Hacker News Reader

Comment by ktpsns | Hacker News Reader

> JavaScript, captchas, and logins, are the main “gotchas” for text-based browsing, if the functionality of a site (or part of the site) relies on any of these then most likely it will not work.

Really, there is no reason why a form should require JavaScript. When jQuery was hip, the js community celebrated "Graceful degradation". I frequently have the feeling this attitude is lost. That's super sad because it also excludes all the handycapped people.

Does even anybody remember the good old HTTP basic acess authentification? This is one of the most accessible ways of protecting ressources, it can be consumed by any HTTP client (!), and it is just reduced to the basic.

One of the worst things are these terrible captchas everywhere. I wonder why we cannot come up with a web standard interface in a way the captchas could be offloaded to customizable and adaptable GUIS rendered by the browsing client. This way, clients (users) could even declare what kind of captcha they can solve (blind people obviously cannot read images).

View on HN

> Does even anybody remember the good old HTTP basic acess authentification?

old, yes. good, no.

* Browsers never implemented a way to "log out", so creds end up cached in memory until the browser is restarted.

* There is no concept of a session so the credentials need to be included in each request and verified every time. If you use something like bcrypt or pbkdf2 on the backend that means every request will take hundreds of milliseconds.

* Since every request needs to be verified you can't easily use 2FA, without ugly hacks that 'remember' that the earlier creds were valid.

Hopefully things like WebAuthn will result in a resurgence of browser native autentication.

How does a "session" exist without "credentials" that have to be verified every time? Http is stateless so even non-native authentication solutions have to deal with these problems. Why can't your server generate a "session token" and require it to be passed using basic auth? Wouldn't you want to hash these "session tokens" on your server in case it becomes compromised?

non-native authentication solutions do deal with these problems. HTTP Basic auth does not. full stop.

> Does even anybody remember the good old HTTP basic acess authentification?

Yes! It was great! People would just transmit username and password in plaintext!

Wait. That's actually the opposite of great. That's why nobody uses it any more.

And no, handycapped people aren't excluded just because something doesn't degrade gracefully into a no-JS environment. You can (and many people do) make perfectly accessible web sites that still require JS.

As for offloading captchas to the client? That suffers a similar problem to basic auth - it's extremely vulnerable because attackers can obtain access to information that makes their job trivial. That's why we cannot "come up with a standard" - the client has to be treated as hostile, because there's no way to verify their integrity.

> Yes! It was great! People would just transmit username and password in plaintext!

> Wait. That's actually the opposite of great. That's why nobody uses it any more.

Unless of course, if you're using HTTPS, in which case HTTP basic auth is fine and very simple to configure for many use cases.

Yeah, I'm kind of surprised that the age of HTTPS-All-The-Things hasn't led to a resurgence in the use of Basic Auth. As you note, the security problems that have been the big knock on Basic Auth for decades are completely obviated if your whole site is served over HTTPS.

My guess on the reason why is two-fold. First, we've been telling people that Basic Auth is a terrible thing only stupid people would use for more than two decades now, and once a lesson like that gets hammered deep enough into the mass consciousness it tends to stay there even long after the underlying facts have changed. And second, using Basic Auth means giving up any possibility of styling/designing your login experience and relying instead on the browser's built-in dialogs, which tend to be clunky and ugly in the extreme.

The UX for basic auth is terrible on most browsers. In Firefox, the dialog box refuses to give up focus, preventing me from copying the password from my password manager (which, while integrated into the browser, doesn't support filling basic auth dialogs).

I've had reasonably good experiences with filling out Basic Auth dialogs in Firefox via KeePassXC/KeePassXC-Browser. But by "reasonably good" I mean that it works, the password gets filled in, but the whole experience is still more clunky and error-prone than filling in an HTML login form would be. So yeah, lots of room for improvement here.

It's still a security risk. MITM happens regularly. Which means you better constrain it to either low-risk auth, or to networks you completely control.

For further risks, see e.g. https://security.stackexchange.com/questions/988/is-basic-au...

Yes, it's simple. And you're trading off security for simplicity. Make that choice, maybe, for your Intranet or your small blog. Commercial sites that have stored PII really, REALLY shouldn't.

