Post 9ghfydiMkyouRTIPFQ by templewulf@mastodon.gamedev.place
(DIR) More posts by templewulf@mastodon.gamedev.place
(DIR) Post #9ghcbn6PO4yz2DxGS0 by alcinnz@floss.social
2019-03-12T18:05:49Z
1 likes, 3 repeats
Reminder: if you don't use JavaScript, you don't get crashes. And don't need loading screens.I'm liking this post: https://dev.to/winduptoy/a-javascript-free-frontend-2d3e
(DIR) Post #9ghdCVEambt8KhHwC8 by alexbuzzbee@fosstodon.org
2019-03-12T18:12:27Z
0 likes, 1 repeats
@alcinnz I've felt for a while that most webapps could be implemented with <form> and reasonable CSS, if that. Client-side scripting is way overused.
(DIR) Post #9ghdeieySdDU505Cdc by carbontwelve@d20hero.club
2019-03-12T18:17:38.767272Z
0 likes, 0 repeats
@alcinnz I need to check this out when I get home
(DIR) Post #9gheIgoClKz5vDSZ3g by alcinnz@floss.social
2019-03-12T18:24:45Z
1 likes, 0 repeats
And he's got a list of things he wants to be able to do without JS. discuss?"1. Why can't we have a standard search element that filters a list on the client side (similar to how ng-repeat | filter: worked on Angular)?2. Wouldn't a standard HTML element for drag-and-drop sorting be awesome?3. More advanced validation functionality, like comparing equality of two different form fields.4. The ability to do the modal/checkbox trick above without it feeling like a hack and writing weird CSS."
(DIR) Post #9gheeNHQ3Cvzj1SsBk by alexbuzzbee@fosstodon.org
2019-03-12T18:28:40Z
0 likes, 0 repeats
@alcinnz Basically what you need for 4 is the ability for an element to toggle the hidden attribute on another element. Maybe a 'shows' and/or 'hides' attribute?
(DIR) Post #9ghfydiMkyouRTIPFQ by templewulf@mastodon.gamedev.place
2019-03-12T18:43:30Z
0 likes, 1 repeats
@alcinnz the trick with `#myToggle:checked ~ #myToggledUI` was worth the read alone!I don't think I can agree that it's "plain and simple" when you have to trick the UI into clicking that checkbox by abusing the `<label>` tag. But I really like it in principle, and I would love to see this formalized in a more intuitive way.
(DIR) Post #9ghgTmZbs0BMtV3BBo by alcinnz@floss.social
2019-03-12T18:49:11Z
0 likes, 0 repeats
@alexbuzzbee I'd add that I think modals have become a useful and dominant enough UI pattern on The Web (particularly in the form of "lightboxes") that I believe they should be native to HTML.Maybe there's an attribute on links and buttons for that. Which could also set a side of this element to place it on, or maybe even pull in entire webpages for UIs like Stripe or OpenStack Horizon.
(DIR) Post #9ghgaqdf9ZfzWuJbJg by alexbuzzbee@fosstodon.org
2019-03-12T18:50:27Z
0 likes, 1 repeats
@alcinnz Perhaps add a 'modal' attribute to <button> that opens a modal document iframe-style? Or perhaps a modal element which is given by id?
(DIR) Post #9ghgdEAMeMBB4tkICG by alcinnz@floss.social
2019-03-12T18:50:52Z
0 likes, 0 repeats
@alexbuzzbee I like it!
(DIR) Post #9ghkLA8rGzdlCWgO4u by dwardoric@chaos.social
2019-03-12T19:32:25Z
0 likes, 1 repeats
@alcinnzInteresting read, thanks for sharing.Remember the times when it was called unobtrusive javascript?Somehow things have gone a bit downhill since then.
(DIR) Post #9ghmJveDsO3HrotP8a by ranfdev@linuxrocks.online
2019-03-12T19:54:35Z
0 likes, 1 repeats
@alcinnzActually, there is already an element for dialogs, lightboxes and modals, but it's still not supported everywhere (ex. It doesn't work on Firefox for android)<dialog>https://developer.mozilla.org/en-US/docs/Web/HTML/Element/dialog@alexbuzzbee
(DIR) Post #9ghnD3S0ZBCHzjSudU by alcinnz@floss.social
2019-03-12T20:04:37Z
0 likes, 0 repeats
@ranfdev @alexbuzzbee From what I can tell from that page, this doesn't fully answer the need: how do you open the dialog without JS? But it would be useful to encourage using this element alongside what we were discussing.
