Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Implement window.{alert, prompt, confirm} removal from cross-origin iframes

bugs.chromium.org

Post reply on HN
Print view View original

81–90 of 160 posts

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#81

Post by gzer0 »

phillipseamore wrote: post #23
trangus_1985 wrote: post #13

This makes a lot of sense, and is (IMO) a really great thing to do for users. IMO Cross Origin iframe alert/prompt should only be allowable with CSP rules explicitly permitting the cross origin iframe in the first place (in allowlist capacity). The amount of abuse this has seen and will see is a blight, especially on the average user. HOWEVER What the hell, Chrome? This timeline for a change of this magnitude is INSA…

Switch to Mozilla? They are positive to this, and Webkit also. That is often the case, Chromium just has a faster turn-around then the others so usually are first to implement. The discussion about this started a year ago with the individual browsers and WHATWG. https://bugzilla.mozilla.org/show_bug.cgi?id=1624978

Microsoft Edge released 92.0.902.62 today which now re-allows the dialogs in cross domain iFrames. We are suggesting that our user base moves from Chrome to Edge.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#82

Post by asdfasgasdgasdg »

sambeau wrote: post #59
asdfasgasdgasdg wrote: post #34

Earlier quoted context omitted.

What's insane about the timeline? They started talking about this a year and a half ago, approved it winter this year, and had it out in beta in May. How much longer should they take? What's insane about the opt-out process? It seems very easy to me. I was able to generate an opt-out token in about three minutes for example.com. I'm a backend developer so I don't know too much about web servers, but I imagine it woul…

“But look, you found the notice, didn’t you?” “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”

This is the noticeboard for upcoming proposed changes for Blink. You may not have known about its location before, but that does not mean it was hidden away or intentionally obscure.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#83

Post by sbierwagen »

akersten wrote: post #20
bawolff wrote: post #9

Earlier quoted context omitted.

Idk why everyone jumps to these paranoid conspiracy theories - alert() box to trick people has been a thing for decades, and its super rare for it to be used legitly outside of debugging.

How often is it that you have a malicious iframe on your website being used to trick people though? Why only remove it from iframe and not the entire browser if that is the concern? Why was this concern not alleviated with better UI for the standard alert dialogs? Alert dialogs and prompts are huge for accessibility - they're genuinely one of the best ways to get a screenreader's attention and have the user interact…

The only time I've seen alert boxes used is in XSS demos and attack ads that break the sandbox to spawn 1000 popups that they say the FBI is blackmailing me, and that I should send 0.5 bitcoin to this address now.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#84

Post by asdfasgasdgasdg »

_jal wrote: post #40
asdfasgasdgasdg wrote: post #34

Earlier quoted context omitted.

What's insane about the timeline? They started talking about this a year and a half ago, approved it winter this year, and had it out in beta in May. How much longer should they take? What's insane about the opt-out process? It seems very easy to me. I was able to generate an opt-out token in about three minutes for example.com. I'm a backend developer so I don't know too much about web servers, but I imagine it woul…

> which you have to abide by using google.com or any other Google web property When did my web site become a Google property?

> When did my web site become a Google property?

It isn't. Not sure that's relevant to the discussion though. We're talking about Google's TOS, which presumably the person at the start of this thread is concerned about having to accept to get an origin trial token.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#85

Post by dylan604 »

habibur wrote: post #63
dylan604 wrote: post #60

Earlier quoted context omitted.

>(at least on my 50 year old fork of firefox). Since you're obviously from the future, can you give me tips on some stocks or sporting events to "invest"?

That's a way of saying "decades old". Not to count years literally.

yes, and it's also understood that people are not really from the future with the information that I requested. Did you really think that was what I believed so that you needed to pedantically explain it to me?

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#86

Post by dylan604 »

ceejayoz wrote: post #74
dylan604 wrote: post #62

Earlier quoted context omitted.