Thanks for the link, it's a good summary of the trade offs.

> It's still a security risk. MITM happens regularly.

Then it's more or less as broken as alternative authentication methods

Nope. Because other methods never transmit a password in cleartext. (And they especially don't transmit it with every single request)

How do they manage this feat over unencrypted stateless http? Surely they must transmit something with every request?

I think any thorough investigation will conclude that there is, in fact, no way to securely authenticate a web user over unencrypted http.

> Really, there is no reason why a form should require JavaScript.

I’m a web developer who has never done significant forms without JavaScript.

So I’m curious: how would you handle reactive form fields without client side scripting? For example (perhaps a bad example): the user is entering data in “rows”. The user clicks “add row” and then a new row of fields appears. The user can also delete rows on a whim. Their changes should only be persisted once submit is clicked.

Would the “right” way be a full page reload with the row added/deleted, and caching all the values?

Not to mention, if fields require cross validation, is it customary to have to submit the form to get the validation error messages to occur? On some of the forms I’ve worked on, this would be very complex.

> Would the “right” way be a full page reload with the row added/deleted, and caching all the values?

If the user didn't have Javascript enabled, then yes.

You'll have to do the validation server side anyway, client side scripting is just a "nice to have" it shouldn't be mandatory.

There are also probably too many people using the web to build applications that should be native.

> There are also probably too many people using the web to build applications that should be native.

I hear this a lot, but I'm personally glad I don't need to download an app to my phone/computer to order pizza or find directions.

Obviously this is a balance, but of the two extremes that could exist, having too many web-apps seems to be better than having too few. The quickest, simplest step you can take ATM to improve your device security is to install fewer apps -- particularly if you use an OS like Android.

It's not clear to me that situation would get any better if half of the web disappeared.

Split the form into pages, and use session variables to maintain state. Regarding form fields appearing and all your fancy front end logic: none of this would fly in user testing.

I find it mind-boggling there’s a generation of developers after me that doesn’t know the basics of server side state. No offence intended to yourself, and good on you for putting yourself out there to ask :)

As a web developer for the past 20 years, I do know how server-side state works. What baffles me is that, while there is certainly much to complain about the state of front-end JS dev today, the attitude of some that moving the web back 15 years is a good thing.

There is a reason single-page apps became a thing, so I'm not clear why you think a page refresh for every user interaction is somehow a good thing. The dismissive attitude that "Regarding form fields appearing and all your fancy front end logic: none of this would fly in user testing" flies in the face of how 90% of heavy consumer front ends out there work today.

Single-page apps became a thing because of lack of development resources to build native apps or properly engineer server side solutions (as well as a business desire to centralize and lock down the product so people have to experience ads, pay subscriptions...). It has nothing to do with creating a user friendly experience. 100% of the time a user would benefit from a native app or properly engineered server-side rendered web page over a SPA.

> 100% of the time a user would benefit from a native app

I strongly prefer single-page web apps over native apps. Web apps are constrained by my browser. Native apps get a lot more trust.

That's a problem we should have fixed on the platform side long ago, but didn't. Now we're stuck with the garbage fire of the modern web. That doesn't make it better.

> 100% of the time

Nothing in software engineering is absolute. And even if something were to be 100% the correct solution one day, the next it could change.

I agree, but there is one problem: most people would rather use an SPA than have to download an app and have to keep it up to date themselves.

I wonder if there's a market for an alternative "browser" that loads "native" code (or as close as practically possible) and runs it in a sandbox.

> I wonder if there's a market for an alternative "browser" that loads "native" code (or as close as practically possible) and runs it in a sandbox.

Electron comes close, but many don’t like it at all. (I have somewhat mixed experiences, I love VS Code but I’m not too fond of Slack.)

Electron isn't native in any sense of the word. I meant something more like OS-specific binary executables that get loaded and executed in a sandbox.

Mike Acton once said something about having created a browser plugin his team used that loaded and ran binary exe tools on demand, but that it was also wildly insecure. At least I think he said something like that. My memory could be wrong about that.