(DIR) Post #9ghnpRCihT7efWcJEW by ranfdev@linuxrocks.online
2019-03-12T20:11:30Z
0 likes, 1 repeats
@alcinnzYou still need a bit of js to toggle the open attribute of the <dialog>, but at least it should be more accessible than a custom modal.Maybe they could add a way to connect the value of an attribute (like open="true") to a checkbox's state@alexbuzzbee
(DIR) Post #9giFWKZxuBf3KtAQVs by tleydxdy@pl.smuglo.li
2019-03-13T01:21:56.715290Z
0 likes, 0 repeats
@alcinnz @alexbuzzbee @ranfdev there's nothing wrong with using js, just that some developers are evil.
(DIR) Post #9giGnSj8xq3vU3C1wW by alcinnz@floss.social
2019-03-13T01:36:07Z
0 likes, 0 repeats
@tleydxdy I won't shame anyone for using JavaScript, it's the tool we have now.But I don't think it should have ever been a part of the web. All our standards should have remained declarative for the sake of user-control, accessibility, and ease of authorship. Not to mention security in the face of vulnerabilities like Spectre.Just so you know where I'm coming from.
(DIR) Post #9giHsdeBtHs2knuNyC by alcinnz@floss.social
2019-03-13T01:48:15Z
0 likes, 0 repeats
@tleydxdy As for the author of the blogpost which this discussion is centered around, he's enjoying stripping out all the JavaScript which was slowing down his service and making it more fragile. And he wishes he could strip out more.
(DIR) Post #9giIK0z7ELw6x7kYgi by tleydxdy@pl.smuglo.li
2019-03-13T01:53:21.097329Z
0 likes, 0 repeats
@alcinnz my opinion is that HTML should represent something static and simple, it defines how a page's format. Handling logic using another language (js) is the right choice. The problem that js now causes, is because people are evil, and they'll find a way no matter what. Just look at web assembly, at least you can only obfuscate js.
(DIR) Post #9giJ3fsG3Fa6nfJYXY by alcinnz@floss.social
2019-03-13T02:01:28Z
0 likes, 0 repeats
@tleydxdy I'm confident they wouldn't find a way if we didn't give them Turing Completeness. Which yes, requires great care.But yes it is worth considering whether creating another language is appropriate for the tasks he (or anyone else) cites. And in the case of triggering modal dialogs to show, it looks to me like just a different presentation of link traversal.
(DIR) Post #9giKYMDXHim4lbSgS0 by tleydxdy@pl.smuglo.li
2019-03-13T02:18:21.222086Z
0 likes, 0 repeats
@alcinnz I'm not really talking about the turing completeness of js. but I meant it is just as easy to let people install a plug-in that does what they want, and once it got popular, web browsers will have to include them. btw PowerPoint with links and animation is turing complete.
(DIR) Post #9giLzIfsfHlnYH8BAO by alcinnz@floss.social
2019-03-13T02:34:18Z
0 likes, 0 repeats
@tleydxdy Yes, avoiding Turing Completeness can be difficult. And yes, other measures would be necessary to achieve widespread privacy.But I do wish to explore route of replacing JavaScript. Think of the worthwhileness of that what you will.
(DIR) Post #9glGkFVqDpA16ZJojw by alvarezp@mastodon.xyz
2019-03-14T12:19:39Z
0 likes, 0 repeats
@alcinnz Yes! I like these proposals. I have gone myself through this when working with database-related frontends without JS and also came up with some needs:1. A multi-column SELECT element.2. A data grid. As opposed to tables, data grids can't span and allow sorting by columns.3. Selecting the sort column for this hypothetical datagrid via URL, something like page.html?var=val#anchor##table1.sort=name,asc.4. A "select all / deselect all" mechanism for forms.
(DIR) Post #9glVIggj5ZyManj39U by alvarezp@mastodon.xyz
2019-03-14T12:37:29Z
0 likes, 1 repeats
@tleydxdy @alcinnz @alexbuzzbee @ranfdev There *is* something wrong with using JS [in documents like HTML] although sometimes we don't have a better choice. As an end-user, allowing Web-wide open Javascript means allowing arbitrary remote code execution [with some limits, but still]. JS, being imperative, not only allows for evil but even makes it difficult to detect. If we ever had a <cryptominer> HTML tag it woukd be easily blocked too.
