I had exactly the same thought, my wife is doing a Shecodes course and the confirm and alert features are very good simple UI components that require no additional work, it allows beginners to piece together a complete experience without having to build a whole UI stack.

And letting go of beginners... removing them seems like the reverse of what we need to do here. They should be improved to the point that no one needs custom confirm dialogs anymore.

It makes no sense at all that we require so much reinvention of the wheel on the web, even down to these ultra-generic features.

> I know these are almost never used in professional projects

Well, ignore me clearing my throat and wiping away the sweat on my head, but at least confirm() is quite useful.

Yes, I could make something that acutally looks nice and has better usability, but sometimes you want to ask a quick question and looks aren't important.

Still, I don't think these commands are affected, just when the script comes from another source, which is a new policy, since script origin wasn't ever questioned by browsers.

No, this is about alerts from cross origin content, like from an iframe that loads from a different origin than the parent page

Google is planning to remove alerts entirely: https://twitter.com/Rich_Harris/status/1422930436850860033

Direct source:

> Major browser vendors are generally aligned about wanting to move the platform away from alert() and friends, even though it will unfortunately involve some breakage.

- https://twitter.com/estark37/status/1422694855390629893

That at least doesn’t seem like any kind of near-future thing.

I just hope there’ll be some replacement, we use confirm() to prevents users from losing changes that weren’t saved (just like many other sites including fastmail and google)

It would still break sites like codepen.io that use iframes for this.

codepen's iframes are their own, not cross-origin

They're on another domain they own, but they are on another domain (cdpn.io) and the cross-origin concern does apply. They do that because they have auth cookies on codepen.io and don't want them exposed to the iframe.

See these tweets by their cofounder: https://twitter.com/chriscoyier/status/1422940724295786503?s... and https://twitter.com/chriscoyier/status/1420033471376920578?s...

if they were on the same domain you could load iframes with the parent site and do arbitrary CSRF

What about console? It is easy to use for beginners and really powerful if you want to dig deeper. Even as a beginner I always found alert() really awkward. Now that I am programming Javascript for a living I never use it.