Hacker News Reader

Comment by ceronman | Hacker News Reader

This is definitely not the most important reason to keep `alert`, but I'd like to share it anyway:

My girlfriend recently decided that she wants to learn programming. Given that she already knows some HTML and CSS, I thought JavaScript was the best option as her very first language, as she could apply what she learns easily. So I decided to teach her programming with JS.

In these lessons I've been teaching her how to do basic input and output using `alert`, `prompt` and `confirm`. I know these are almost never used in professional projects, but for beginners these are very practical. They are easy to use and you can test everything in the browser without having to deal with all the overwhelming complexity of the usual JS toolchains. It's so sad that they are going away :( This definitely would make JS a bit less appealing for the complete beginner.

View on HN

I had exactly the same thought, my wife is doing a Shecodes course and the confirm and alert features are very good simple UI components that require no additional work, it allows beginners to piece together a complete experience without having to build a whole UI stack.

And letting go of beginners... removing them seems like the reverse of what we need to do here. They should be improved to the point that no one needs custom confirm dialogs anymore.

It makes no sense at all that we require so much reinvention of the wheel on the web, even down to these ultra-generic features.

> I know these are almost never used in professional projects

Well, ignore me clearing my throat and wiping away the sweat on my head, but at least confirm() is quite useful.

Yes, I could make something that acutally looks nice and has better usability, but sometimes you want to ask a quick question and looks aren't important.

Still, I don't think these commands are affected, just when the script comes from another source, which is a new policy, since script origin wasn't ever questioned by browsers.

No, this is about alerts from cross origin content, like from an iframe that loads from a different origin than the parent page

It would still break sites like codepen.io that use iframes for this.

codepen's iframes are their own, not cross-origin

They're on another domain they own, but they are on another domain (cdpn.io) and the cross-origin concern does apply. They do that because they have auth cookies on codepen.io and don't want them exposed to the iframe.

See these tweets by their cofounder: https://twitter.com/chriscoyier/status/1422940724295786503?s... and https://twitter.com/chriscoyier/status/1420033471376920578?s...

if they were on the same domain you could load iframes with the parent site and do arbitrary CSRF

Google is planning to remove alerts entirely: https://twitter.com/Rich_Harris/status/1422930436850860033

Direct source:

> Major browser vendors are generally aligned about wanting to move the platform away from alert() and friends, even though it will unfortunately involve some breakage.

- https://twitter.com/estark37/status/1422694855390629893

That at least doesn’t seem like any kind of near-future thing.

I just hope there’ll be some replacement, we use confirm() to prevents users from losing changes that weren’t saved (just like many other sites including fastmail and google)

What about console? It is easy to use for beginners and really powerful if you want to dig deeper. Even as a beginner I always found alert() really awkward. Now that I am programming Javascript for a living I never use it.

Reply on news.ycombinator.com