We had this 20 years ago with Java (not native obviously) and ActiveX (Windows x86 only.)

> most people would rather use an SPA than have to download an app and have to keep it up to date themselves

Citation?

> Citation?

No.

> I wonder if there's a market for an alternative "browser" that loads "native" code (or as close as practically possible) and runs it in a sandbox.

This is probably not what you had in mind, and I'm not sure how good it would be at sandboxing, but REBOL Reblets imho come close to this <http://www.rebol.com/reblets.html>

The question is what "browser" means. If viewing data connected by hyperlinks is the goal, that's pretty easy. Rebol's approach to X-Net (Executable Internet) apps is very different, with the goal of being a way to share both data and active content. You can do both, the web we know just wasn't designed for that.

Hah, you mean Java applets? Everything old is new again.

I meant something more like OS-specific binary executables that get loaded and executed in a sandbox.

I have uBlock Origin on my browser. I can even change the font-size on a web page if I need to. A native app can be doing anything it wants without my knowledge, and I can't even change the font-size.

Native apps have a performance benefit at the expense of everything we take for granted on the web, like being able to open up a developer console and inspect it.

For example, I noticed that the top language translation app on the Mac App Store incurs a Google Analytics request for every keystroke. And since there's no easy network tab I can open on any app, I only found it out because I was curious how it worked and mitm'd it with a proxy. And I couldn't just toss uBlock Origin at it to de-trackify it like I can any web app.

Doesn't seem like a 100% epic win for users to me. In fact, the only upside I can even think of is that it probably uses less RAM than a Chrome tab opened to Google Translate. Let's slow down and acknowledge the trade-offs before we go all-in on HN memes like native app superiority.

> It has nothing to do with creating a user friendly experience.

This is absolutely not true. Think about any kind of dynamic dashboard or data management platform. Having full page reloads for any minor change to filters, etc, is simply an unacceptable UX. But it has to be web-based because you need to be able to access it from any device, anywhere, without installing an app.

Plus, on a personal level, there are many services for which I will never install a native app—because I don't use it often, or because the native app provides no added benefit, or for one of a hundred other reasons. Those services don't get my business if they don't have a web app.

That is a significant, but limited-use, case.

Theere's no reason a static contnt page must require JS Simply to render text, with a blank page as fallback.

Better ways of addressing the dashboaard example might be worth considering.

Too: bullshit dashboards with JS-based fakery;

https://www.theverge.com/2016/11/8/13571216/new-york-times-e...

Limited? That describes about half the applications I've built in my career!

In all seriousness, there is a big difference between static content pages and full-blown applications; the cost to make the latter work properly without JS enabled is almost never worth it. But the same is true even for some static pages; for instance, I would never expect that NY times election forecast page to work without JavaScript, and don't see any reason that it should. (The "JS-based fakery" is pretty irrelevant to the discussion, IMO.)

What fraction of all HTML pageloads?

And: Sampling bias. A simple static page shouldn't require development. Hence, anyone doing web dev will have experience skewed strongly to more complex designs.

How would you describe the basic underlying structure and mechanics of a typical app you've built?

> What baffles me is that, while there is certainly much to complain about the state of front-end JS dev today, the attitude of some that moving the web back 15 years is a good thing.

The problem is that many people, for various reason (accessibility, poor network connection, low-end hardware, etc.) are stuck "in the past" with regards to the web. This doesn't mean you have to make this the experience for everyone using your website: just make sure it degrades gracefully for those who can't use the new shiny stuff.

This is often much easier said than done. Graceful degradation isn't free, and for many types of applications, simply isn't worth the effort to support.

> Graceful degradation isn't free, and for many types of applications, simply isn't worth the effort to support.

I hate to say it, but you're essentially saying "we can't afford to support people who are disabled, cannot afford the newest hardware, or are simply driving through a place with poor reception".

Yes, unfortunately that's exactly what I'm saying. In a perfect world, every app would be fully accessible, colorblind-friendly, work offline, etc etc. But in reality, all of those things cost money, and sometimes the cost outweighs the benefits. To give an extreme example, if my app has 1 million users, but only one is blind, do you expect me to spend (potentially significant) development resources on that single user?

