chromium VS construct-stylesheets

One of the unexpected use of shadow DOMs for me was a document generated for image resource URLs [1], because the HTML standard apparently specifies the exact DOM structure of the generated document except for the `` element [2].

[1] https://github.com/chromium/chromium/blob/f02ca73/third_part...

[2] https://html.spec.whatwg.org/multipage/document-lifecycle.ht...

Recently my favorite open source mouse gestures extension SmartUp Gestures was taken over by some shady entity (with github no longer being updated of course).

I opened Chrome ticket that they should ask to re-enable extension when ownership changes. They just closed the ticket replying with this link:

https://chromium.googlesource.com/chromium/src/+/main/extens...

:(

Hmm. It looks like files with the .lnk or .pif file extension can only be downloaded on a user gesture: https://chromium.googlesource.com/chromium/src/+/39841e54180...

So it can't be done silently. Although, I do wish the type was marked "DANGEROUS" a la dll files.

On Linux, Chromium uses setuid or user namespaces to restrict the access of sandboxed components and seccomp-bpf to reduce the kernel attack surface.

Check out the Chromium docs on this topic: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/l...

You can also disable JIT in Firefox by setting javascript.options.baselinejit to false in about:config, although you won't get CET.

[1] https://github.com/chromium/chromium/blob/12c232c43ce7324d30...

Chromium targets iOS already: https://chromium.googlesource.com/chromium/src/+/main/docs/i...

For the sake of completeness, I've traced the evolution of the notice over time:

From 2008-07-26: "Going incognito doesn't affect the behavior of other people, servers, or software. Be wary of: / • Websites that collect or share information about you / • Internet service providers or employers that track the pages you visit / • Malicious software that tracks your keystrokes in exchange for free smileys / • Surveillance by secret agents / • People standing behind you" (https://chromium.googlesource.com/chromium/src/+/09911bf300f...)

From 2013-12-07: "Going incognito doesn't affect the behavior of other people, servers, software, or people standing behind you." (https://chromium.googlesource.com/chromium/src/+/c5e36c57178...)

From 2013-12-13: "However, you aren't invisible. Going incognito doesn't hide your browsing from your employer, your internet service provider, or the websites you visit." (https://chromium.googlesource.com/chromium/src/+/70821506825...)

From 2014-02-27: "However, you aren't invisible. Going incognito doesn't hide your browsing from your employer, your internet service provider, governments and other sophisticated attackers, or the websites you visit." (https://chromium.googlesource.com/chromium/src/+/ab54bd65701...)

From 2014-04-29: "Going incognito doesn't hide your browsing from your employer, your internet service provider, or the websites you visit." (https://chromium.googlesource.com/chromium/src/+/eb09a62ef40...)

From 2016-01-15: "However, you aren't invisible. Going incognito doesn’t hide your browsing from your employer, your internet service provider, or the websites you visit." (https://chromium.googlesource.com/chromium/src/+/b7dac1a6a79...)

From 2017-02-27: "Your activity might still be visible to: / • Websites you visit / • Your employer / • Your internet service provider" (https://chromium.googlesource.com/chromium/src/+/cfe102adddc...)

From 2017-03-29: "Your activity might still be visible to: / • Websites you visit / • Your employer or school / • Your internet service provider" (https://chromium.googlesource.com/chromium/src/+/7ca3ccf74e8...)

(Note that some of these were behind a feature flag for a few months.) Also, it looks like they've been intending to modify the new-tab page text for Incognito windows for some time, as part of the "Revamped Incognito NTP" project. You can view the modified text with 'chromium --enable-features=IncognitoNtpRevamp':

From 2021-08-13: "What Incognito doesn't do / Incognito does not make you invisible online: / • Sites know when you visit them / • Employers or schools can track browsing activity / • Internet service providers may monitor web traffic" (https://chromium.googlesource.com/chromium/src/+/e6ae57ba385...)

From 2022-01-25: "What Incognito doesn't do / Incognito does not make you invisible online: / • Sites and the services they use can see visits / • Employers or schools can track browsing activity / • Internet service providers can monitor web traffic" (https://chromium.googlesource.com/chromium/src/+/8b349f6c984...)

Blink can now be compiled for iOS, but without JIT or WASM:

https://chromium.googlesource.com/chromium/src/+/main/docs/i...

https://bugs.chromium.org/p/chromium/issues/detail?id=141170...

I think its weird that Vercel has this limit. There is no practical reason I can think of for having such a limit on URL characters that is so small. Chrome suggests a 2MB limit[0] for example. The platform itself doesn't have one, and Firefox I believe if memory serves (I can't find the source for this claim atm) is 1 MB effectively, and I don't think Safari is any lower than that either (and may well be more inline with Chrome on this, at 2 MB)

[0]: https://chromium.googlesource.com/chromium/src/+/master/docs...

