Google hits undo on limiting JavaScript capabilities in cross-origin iframes

Re:Google hits undo on limiting JavaScript capabilities in c... by phpnode on Thursday August 05, 2021 @06:45AM (#28071974)

You're underestimating the level of breakage here, it's not just a few tutorial sites it's tens of millions of websites, many unmaintained. Like them or not alert(), confirm() and prompt() are key pieces of functionality depended on for literally decades now. I'm trying to imagine the economic cost of this change and it's just enormous.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by riho on Thursday August 05, 2021 @06:49AM (#28072003)

I understand that. But that was the case with popups as well. Remember when we needed popup blockers? Straight up removing the functionality is of course a drastic measure, so realistically I could see something like what we did with popups, where the browser first asks you if you'd like to allow alerts on the page, and only allow them to be shown if the user explicitly chooses so.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by pineconewarrior on Thursday August 05, 2021 @08:37AM (#28072835)

This is the fix. Deprecate alerts gracefully in favor of the native dialogue element!

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by pjmlp on Thursday August 05, 2021 @07:51AM (#28072411)

I still see them everywhere.

[ Parent | on HN ]

Re:Google hits undo on limiting JavaScript capabilities in c... by user5994461 on Thursday August 05, 2021 @08:47AM (#28072930)

It's only blocking when inside an iframe.

There may be millions of sites using these functions legitimately, but not inside an iframe.

[ Parent | on HN ]