You have to do that cost-benefit analysis based on how important those things are to your business—for instance, screen reader support is an absolute necessity for the public sector and certain information-heavy apps, but probably not as important for visual tools.

It's absolutely ridiculous how some content based websites require several MB of js to function. And the devs say this is because it is 'easier' to write such apps. And if the thought of optimization even comes to their minds, its just adding another layer on top of this madness to manage the layers below, or saying its too hard. Of course it is hard if you start with an overcomplex solution in the first place and try to trim away stuff from it. How hard exactly is it to write some plain html and css, with js doing some optional improvements? Most problems of web development are self inflicted.

I was talking to someone once about how ridiculously bloated Imgur is and that I had to use Imgoat because of the slow internet I was experiencing then. Of course they were trying to make all kinds of excuses like imgur not having servers nearby etc. But of course the really simple fact couldn't get to their heads that Imgur downloads like what 2-3 MB maybe even more of crap minus the actual image whereas Imgoat is something like 500 KB. No amount of network optimizations and caches etc are going to get over this fact. And also, such optimizations are over and above the page download size improvements anyways. If Imgoat used such techniques it'd be even faster. Most importantly: both sites have the exact same and simple core function, yet one site is so many times more bloated than the other. I will let you derive your own conclusions as to what this means.

And imgur also has the typical horrendous js misuses such as scrollbar hijacking that makes absolutely no sense etc.

There is nothing limiting a disabled person’s browser from executing JavaScript, screen readers are generally not concerned with how an HTML element was created (server side or client side), but just read what’s on the page.

>just make sure it degrades gracefully

Okay, example: client pays me to make an somewhat interactive website. Client wants it to be done using React as that is easy to get other devs for in the future, if the need arises. Client doesn't want to pay double (random estimate) to make everything behave in e.g. Lynx. Do I do it out of pocket, or just say no to the client?

I think you have a duty to your client to tell them why they should be paying you double to do the job right. If they don't, well, Hacker News is full of people like me to shame them for excluding people from using their website.

> If they don't, well, Hacker News is full of people like me to shame them for excluding people from using their website.

And the absolute number of HN people like you shaming folks for not supporting text-mode browsers like lynx is a rounding error for most websites.

Yeah there are a lot of ivory tower developers here with little to no real world experience and have never done anything of any substance or complexity pushing their tiny limited experience and knowledge and you can spot them from miles away in these comment sections. Those of us who work in the real world know how silly some of these comments are.

Please don't post personal attacks here; they contribute nothing to the discussion.

Develop with React but use something like Next.js to do Server Side Rendering (SSR)?

> the attitude of some that moving the web back 15 years is a good thing.

Straw man. We don’t want to go 15 years back, only 10 :-)

Seriously, the web was at a local maximum around 2009. Google worked, GMail was OK, Ajax was expected for r new stuff but was still written with graceful degradation in mind.

> There is a reason single-page apps became a thing, so I'm not clear why you think a page refresh for every user interaction is somehow a good thing.

So the reason I always hear is performance: Less HTTP-requests, less latency, therefore better user experience. While that might be the case for flaky mobile connections (although executing lots of Javascript on resource constraint devices might not be the best idea either), with fast wired connections I experience the opposite: The single page apps of today feel a lot slower to me, than the websites with the same functionality did 10 years ago, thanks to all the computation which has to be done on client side. Just take Youtube for example: What a bad experience nowadays, especially with Firefox. That was way better back in a time when they didn't try to avoid page refreshes. And it's not just Youtube, it's all over the web. A welcome change to all of that is HN, because it still feels as fast as websites did, before frontend development was even a thing.

You can disable the new polymer layout for YouTube on Firefox using a console command. It brings back the old layout which is much faster and more functional.

Performance of JS is much more controllable than round-trip latency.

Theres a huge spectrum between SPAs and pure js-less apps.

Until someone presses the back button. :)

I find it mind-boggling that people forget the hell of flash scope and the back button and broken history and POST-redirect-GET. Session state was miserable and the best thing about SPAs is avoiding that.

The truth is SPAs have to re-invent all of that on the client side. More SPAs have broken back button and history than server side apps ever did.

