Live data from Hacker News

Implement window.{alert, prompt, confirm} removal from cross-origin iframes

bugs.chromium.org

61–70 of 160 posts

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#61

Earlier quoted context omitted.

Coping test seems to work fine in Chrome and Safari, so don't think Google broke anything in regards to text selection/copy/paste on the page.

Works fine in Firefox, too.

Not for me on OSX. New FF profile to rule out extensions/settings; https://youtu.be/XGTyDQGTC4E.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#62

Earlier quoted context omitted.

There's an ongoing conversation that has lasted about four years on https://github.com/whatwg/html/issues/2791 regarding whether or not browsers should implement ` `, (think client-side SSI, php's `include`, ngInclude, or similar fragment import functionalities from different software) which basically comes down to the four(?) editors (Mozilla, Microsoft, Google, Apple) not liking it. I noted that it's the most comme…

At this point HTML is quickly turning into not a markup language

I miss writing HTML instead of telling Javascript how to create the HTML that I would use. I preferred JQuery's $('') vs document.createElement('element').append(document.createElement()) bullshit

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#63

Earlier quoted context omitted.

The entire web does this, not just Google. Alert is pure garbage and should not have made it past the 90s. Also, basic auth popups need to go too. Not sure why browsers would ever make those focus stealing in the first place. There should not be one single way for a web application to steal focus. The current workaround is to download a buggy ad blocker (last time I used chrome, just like firefox it has no way to tur…

>(at least on my 50 year old fork of firefox). Since you're obviously from the future, can you give me tips on some stocks or sporting events to "invest"?

That's a way of saying "decades old".

Not to count years literally.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#64
post #8

Earlier quoted context omitted.

Something's definitely misbehaving in Firefox on the page. Using a mouse to highlight text in a comment and then trying to move the highlight to the next paragraph, the selection jumps to the first paragraph as soon as the cursor leaves the `span` of each paragraph. From a quick look at the DOM, I'd bet dollars to donuts it's the weird combination of custom WebComponents and the #shadow-root stuff and other various m…

If you create a new Firefox profile alongside your usual one, and do not change any settings, can you reproduce the copy paste issue you’re seeing?

im also getting it after trying with troubleshooting mode on (disables extensions, themes and custom settings.) this is on windows and latest firefox 90.0.2

https://i.imgur.com/y5lkfHI.gif

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#65
post #9

Earlier quoted context omitted.

Idk why everyone jumps to these paranoid conspiracy theories - alert() box to trick people has been a thing for decades, and its super rare for it to be used legitly outside of debugging.

How often is it that you have a malicious iframe on your website being used to trick people though? Why only remove it from iframe and not the entire browser if that is the concern? Why was this concern not alleviated with better UI for the standard alert dialogs? Alert dialogs and prompts are huge for accessibility - they're genuinely one of the best ways to get a screenreader's attention and have the user interact…

> How often is it that you have a malicious iframe on your website being used to trick people though?

Definitely more often than whatever hacky edge case websites relies on this behavior.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#66
post #2

They've even eschewed the standard way to opt-in iframes to powerful, dangerous features like `alert` and `confirm` - you can't even `sandbox` the iframe to allow it. You have to enroll your website in a Chrome Origin Trial[0], which only lasts until December, and also requires you to create a Google account, agree to Google ToS, and you might be blessed with the ability for your perfectly-fine-before-Chromium-team-c…

> Who the hell is in charge over there, and what compels them to incessantly break the web?

Well, to be fair, they went to the standards body and proposed it, and both Firefox and Webkit were in favour of the spec change.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#67

This is peak Chrome; what seems to be a reasonably good idea that's hampered because it was pushed out thoughtlessly without putting any serious effort into notifying the people affected or making sure that nothing else breaks, or making sure that it thoroughly solves the problem. The product owners at Chrome are smart, but they're careless and constantly break the web because they don't seem to have enough of a sens…

> . The product owners at Chrome are smart, but they're careless and constantly break the web because they don't seem to have enough of a sense of gravitas or caution about what they're doing. Now imagine when Chrome has no competition whatsoever anymore, which will eventually happen. Google will control the web, at the very least on PC and Android, which is like 90% of the audience or something. They will take terri…

[deleted]

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#68

This is peak Chrome; what seems to be a reasonably good idea that's hampered because it was pushed out thoughtlessly without putting any serious effort into notifying the people affected or making sure that nothing else breaks, or making sure that it thoroughly solves the problem. The product owners at Chrome are smart, but they're careless and constantly break the web because they don't seem to have enough of a sens…

Hmm, the linked bug is from March 2020, and this thing will be Removed in December 2021. That's nearly 2 years, no?

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#69

Earlier quoted context omitted.

Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.

The entire web does this, not just Google. Alert is pure garbage and should not have made it past the 90s. Also, basic auth popups need to go too. Not sure why browsers would ever make those focus stealing in the first place. There should not be one single way for a web application to steal focus. The current workaround is to download a buggy ad blocker (last time I used chrome, just like firefox it has no way to tur…

basic auth is super useful for protecting staging sites, however.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#70

This is peak Chrome; what seems to be a reasonably good idea that's hampered because it was pushed out thoughtlessly without putting any serious effort into notifying the people affected or making sure that nothing else breaks, or making sure that it thoroughly solves the problem. The product owners at Chrome are smart, but they're careless and constantly break the web because they don't seem to have enough of a sens…

So over a year ago they did publish their "Intent to remove" for this https://groups.google.com/a/chromium.org/g/blink-dev/c/hTOXi...

Honestly, what is the right way to "notify the people affected" for changes like this, apart from publishing them to their mailing list. There is no centralised place for these sorts of things, apart from each developer's mailing lists, or the standards mailing lists.

I'm a web developer and I've never paid attention to the blink-dev mailing list, but perhaps I should more?

Post reply on HN