality was always treated separately from construction. I could never quite agree with that, but it also meant that I was "on my own," if I wanted to try using modern quality engineering techniques.

Their [hardware] products are damn good, though. What many companies would consider minor quality issues are treated like Extinction-Level Events, at that company. They've been doing it for 100 years, so it's difficult to argue with them.

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#42
post #34

Cool, but this article would have been more useful with some practical examples of things Lighthouse doesn't catch. If the point is "this automated metric isn't perfect", no automated metric is but how bad is it exactly? I still don't have a sense for how bad Lighthouse is because I've never disabled all keyboard events, disabled all mouse events, or changed the high contrast stylings. The article almost makes the op…

You didn't understand the article. The article doesn't contain a single loophole. Each of those features has legitimate use cases and it is impossible to detect whether they are illegitimate. Just look at the first example. It straight up denies access to the content and the reason why lighthouse accepts it is because hiding content just hides content. Usually when content is marked hidden the user is not supposed to…

Mostly; I can't think of a good reason for 1px sized text.

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#43
post #39

Earlier quoted context omitted.

...how exactly does your system background colour include personal information?

It can be used for fingerprinting

I mean, not to be defeatist but... once you’ve got JS turned on you’ve already handed out such a massive amount of entropy I’m not sure this one extra item makes a huge difference.

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#44
post #43
post #39

Earlier quoted context omitted.

It can be used for fingerprinting

I mean, not to be defeatist but... once you’ve got JS turned on you’ve already handed out such a massive amount of entropy I’m not sure this one extra item makes a huge difference.

> one extra bit

If it's the OS default, it's probably worthless. But if it isn't, I would imagine it could be quite unique, no? Presuming it's an RGB color, that's 16M possibilities. And there are multiple system colors, meaning even more chance you're a snowflake if you customized them. If you chose a random color on just 2 of them, that's probably enough to make you unique among the entire world. (But it is, of course, likely that you might choose something common, like #ff00ff.)

If you turn of JavaScript, that's also probably a pretty good signal, no? (I'm just hearing someone shouting "There are dozens of us! Dozens!")

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#45

Wow, CSS system color keywords seem like a massive privacy leak. I just tested setting the property: background: Background; on an element, and then changing my Windows desktop background. The element immediately changes color to match my desktop. Then if I call getComputedStyle on the element, I get my desktop background color in javascript. This is in Firefox private mode, and apparently every website can read all…

It's already trivially easy to fingerprint a user in about a dozen other ways via:

User Agent String (being fixed soon by the Chrome team)

HTTP_ACCEPT headers

Browser plugin metadata

Time zone

System fonts

Supercookies

Canvas and WebGL fingerprinting

AudioContext

Device CPU and memory

What's one more bit of information?

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#46
post #39

Earlier quoted context omitted.

...how exactly does your system background colour include personal information?

It can be used for fingerprinting

i'd imagine most of the background colors are the same as most people set an image as their background.

ive not really thought about (or even know to be honest) what my desktop background color is these days. its not something ive throught about since windows 95. once XP came along with that pretty background I think i've used a photo ever since

but oh well 1 more bit is one more bit for the people that do still set a background

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#47

Wow, CSS system color keywords seem like a massive privacy leak. I just tested setting the property: background: Background; on an element, and then changing my Windows desktop background. The element immediately changes color to match my desktop. Then if I call getComputedStyle on the element, I get my desktop background color in javascript. This is in Firefox private mode, and apparently every website can read all…

Huh, neat. If anyone else is curious I threw all the color codes on my site here: https://traverseda.github.io/code/cssColourTest.md.html

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#48
post #46
post #39

Earlier quoted context omitted.

It can be used for fingerprinting

i'd imagine most of the background colors are the same as most people set an image as their background. ive not really thought about (or even know to be honest) what my desktop background color is these days. its not something ive throught about since windows 95. once XP came along with that pretty background I think i've used a photo ever since but oh well 1 more bit is one more bit for the people that do still set…

I set my background to a solid color. Mostly so compression on screenshots and screen captures is more effective. Though, I’d consider me an edge case here.

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#49
post #43

Earlier quoted context omitted.

I mean, not to be defeatist but... once you’ve got JS turned on you’ve already handed out such a massive amount of entropy I’m not sure this one extra item makes a huge difference.

> one extra bit If it's the OS default, it's probably worthless. But if it isn't, I would imagine it could be quite unique, no? Presuming it's an RGB color, that's 16M possibilities. And there are multiple system colors, meaning even more chance you're a snowflake if you customized them. If you chose a random color on just 2 of them, that's probably enough to make you unique among the entire world. (But it is, of cou…

If you turn Javascript off, the only information the website can get is user agent and IP, which would narrow it down much less than using Javascript even just among the pool of non-javascript users.

Keep in mind that there are a lot of services that load sites without Javascript enabled (scrapers, mail, preloading).

Re: Building the most inaccessible site with a perfect Lighthouse score (2019)

#50

Wow, CSS system color keywords seem like a massive privacy leak. I just tested setting the property: background: Background; on an element, and then changing my Windows desktop background. The element immediately changes color to match my desktop. Then if I call getComputedStyle on the element, I get my desktop background color in javascript. This is in Firefox private mode, and apparently every website can read all…

Doesn't seem to affect Safari
Post reply on HN