Since they specifically point out back-end state and full page reloads as an option, they're clearly asking from a place of incredulity. As in, "Wait, HNers actually think this is good UX?"

And no, moving client-side logic to the back-end isn't self-evidently superior. Not for your implementation nor for user UX. So you'd have to use more than condescension to make your point. Full page reloads for an "Add Row" button died for more reasons than just "web developers are idiots and don't realize how everyone actually loved that."

In the old days the user would submit the form, the validation would happen on the server, then return a result. If the result was a failure, you would render the errors on a new page load. If the result was a success, you could redirect the user to "confirmation" page or reload the same page but with a different output.

Yes. Use JavaScript for adding rows and validation, and fallback to new requests for both tasks if JavaScript is disabled. This is not difficult to do.

It's not difficult to do, I agree, but time spent doing it, testing it, maintaining it carries the opportunity cost of doing other things that may be more valuable.

Usually, such things are in abundance and take priority over supporting browsers without JS. For the vast majority of apps and businesses, JS as a minimum entry requirement is a perfectly acceptable tradeoff of lost users vs additional development cost.

I don't disagree. Heck, all of the websites I maintain for work require JS (although to be fair I also control the requirements for users: the latest version of Firefox or Chrome). I do wish the cost of requiring JavaScript was higher, though.

Genuinely interested, not assuming/implying I'm right - why?

I think just insisting on JS is, for most applications, the best thing for the most people. If the app is such that it has maximum availability as one of its top goals (government public service, public infrastructure, bill paying etc) I completely get it, but otherwise I'm just not convinced that not requiring JS is somehow inherently good.

If you'll allow a pretty weak analogy, it's almost like refusing to use a car and insisting upon using a horse and cart. You may have your own good reasons for doing that, and that's completely fine, you are free to make that choice, but you absolutely should expect the modern roads not to cater to you, and to be very often inconvenienced. Indeed, you shouldn't really expect society to spend lots of tax money catering to your choice and designing all roads, junctions, etc with it in mind, beyond the very minimum level so you can at least use the most important roads.

It's more like suggesting that perhaps sometimes walking is better than taking a car, while more fashionable developers insist on trying to use the car to go from the kitchen to the living room. And you still have to walk to the car.

I would use instead the analogy of a car and a bike. And indeed society does cater toward the bike, in many places.

But rather than any analogy, think about how many times more powerful a modern computer is than a computer from 2000. Now think about how many times more "things" you can do on that computer simultaneously. The latter is much smaller than the former.

Well, it depends on who your users are and the regulatory requirements you are operating within.

A US college or university site can be sued for lack of Section 508 compliace.

So, it goes beyond development costs to legal risk of lack of compliance.

OTOH, a site selling cars probably does not need to worry about potential car-buyers using screen-readers.

As other comments have pointed out, there is no causal relationship between the use of JS and lack of accessibility, screen reader compatibility etc. So supporting no-JS and being accessible are two different concerns.

I'm absolutely all for accessibility and would never argue against making things accessible as part of some cost-based tradeoff. Frankly this shouldn't even be an issue that comes up if you 'just do things right' from the get go - but even if it does, the imperative is always on you to just fix it.

There might be a correlation where apps that happen to use JS are more likely to be written in a way which is less accessible by default, but that's another conversation.

With that out the way - totally agree with you, for certain apps with regulatory requirements insisting that JS not be required for use, that's what you do - and for good reason - max availability to anyone for public services etc - that makes complete sense.

I don’t disagree.

The point I may have misunderstood is putting development effort into a SPA that only uses JS and works well with a screenreader versus the non-JS alternative that also works well with a screenreader.

Of course, it depends on where in the development process the developer becomes ‘aware’ of making the site compliant.

As you said, ‘do the right thing from the get go’.

The main article was talking about login forms, posting comments, and other simple use cases.

I would add a new @type property to table elements and publish it as HTML6 standard. @type=reactive would let you add/delete rows in the table.

99% of the forms I run in to in the wild are one-page forms without any interactivity, and just a single "Submit" button. Yet these web sites usually require Javascript (usually for tracking and ad delivery).

