News for hackers. Stuff that matters.
Re:Canistilluse.com by gkoberger on Wednesday August 25, 2021 @11:58PM (#28310509)
It's not! Just being able to trigger alert from an iFrame that is being reconsidered.
Re:Canistilluse.com by anonydsfsfs on Thursday August 26, 2021 @12:27AM (#28310716)
That's just the immediate change, but the Chrome team has said they plan on removing alert() entirely: https://twitter.com/domenic/status/1422647331804037120
Re:Canistilluse.com by jacquesm on Thursday August 26, 2021 @12:37PM (#28317186)
The Chrome team are a bunch of entitled jerks. They keep doing these things completely tone deaf and disconnected from the rest of the world. Unfortunately this seems to be fairly common with large software vendors in general, as soon as they have a captive audience they immediately turn hostile.
Re:Canistilluse.com by shp0ngle on Thursday August 26, 2021 @05:47AM (#28312655)
It's a random Twitter thread where it's not even clear if they talk about alert() in general, or iframe alerts.
Re:Canistilluse.com by dmitriid on Thursday August 26, 2021 @08:23AM (#28314034)
It's not a random twitter thread. That's one of Chrome's main standards-writing people. And he explicitly talks about the removal of these entirely.

There's more in Intent to Remove: https://groups.google.com/a/chromium.org/g/blink-dev/c/hTOXi...

--- start quote, emphasis mine ---

We’re on a long, slow path to deprecate and remove window.alert/confirm/prompt and beforeunload handlers due to their role in user-hostile event loop pausing, as well as phishing and other abuse mechanisms. We’ve been successfully chipping away at them in various cases, e.g. background tabs, subframes with no user interaction, and now cross-origin subframes. Each step is hard-fought progress toward the eventual goal

--- end quote ---

Re:Canistilluse.com by jrochkind1 on Thursday August 26, 2021 @09:13AM (#28314477)
Thanks for this!

It ought to be a lot easier than this detective-work to discover this plan. Like, we should probably all know about it, and stop using these user-agent modals now working to replace all use of them?

(rails-ujs, for instance, still uses window.confirm for opt-in "are you sure" on form submissions. not sure what a good replacement is honestly. This is something I would hope to see people discussing and figuring out...)

Re:Canistilluse.com by achairapart on Thursday August 26, 2021 @12:22PM (#28316974)
Still, just a bunch of Google Devrels that decided out of the blue to break the web, because... well, they can.
Re:Canistilluse.com by jacquesm on Thursday August 26, 2021 @12:38PM (#28317202)
Exactly that. It is amazing that a bunch of isolated developers has the ability to inflict such damage on the web by breaking backwards compatibility.
Re:Canistilluse.com by shp0ngle on Thursday August 26, 2021 @08:26AM (#28314062)
okay, that’s actually a useful source, thanks.
Re:Canistilluse.com by jrochkind1 on Thursday August 26, 2021 @09:12AM (#28314459)
oh wow. that's gonna break a LOT of things. I hope they agreed the value of that removal has to be very high for that level of breakage, and decided it was... if decision-makers just don't care about breakage anymore, that would be disturbing.
Re:Canistilluse.com by q-rews on Thursday August 26, 2021 @12:07AM (#28310576)
> being able to trigger alert from an iFrame that is being singlehandedly removed by the Chrome team.

Fixed that for you. It’s not being reconsidered; The Chrome team makes decisions for the web whether you agree with them or not. They might pull the “proposal” only to just do it again later. [1]

More context on the same blog [2]

1: https://www.quirksmode.org/blog/archives/2017/09/chrome_brea...

2: https://www.quirksmode.org/blog/archives/2021/08/breaking_th...

Re:Canistilluse.com by bokan on Thursday August 26, 2021 @10:33AM (#28315460)
Disclaimer: I'm the one who made the change in [1] so I'm biased but...

IMHO the argument on the blog mischaracterizes the situation - Chrome didn't break these properties but changed how they're interpreted under pinch-zoom. This was done precisely to keep backwards compatibility (on desktop browsers): at the time, the vast majority of pages assumed pinch-zoom can't happen on desktop (something that was becoming more common). The status quo meant zooming in on a desktop page would cause it to "swim" as various "fixed" elements shifted around, JS drop-down menus appeared in the wrong place, etc. This happened virtually everywhere one looked: facebook, twitter, apple.com, etc.

The blog basically argues for "make pages fix themselves" which, even if major sites do, is unrealistic in the long tail.

> They might pull the “proposal” only to just do it again later

It's not nefarious, this often happens in response to feedback and real world experience to try and minimize disruption. In this case, developers convincingly argued that there should be an API to better react to pinch-zoom before making the change.

Re:Canistilluse.com by jacquesm on Thursday August 26, 2021 @12:39PM (#28317212)
Then you go to the standards body.