Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Implement window.{alert, prompt, confirm} removal from cross-origin iframes

bugs.chromium.org

Post reply on HN
Print view View original

51–60 of 160 posts

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#51

Post by voidnullnil »

userbinator wrote: post #4
akersten wrote: post #2

They've even eschewed the standard way to opt-in iframes to powerful, dangerous features like `alert` and `confirm` - you can't even `sandbox` the iframe to allow it. You have to enroll your website in a Chrome Origin Trial[0], which only lasts until December, and also requires you to create a Google account, agree to Google ToS, and you might be blessed with the ability for your perfectly-fine-before-Chromium-team-c…

Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.

The entire web does this, not just Google.

Alert is pure garbage and should not have made it past the 90s. Also, basic auth popups need to go too. Not sure why browsers would ever make those focus stealing in the first place. There should not be one single way for a web application to steal focus. The current workaround is to download a buggy ad blocker (last time I used chrome, just like firefox it has no way to turn popups off).

Edit: I just remembered alert no longer steals focus on modern browsers (IIRC). But basic auth still does (at least on my 50 year old fork of firefox).

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#52

Post by irjustin »

phillipseamore wrote: post #23
trangus_1985 wrote: post #13

This makes a lot of sense, and is (IMO) a really great thing to do for users. IMO Cross Origin iframe alert/prompt should only be allowable with CSP rules explicitly permitting the cross origin iframe in the first place (in allowlist capacity). The amount of abuse this has seen and will see is a blight, especially on the average user. HOWEVER What the hell, Chrome? This timeline for a change of this magnitude is INSA…

Switch to Mozilla? They are positive to this, and Webkit also. That is often the case, Chromium just has a faster turn-around then the others so usually are first to implement. The discussion about this started a year ago with the individual browsers and WHATWG. https://bugzilla.mozilla.org/show_bug.cgi?id=1624978

Not a suitable answer for website owners. Even if they literally asked all their customers to switch, end users won't.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#53

Post by javajosh »

bawolff wrote: post #9
userbinator wrote: post #4

Earlier quoted context omitted.

Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.

Idk why everyone jumps to these paranoid conspiracy theories - alert() box to trick people has been a thing for decades, and its super rare for it to be used legitly outside of debugging.

> its super rare for it to be used legitly outside of debugging

Simply false. This change broke several of my companies apps, and it broke Salesforce, and God knows what else. And it's not just a layout problem; it's material behavior which changed.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#54

Post by r00fus »

phillipseamore wrote: post #23
trangus_1985 wrote: post #13

This makes a lot of sense, and is (IMO) a really great thing to do for users. IMO Cross Origin iframe alert/prompt should only be allowable with CSP rules explicitly permitting the cross origin iframe in the first place (in allowlist capacity). The amount of abuse this has seen and will see is a blight, especially on the average user. HOWEVER What the hell, Chrome? This timeline for a change of this magnitude is INSA…

Switch to Mozilla? They are positive to this, and Webkit also. That is often the case, Chromium just has a faster turn-around then the others so usually are first to implement. The discussion about this started a year ago with the individual browsers and WHATWG. https://bugzilla.mozilla.org/show_bug.cgi?id=1624978

The issue isn't the cross origin alert change. It's the TOS required and opt-out process.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#55

Post by maccolgan »

andrewmcwatters wrote: post #43
trangus_1985 wrote: post #13

This makes a lot of sense, and is (IMO) a really great thing to do for users. IMO Cross Origin iframe alert/prompt should only be allowable with CSP rules explicitly permitting the cross origin iframe in the first place (in allowlist capacity). The amount of abuse this has seen and will see is a blight, especially on the average user. HOWEVER What the hell, Chrome? This timeline for a change of this magnitude is INSA…

There's an ongoing conversation that has lasted about four years on https://github.com/whatwg/html/issues/2791 regarding whether or not browsers should implement ` `, (think client-side SSI, php's `include`, ngInclude, or similar fragment import functionalities from different software) which basically comes down to the four(?) editors (Mozilla, Microsoft, Google, Apple) not liking it. I noted that it's the most comme…

At this point HTML is quickly turning into not a markup language

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#56

Post by pornel »

This could have been handled better:

* Position and clip the alert box within bounds of the frame, so that it doesn't display anything that the frame couldn't do itself.

* Don't make framed alerts steal focus, so that it also loses special behavior.

* Ideally, provide some replacement like `await alert()` so that authors can migrate with minimal changes.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#57

Post by [deleted] »

akersten wrote: post #2

They've even eschewed the standard way to opt-in iframes to powerful, dangerous features like `alert` and `confirm` - you can't even `sandbox` the iframe to allow it. You have to enroll your website in a Chrome Origin Trial[0], which only lasts until December, and also requires you to create a Google account, agree to Google ToS, and you might be blessed with the ability for your perfectly-fine-before-Chromium-team-c…

[deleted]

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#58

Post by ceejayoz »

floatingatoll wrote: post #26
akersten wrote: post #8

Earlier quoted context omitted.

Something's definitely misbehaving in Firefox on the page. Using a mouse to highlight text in a comment and then trying to move the highlight to the next paragraph, the selection jumps to the first paragraph as soon as the cursor leaves the `span` of each paragraph. From a quick look at the DOM, I'd bet dollars to donuts it's the weird combination of custom WebComponents and the #shadow-root stuff and other various m…

If you create a new Firefox profile alongside your usual one, and do not change any settings, can you reproduce the copy paste issue you’re seeing?

Tried with a brand new Firefox profile, on OSX. Still wonky.

Screencast: https://youtu.be/XGTyDQGTC4E

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#59

Post by sambeau »

asdfasgasdgasdg wrote: post #34
trangus_1985 wrote: post #13

This makes a lot of sense, and is (IMO) a really great thing to do for users. IMO Cross Origin iframe alert/prompt should only be allowable with CSP rules explicitly permitting the cross origin iframe in the first place (in allowlist capacity). The amount of abuse this has seen and will see is a blight, especially on the average user. HOWEVER What the hell, Chrome? This timeline for a change of this magnitude is INSA…

What's insane about the timeline? They started talking about this a year and a half ago, approved it winter this year, and had it out in beta in May. How much longer should they take? What's insane about the opt-out process? It seems very easy to me. I was able to generate an opt-out token in about three minutes for example.com. I'm a backend developer so I don't know too much about web servers, but I imagine it woul…

“But look, you found the notice, didn’t you?”

“Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#60

Post by dylan604 »

voidnullnil wrote: post #51
userbinator wrote: post #4

Earlier quoted context omitted.

Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.

The entire web does this, not just Google. Alert is pure garbage and should not have made it past the 90s. Also, basic auth popups need to go too. Not sure why browsers would ever make those focus stealing in the first place. There should not be one single way for a web application to steal focus. The current workaround is to download a buggy ad blocker (last time I used chrome, just like firefox it has no way to tur…

>(at least on my 50 year old fork of firefox).

Since you're obviously from the future, can you give me tips on some stocks or sporting events to "invest"?

Post reply on HN