Something like 90% of sites I run in to deliver static content, yet almost all use Javascript (again, for tracking and ad delivery).

Fortunately, the overwhelming majority of these sites still work great or at least good enough without Javascript.

Most sites out there really have no legitimate need for Javascript, with the exception of truly interactive sites like ones that let you play games in the browser, let you use some sort of application (like a spreadsheet, word processor, graphics program, or, arguably, web mail) in the browser, or do something like let you see live updates of things like stock tickers. But most sites are not like this. They just serve static content that could be served up just as well or even better without JS.

> I’m a web developer who has never done significant forms without JavaScript.

Perhaps you should give it a try and learn how to do it. That way you'll know when building non-js fallbacks is feasible and how do it easily.

> is it customary to have to submit the form to get the validation error messages to occur?

You trust the client to perform validation? Client-side validation should only be used to improve UX, not as a substitute for server-side validation.

> Would the “right” way be a full page reload with the row added/deleted, and caching all the values?

I don't know if this is the "right" way, but it sure sounds like a more reasonable fallback for clients without JS than serving them a blank page.

> Does even anybody remember the good old HTTP basic acess authentification? This is one of the most accessible ways of protecting ressources, it can be consumed by any HTTP client (!), and it is just reduced to the basic.

Yes! I recently used an e-shop that uses HTTP auth for user accounts. It was a bit unsettling, when the browser asked me for login credentials. :)

It's also quite disappointing that I can't use my 1Password vault when a website asks for my HTTP password via a standard dialog in Firefox.

PS: I am using Ubuntu so I can't use 1Password as a standalone application; but how does it happen that a website is perfectly capable of blocking my interaction with the browser? Why doesn't Firefox ask for the password as part of the actual webpage instead?

Hadn't tried it in other browsers - does it work at all?

In this case, the u/p needs to be sent along with the request - which means it needs to be asked for by the browser before the request to the site is ever sent..

No, I mean just show a customised page for 403 that also has a username/password that you could put in and log in.

The cross-browser modal dialog is entirely anti-Ux.

Bitwarden is able to auto-fill basic auth dialogs in Firefox, but only if there is only a single entry for the page in store. Thought, sometimes it sometimes does not work.

I do wish Mozilla would finally do away with the modal auth dialog and use in-tab content that extensions can interact with.

I just set up my own Git central using HTTP basic auth (with cgit and Gitolite). It is refreshingly simple and also looks good in text-based browsers.

https://github.com/h2o/h2o/wiki/Hosting-private-and-public-r...

Yup, I also use basic auth for in-development websites for my customers. It's just a few lines in nginx, and very flexible. The website doesn't even need to know.

>Really, there is no reason why a form should require JavaScript.

This is one of those things that's technically true, but misleading.

Without scripting, you can't do any client-side validation, so you have to submit the form.

Without scripting, it's then harder to repop the form for the user when it fails.

I'm not saying things aren't excessive today -- they clearly are. But tossing client-side scripting entirely seems like a baby/bathwater situation.

You need to re-do all your client-side user assistance prompts+ with real validation serverside anyway...

+ client-side validation is not validation.

Server side validation is a backstop. It doesn't need to have fancy error messages or anything like that. Client side can have friendly, nice error handling and validation. Server side can damn near barf on the user's shoes when it encounters a validation issue.

Most forms either don't need any kind of validation or you still have to validate the data on the server and do something reasonable when it fails.

Repopulating the form on the server side after validation failure is trivial and even more so when there are libraries that abstract that away (eg. wtforms).

On a similar note I somehow fail to see the benefit of writing (and often duplicating) large parts of business logic in client-side javascript and replacing perfectly good HTML form-submission mechanism with random JSON "REST" APIs.

    > Repopulating the form on the server side 
    > after validation failure is trivial

You'd think so, but the number of sites out there that still require me to re-type the full form because one field failed validation is mind-boggling.

Just use Weboolkit (Wt, http://webtoolkit.eu/). It handles graceful degredation on no-JS automatically. This is one of the neatest things about it, you get full single page interaction w/ sockets if supported, or just normal HTTP pages if Javascript is disabled or not supported.

