Google hits undo on limiting JavaScript capabilities in cross-origin iframes

Re:Google hits undo on limiting JavaScript capabilities in c... by riho on Thursday August 05, 2021 @06:37AM (#28071913)

Perhaps a controversial take, but I would be happy to see alerts removed altogether. I'm sure someone can point to a few legitimate uses of them, but in the grand scheme of things, they're usually terrible for user experience, as they block everything else (which is the point). This is also often used as a way to scam less computer literate people with "microsort security" alerts, that keep getting reopened when closed.

I get that there are lots of JS tutorials out there that use it as a way to show simple interactions, but that's a very weak argument for keeping an API that is potentially harmful.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by phpnode on Thursday August 05, 2021 @06:45AM (#28071974)

You're underestimating the level of breakage here, it's not just a few tutorial sites it's tens of millions of websites, many unmaintained. Like them or not alert(), confirm() and prompt() are key pieces of functionality depended on for literally decades now. I'm trying to imagine the economic cost of this change and it's just enormous.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by riho on Thursday August 05, 2021 @06:49AM (#28072003)

I understand that. But that was the case with popups as well. Remember when we needed popup blockers? Straight up removing the functionality is of course a drastic measure, so realistically I could see something like what we did with popups, where the browser first asks you if you'd like to allow alerts on the page, and only allow them to be shown if the user explicitly chooses so.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by pineconewarrior on Thursday August 05, 2021 @08:37AM (#28072835)

This is the fix. Deprecate alerts gracefully in favor of the native dialogue element!

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by pjmlp on Thursday August 05, 2021 @07:51AM (#28072411)

I still see them everywhere.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by user5994461 on Thursday August 05, 2021 @08:47AM (#28072930)

It's only blocking when inside an iframe.

There may be millions of sites using these functions legitimately, but not inside an iframe.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by asddubs on Thursday August 05, 2021 @07:12AM (#28072139)

it's not like you couldn't do the exact same microsort security alerts with a position:absolute overlay. Google can just make the alert window explicitly stay within the viewport instead of breaking the internet.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by shikoba on Thursday August 05, 2021 @07:18AM (#28072185)

Correct problem. Incorrect solution. Like always.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by remus on Thursday August 05, 2021 @08:07AM (#28072543)

When there are billions of users and millions of websites I think it's very rare that you'll have 'correct' solutions, just different trade offs.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by hulitu on Thursday August 05, 2021 @07:09AM (#28072121)

I do not see any added value for alerts. They only interfere with normal work. "Site wants to send you alerts". No thanks. They have most of the issues behind a paywall so they just want to serve more ads. If I need something, i will look for it. The newspaper sites are the worst offenders. No i do not need propaganda alerts.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by asddubs on Thursday August 05, 2021 @07:13AM (#28072151)

I think you're thinking of push notifications

[ Parent | on HN ]