> With adoptedStyleSheets they're objecting to making backwards incompatible changes

Which would not be bacwards incompatible if they hadn't shipped something that wasn't agreed on in the first place.

Again, slowly: they literally shipped that to production despite loud and explicit objecitons from both Firefox and Safari they shipped it to production. When asked to hide it back behind the flag, "but backwards incompatible change, the framework we're developing is already depending on it"

And since you're quoting rniwa, here's the relevant quote https://github.com/WICG/construct-stylesheets/issues/45#issu...:

--- start quote ---

I feel like I’ve put so much time & energy into making this feature something sane & useful, and all you did was basically to dismiss many of my feedbacks and go with whatever you like and just ship it. And now you’re saying you can’t make changes because you shipped it?

I’m sorry but that’s just not how standards work.

--- end quote ---

> With WebMIDI they're saying they want to do an announcement before making the change.

Indeed. Once again: because they shipped an API that neither Safari nor Mozilla supported. Now that this issue has surfaced (no thanks to Chrome), they can't just roll it back or fix it because people already rely ono this behaviour, which the implicitly acknowledge.

It's not true, to w3c's surprising credit.

What Google does, is publish a "draft" which is as far from a standard as their authors are from the Moon. This gives Chrome the leeway to call it an "emerging standard" and just ship it. It doesn't care if there are objections, or that other browser vendors will not implement it. It's now a "standard" in Google's dictionary.

For something to become a W3C standard even in the present world, you need a consensus and at least two independent implementations. None of that exists for stuff Google pushes out (hardware APIs, web transport, constructible stylesheets [1], the list goes on...).

The correct name for those is Chrome-only non-standards.

[1] These one isn't even a draft. It is.... "a collection of interesting ideas" in a working group https://wicg.github.io/construct-stylesheets/ Shipped by default in Chrome, of course

I literally provided just some of the examples. Those are easily verifiable.

Web Transport is shipped by default. What was the input from other browser?

Here's the timeline for HID: https://github.com/mozilla/standards-positions/issues/459#is...

Constructible Stylesheets: the spec contained a trivially reproducible race condition, the API was badly specified. Google shipped against any objections and refused to bring it back under the flag. Full discussion here: https://github.com/WICG/construct-stylesheets/issues/45. Shipped in Chrome https://github.com/WICG/construct-stylesheets/issues/45#issu... (may be hidden on mobile) despite multiple unresolved issues. Two years later Chrome did add a better API that people originally requested, other issues potentially remain.

> If there are examples of 'Apple ignoring standards' actually meaning Chrome-only features please tell me one.

Easy.

The most obvious/glaring one is WebHID. Enjoy the timeline: https://github.com/mozilla/standards-positions/issues/459

It's not just HID, of course. All/most of the hardware APIs are considered harmful by both Safari and Mozilla. Chrome is shipping them enabled by default, and there's no end to clueless developers maoning about this and calling Safari (mostly) and Firefox (from time to time) too slow in "moving the web forward". Needless to say that all those non-standards are pushed forward by Chrome.

The less obvious one is Constructable Stylesheets.

The spec had an obvious flaw that could lead to easily reproducible deadlocks. And that is on top with other issues with design, API naming etc. A team within Google (lit-html) wanted this feature, so Chrome shipped it against clear objections from both Safari and Firefox. And then refused to move the feature back under a flag because "0.8% of page views in Chrome" were suddenly using this feature. And proceded to gaslight other browsers' developers https://github.com/WICG/construct-stylesheets/issues/45. See e.g. a response to that https://github.com/WICG/construct-stylesheets/issues/45#issu... Of course there's now a "looking ahead" that wants to do exactly what Safari and Mozilla wanted to do in the first place: https://web.dev/constructable-stylesheets/#looking-ahead

In general, Chrome pushes 40 to over 100 new Web APIs with each release (that is, every two months). How many of them are actual standards that had actual input from other browser developers? In how many Chrome actually listened and implemented suggestions? https://web-confluence.appspot.com/#!/confluence

> The negatives are often theoretical

They are not theoretical. Too bad webapicontroversy.com has been shut down (it looked like this [1]), but you can scroll down to "defer" and "considered harmful" in Mozilla's positions here: [2]

There are more, of course, but they are not visible unless you're willing to follow thousands of issues across hundreds of GitHub repositories. One that springs to mind is, of course Constructible Stylesheets. Mozilla and Safari: the spec describes an algorithm that leads to deadlock in trivial code, we wont implement it until this is fixed. [3] Chrome: ship it, because lit-html (developed by Google) wants it and is already using it. And then procedes to gaslight people and misrepresent their positions (cant' find the relevant link, but at this point I can't find the will to dive into the cesspool).

[1] https://user-images.githubusercontent.com/32768/108985355-3f...

[2] https://mozilla.github.io/standards-positions/

[3] https://github.com/WICG/construct-stylesheets/issues/45#issu...