You absolutely have to do server-side validation anyway, since clients can lie.

Since you're doing the server-side validation you have to do anyway, it's child's play to return the HTML form with the values the client submitted pre-filled.

Client-side validation is a user convenience; it's awesome, but not sufficient in itself, because it can only protect the client, not the server, from invalid values.

Html validation is actually quite powerful and can help with most "quality of life" validations. You know the "this field is required" or "this field needs to be a number" kind of thing.

Even more, html validation has by far a much better UX than most custom made JS solutions. For example if there is an error in the validation, your cursor is immediately transported to the offending field where you can do the correction, with the appropriate css classes available to highlight the field properly.

And for the stuff that html validation is not powerful enough, well then you most probably want to check that on the server as well anyway.

HTML5 validation is excellent, even better if you use JS to customise it...

Yes you can do client-side validation. You're constrained to the pattern fields and the browser implementation, but it's enough to block most invalid submissions.

> Really, there is no reason why a form should require JavaScript.

True. But I'm glad to use Javascript on forms where fields are depending on input from other fields.

Or when you want to give the user the option to submit multiple entries of the same field type. For example when you ask for a job history.

Yes you can sumbit the form on every step but this is much harder to develop and has a lot of negative interactions for the user. For example the scrollposition is gone on each submit. And the user has to wait for a reply from the server on each submit.

Javascript is not the problem, bloated and spammy websites are.

> Javascript is not the problem, bloated and spammy websites are.

It is part of the problem. Because of what Javascript allows and makes possible, bloat can thrive and endure in the modern web.

Well the same applies to images because they can be used for tracking.

Images don't access your device and check your system's configuration, extensions, plugins and more, as far as I know.

> For example the scrollposition is gone on each submit.

Could this be fixed by dynamically-created anchors, so for instance when one is adding a new row to the "job experience" section of an application form, the reload to add the new row could also direct the user to "somesite.com/jobapp#JobExp2"?

That would be where the new row is, but not where you were scrolled to previously.

Javascript itself is not the problem, it's the means. Same as we want gun control (not 100% confident using this analogy though).

>I wonder why we cannot come up with a web standard interface in a way the captchas could be offloaded to customizable and adaptable GUIS rendered by the browsing client.

Because then Google would lose a large free pool of labor for training its machine learning.

So that’s why it’s always traffic stuff.

Yes, and that's why it used to be text from books, where they wanted to confirm their OCR.

The OCR actually helped digitize books, whereas the new captcha only helps Google's self-driving efforts…

I highly doubt that selecting traffic signs in pictures does anything to help Google's self-driving efforts. The models used in autonomous vehicles are extremely state of the art and object detection is largely a solved problem (many people make object detection apps as Hello World projects).

I'm no expert in this area, but as far as I'm aware object detection at the level required for self-driving vehicles is far from a "solved problem" (and requires significantly lower error rates than a "Hello World" project…).

So, if it is largely a solved problem, the captcha is near useless, no?

Yes, people have used Google Cloud's own public APIs to bypass reCAPTCHA v2.

It helped digitize books... for Google. AFAIK they didn't release it to anyone else?

Also, for a while they used it to determine street numbers for Google Maps.

It started out as scanned books 10? years ago before Google bought them up.

>That's super sad because it also excludes all the handycapped people.

That’s not how accessibility works. Requiring JavaScript does not change how accessible your site is to persons with disabilities.

What does hurt is making sites that are difficult to navigate by keyboard, without proper accessibility hints, and actually it’s quite easy to do that without JavaScript.

> the captchas could be offloaded to customizable and adaptable GUIS rendered by the browsing client

Using Chrome with all tracking enabled is basically that. You just don't see CAPTCHAs. Blocking bot is a hard problem to solve.

Basic authentication is fine if all you need is to control access to documents, but it can not be used for access delegation or any scope control.

That depends entirely on how/where you implement this.

You can make your application code check the authorization header, get the username from there and do authorization based on that.

> but it can not be used for access delegation or any scope control

Why not? It's just a header with a username and password. Your app can do whatever you want with that info. It also doesn't strictly have to be a username and password, you allow app tokens or whatever you want in there, that's just what the browser UI calls it.

