Hacker News Reader

Comment by recursivedoubts | Hacker News Reader

I am the author of this article. Happy to answer questions.

I know my alternative approach, htmx-enhanced hypermedia, isn't right for every application, but it can be a much simpler approach for many applications, and, since it is so simple, can be used to conserve complexity in applications that have parts that are not amenable to the hypermedia approach.

View on HN

Thanks for sharing and for your work on intercooler.js and htmx!

I share your sentiments about SPAs, and I've been trying to get back to a simpler web stack.

One of the hurdles I keep running into with libraries like htmx and Alpine is that they don't play nicely with Content Security Policy. And I'm reluctant to forfeit CSP to use a JS library since CSP is the most robust solution I've found for preventing XSS.

Alpine is working on a CSP-compatible build, but it hasn't been released[0] and doesn't seem to be a priority.

htmx is compatible with CSP, but it effectively reverses the protection it offers. The attacker can inject JS through htmx directives.[1] I know there's hx-disable, but this degrades CSP's effect from "secure by default" to "secure when the developer remembers to mark the subtree as containing user-controlled data."

Is there a way to use htmx without forfeiting the benefits of CSP?

[0] https://github.com/alpinejs/alpine/issues/237#issuecomment-9...

[1] https://htmx.org/docs/#security

unfortunately not one I can think of without htmx being baked in to HTML

which, I think should be the case: I don't think htmx should have to exist, I think this is just how HTML should work. That could address a lot of accessibility and progressive enhancment issues as well.

I have no idea how one would go about doing this, but I'm curious if you have pursued that option? Getting the functionality of HTMX into the HTML standard?

Ah, bummer. Thanks for your answer!

Can you be specific about what exactly an exploit taking advantage of this in HTMX would look like?

Could you put publication dates below blog post titles on that website?

Why the use of the article 'An' instead of 'A' ?

They must pronounce it S P A, not "spa". In which case, it's "an" because S sounds like "ess", which starts with a vowel-like sound, so you use "an".

I also pronounce it S P A, so "an" seemed immediately correct to me.

You have no idea how many times I went back and forth on this.

Glad you and I are on the same page, like the comment above you, it's the difference between it being an acronym (SPA) or an initialism (S, P, A).

Because you use "An" if the following starts with a vowel sound, and "SPA" (spoken as the individual letters) does. (EDIT: fell for a false friend, fixed)

Interesting. Do you generally pronunce it as Es-pea-ay? In that case it warrants the an in front

I do. I had never though about pronouncing it as spa, the word.

Sounds similar to the battles between es-queue-el and sequel for SQL.

Interesting, thanks for the insight, I was completely unaware of this one.

Most wouldn’t read an acronym phonetically if it happens to spell a commonly used word.

FWIW, I've never heard anyone say "spa" for SPAs (including conference talks by native speakers, so not just local bubble).

Perhaps it's a culture thing. I am from The Netherlands and I have never heard someone say es-pea-ay; everyone I know pronounces it as "spa". Conference talks in both Dutch and English all pronounce it is as "spa" as well, even native english speakers

On the other end of the spectrum, some people at a past job took to calling interactive but self-contained pages "day spas".

I read this comment and thought about it a lot. I don't think that's the rule. For example, US abbreviating United States. Nobody reads it as "us", even though that's a commonly used word.

U.S. would be initialism, not an acronym. I think we’ve stumbled into a linguistic grey area. Really a matter preference I guess.

https://abbreviations.yourdictionary.com/reference/abbreviat...

https://www.merriam-webster.com/words-at-play/whats-an-acron...

Have you polled web developers? There have been some attempts to do so [0].

[0] https://twitter.com/zachleat/status/1230239491014656001

Reply on news.ycombinator.com