(DIR) Post #9glWUKvTvQoSWnkJ4S by awe@sunbeam.city
2019-03-14T15:04:53Z
0 likes, 0 repeats
@alvarezp How is this related to JavaScript being imperative? If we had a declarative language in every web browser, I don't see how things would be any different.
(DIR) Post #9glWUL7BDwAd75DeIy by alcinnz@floss.social
2019-03-14T15:16:04Z
0 likes, 0 repeats
@awe @alvarezp What defines an imperative language is that you're specifying WHAT you want the browser to do, not HOW to do it. Thereby allowing the browser to decide the HOW, or even IF, itself.
(DIR) Post #9glc28KdkwwB5IRs36 by alvarezp@mastodon.xyz
2019-03-14T15:17:02Z
0 likes, 0 repeats
@awe Can you give an example?
(DIR) Post #9glc28aandhJslubui by awe@sunbeam.city
2019-03-14T16:02:29Z
0 likes, 0 repeats
@alvarezp Say that web browsers all had their own special Web version of Prolog. We would still be in exactly the same boat with arbitrary remote code execution. The issue isn't whether the language is declarative or imperative, it's fundamentally that we're, by default, downloading and executing whatever program someone asks us to, and that program can do whatever it wants. That is, what matters is the language's expressivity and API surface, not the programming style.
(DIR) Post #9glc28olwv2YakXw12 by alvarezp@mastodon.xyz
2019-03-14T16:14:35Z
0 likes, 0 repeats
@awe What terms would you use? Can't say "the problem is that JS is code" because HTML and CSS are also code. Can't say "the problem is executable code" because JS is interpreted, not executed. Nitpicking will always find a flaw. That's why I provided an example: a computer can identify and block a hypothetical <cryptominer> tag easily but can't identify if a piece of JS is a cryptominer or not as none of the individual instructions to cryptomine are actually malicious.
(DIR) Post #9glc89q548iVUp1kLA by alcinnz@floss.social
2019-03-14T16:19:17Z
0 likes, 0 repeats
@alvarezp @awe I tend to say "Turing-complete", but that tends to sound overly technical even to technical people.
(DIR) Post #9gldtRbUvzEU9oJmM4 by alvarezp@mastodon.xyz
2019-03-14T16:39:02Z
0 likes, 1 repeats
@alcinnz @awe That would be a better term but I read somewhere that CSS was recently proven to be turing-complete so I am also not sure.. Now that I looked at Prolog syntax, I probably should have not used the term "declarative". But the point remains. Have you seen the video about using JS in PDFs? Same principle. I don't have enough knowledge of formal languages and grammars to properly express myself.
(DIR) Post #9glhpJmcT8AUYno9s8 by awe@sunbeam.city
2019-03-14T17:22:58Z
0 likes, 1 repeats
@alcinnz @alvarezp I think a perfectly reasonable way of talking about the issue is simply as arbitrary code execution. The whole point of something like blocking a <bitcoinminer> tag or something would be that the tag is _not_ arbitrary code, but rather refers to a specific program with specific behavior. It's the restriction of the language to specific behaviors that makes things like HTML and CSS less problematic.
(DIR) Post #9gljKYroXOICGzhR4a by alcinnz@floss.social
2019-03-14T17:39:58Z
0 likes, 0 repeats
@alvarezp @awe I looked into that, and the reality is CSS+HTML was kind-of proven Turing-Complete. The proof relies on humans doing exactly what the machine tells them, which I don't consider a serious threat. User input (specific clicks or key presses) was the clock signal.Clever idea though!
(DIR) Post #9gljQxfTF1JEvfygS0 by awe@sunbeam.city
2019-03-14T17:39:51Z
0 likes, 1 repeats
@alvarezp @alcinnz It's worth saying that Turing-completeness is at some level a kind of naive view of the issue (and itself is also a very narrow way of talking about language expressivity). CSS might be "technically" Turing-complete (probably only when you include user interactions), but it's not actually as expressive as JavaScript (esp. including the APIs that are made available to JavaScript programs to interface with the browser).
(DIR) Post #9gluqXYE44IgxDzLqC by alvarezp@mastodon.xyz
2019-03-14T19:48:59Z
0 likes, 1 repeats
@alcinnz @awe So, not by itself? That is good. In any case, CSS is much easier to audit and contain. Once I discussed in Twitter about JS and tracking and got the immediate the response: you can get tracked with CSS too. I saw a somewhat unreliable PoC involving CSS selectors for text input content and remote styling for different cases. But a browser can easily just retrieve all the listed CSS resources on page load.