I assume you're not a .NET developer...

No I'm not. Care to elaborate?

> Does even anybody remember the good old HTTP basic acess authentification?

Yes, I use it on some of my sites. For some reason chrome password manager won't work with it. Not sure why.

HTTP basic auth has also been broken on Firefox for iOS for a long time

https://bugzilla.mozilla.org/show_bug.cgi?id=1437817

> I wonder why we cannot come up with a web standard interface in a way the captchas could be offloaded to customizable and adaptable GUIS rendered by the browsing client.

What would prevent the client from not rendering anything and always replying "yes this is a human"?

That's not how any captchas work. It's more like a challenge/response mechanism, so there would have to be a standard for defining a challenge and accepting a response.

The client would take care of displaying the challenge, and taking and sending the repsonse.

Wow; of course there are plenty of reasons why forms require javascript unless you've never coded anything of substance before then yes, in your limited experience no forms require javascript.

If you write even mildly complex business applications with business rules and want a professional and non shitty user experience you absolutely need Javascript, there's no substitute.

If you make simple sign up forms then by all means don't use Javascript.

I've written a SaaS system for SOX compliance tracking that ended up being a multiuser, role-based task manager that had to track dependencies between assignees and tasks. Did the application require JavaScript? Yes. But the JS had nothing to do with it being a "complex business application with business rules." If I'd implemented business rules in JavaScript, running on the client, I'd have been exposing the company to lawsuits.

JavaScript doesn't deserve all the hate it gets, but the flip side of that is that it gets most of that hate because of the way developers keep using it.

You can do the logic on Postback. Yes it requires a round trip to the server it it works perfectly fine.

It's doable, but filling out forms with no immediate feedback about whether you entered your data correctly doesn't seem great from a UI perspective. Consider how useful a calendar picker is for travel.

Also, no JavaScript means no Google Maps.

are people really suggesting basic auth again, is it 1993 outside? Basic auth is horrendous security practice, you're passing a header that has your user and password in plaintext, it's insane to suggest that in 2019

What makes submitting a plaintext password in an Auth header worse than submitting a plaintext password in a POST body?

there's no way to log out, the browser has to store it instead of a session cookie which can be invalidated if it's stolen.

plus what's in this comment https://security.stackexchange.com/questions/988/is-basic-au...

Thanks, I didn't realize that the password was re-sent for every request to the site.

Http auth is a mess of a system that has been a net negative for security by making people screw up hostname parsing because they didn't expect the auth syntax.

Why are you parsing URLs yourself? It's been a solved problem for decades, so use a library.

Because captchas do more than just "user clicked on image", and has to be very wary of creating openings bots can abuse.

from the server (which is the only one you shall trust) captchas are a challenge sent as some bytes in a http request, and then returned later as some bytes in a http request. What the client does with them should be hard for a computer. It may involve javascript, clicking on images, hearing something and entering as text or solving the 3rd riemann conjecture. You cannot prove the javascript has even be interpreted client-side. All you can be sure is that the naswer is correct and that it's hard to do by a computer.

The problem is that we're quickly running out of things that:

1. can be done by humans most of the time

2. cannot be done by machines most of the time

3. fit into the workflow of a web form

Point 3 is the interesting bit: You cannot build a captcha that tests dexterity, emotional intelligence or creative problem solving but is still accessible to a large internet audience.

> "Graceful degradation". I frequently have the feeling this attitude is lost.

Lost? It is just ignored for the sake of cool SPAs and hottest new js stuff.

Captchas are an anti-pattern. Make account creation easy then handle any spam issues within the system yourself. Why make your users suffer for what is basically the service's problem to fix? It's a lazy way out.

With invisible recaptcha most users won't even see a captcha challenge when they sign up to forms

Because most users won't subject themselves to the signup fee to make this revenue neutral.

It's an interesting alternative, though. Pay 5 bucks with the credit card to validate your identity if you don't want to subject yourself to captcha...

Tutanota does this, you choose between solving a Captcha and donating a minimum amount

Reply on news.ycombinator.com