I miss writing HTML instead of telling Javascript how to create the HTML that I would use. I preferred JQuery's $(' ') vs document.createElement('element').append(document.createElement()) bullshit

Might be worth looking at Vue and Svelte.

nah, now i just hand it to the frontend aliens that like that stuff.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#87

Post by jfoster »

voidnullnil wrote: post #51
userbinator wrote: post #4

Earlier quoted context omitted.

Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.

The entire web does this, not just Google. Alert is pure garbage and should not have made it past the 90s. Also, basic auth popups need to go too. Not sure why browsers would ever make those focus stealing in the first place. There should not be one single way for a web application to steal focus. The current workaround is to download a buggy ad blocker (last time I used chrome, just like firefox it has no way to tur…

I would like to point out that stealing focus is part of the browser implementation. I don't think anyone would object to less stuff (if anything) stealing focus.

If the problem is "this functionality steals focus", how about making it not steal focus rather than removing it entirely on short notice? Why don't the Chrome developers focus on fixing their browser?

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#88

Post by danShumway »

ehsankia wrote: post #68
danShumway wrote: post #35

This is peak Chrome; what seems to be a reasonably good idea that's hampered because it was pushed out thoughtlessly without putting any serious effort into notifying the people affected or making sure that nothing else breaks, or making sure that it thoroughly solves the problem. The product owners at Chrome are smart, but they're careless and constantly break the web because they don't seem to have enough of a sens…

Hmm, the linked bug is from March 2020, and this thing will be Removed in December 2021. That's nearly 2 years, no?

Yes, and yet people were still caught off guard. Which is in some ways even worse to me, because what were they doing for those 2 years?

When someone maintains the largest browser in the world, and almost every public website in the entire world relies on maintaining compatibility with that browser, then the standards for reaching out about breaking changes are a lot higher. The amount of time is only one aspect of this, the other is making sure that people actually understand the change is happening.

That is of course, a wildly difficult problem. But while I'm sympathetic to the sheer difficulty of getting people's attention at that scale, I also feel that nobody is forcing the Chrome team to own the entire web. If they're going to be in that position, then they need to act like they're in that position.

At the very least, what internal studies were done over those 2 years to check and see which sites would be broken? How did they miss services like Repl.it during those studies?

My frustration with the Chrome dev team is that they handle feature changes and testing as if they're managing some kind of niche Open Source project, when in reality they are maintaining one of the most important pieces of software in the world. They're not Arch, they're not in a position where they can reasonably dismiss people who get caught by breaking changes because they aren't following the release notes. At the scale of Chrome it becomes their job to make sure website maintainers know about future changes and that nothing breaks.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#89

Post by asdfasgasdgasdg »

zelon88 wrote: post #79
phillipseamore wrote: post #23

Earlier quoted context omitted.

Switch to Mozilla? They are positive to this, and Webkit also. That is often the case, Chromium just has a faster turn-around then the others so usually are first to implement. The discussion about this started a year ago with the individual browsers and WHATWG. https://bugzilla.mozilla.org/show_bug.cgi?id=1624978

From the Google discussion on this change back in March, located here [1]..... > "We haven’t engaged with other browser vendors regarding this change yet, but plan to submit a spec change proposal once the change is approved for Chrome. Since PRs to the HTML spec require one more vendor to support (and none to oppose), we’ll reach out to other vendors before sending the PR." The first comment response reads..... > "A…

> awknoledge that it is not in the web's best interest to do so

The two people you are quoting don't appear to be Google employees. Maybe I'm wrong, but it appears that the Google employees are usually using @chromium.org or @google.com email addresses.

Edit, correction: at least one of the people is a Google employee using a personal email address. I regret the error. Nonetheless, I don't agree with the characterization of the responses.

Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes

#90

Post by sloshnmosh »

I’ve been tracking a massive mobile malvertising and drive-by malware download operatition for the last several months.

The malvertising company is abusing a script found on GitHub called: “alerty” hXXps://github.com/undead2/alerty#readme

Post reply on HN