Hacker News Reader

Comment by lucideer | Hacker News Reader

This exactly.

Given the diligence of the Safari team - especially in the face of the extremely lazy first bug report - it's kinda wild that this person thought it appropriate to post such a negative angle.

The second bug report wasn't even a bug: Chrome & Safari had implemented an unspecified part of the spec. differently to each other (specifically the implementation behind generating client IDs for fetch events in web workers -vs- the main window). The op is relying on an unspecified implementation detail for their app to work. Yet the Safari team actively treat it as a bug in an attempt to be more generally compatible with Chrome.

My takeaway from actually reading through the content of the post is that the Safari devs are responsive and approachable, even even the bug reporter is lazy. Which is more than can be said of many other browsers projects.

View on HN

I credited the Apple developers with doing a good job in the blog. The problem is Apple's policies end up turning a routine bug fix in to a total nightmare.

I think the larger issue is that you're relying on new or exotic browser APIs without enough skepticism about their behavior across a range of platforms. CompressionStream is brand new in 16.4, so zip.js should absolutely NOT assume it's available, and if it does detect the API, it should gracefully fall back to the older implementation if it encounters errors. I realize this is not your issue, but a dependency—but it could be a reason to use a library with a less aggressive upgrade philosophy, such as Pako.

Author of zip.js here, the CompressionStream API is available for 3 years in Chromium-based browsers [1]. That's why I integrated it 6 months ago in zip.js. However zip.js can detect if the API is present or not, and can work if not available (e.g. in Firefox). It cannot detect implementation bugs in the API though. Note that there's also an option to disable the use of the API [2].

[1] https://caniuse.com/?search=CompressionStream

[2] https://gildas-lormeau.github.io/zip.js/api/interfaces/Confi...

It doesn't matter if it's been available for 10 years on Chrome—if it's not reliable on other platforms, don't use it. And you absolutely CAN and should detect implementation bugs in the API. At the very least you can throw CompressionStream's entire compression/decompression process behind a try…catch block, and fall back to the older method on an error.

It was hard for me to anticipate that Apple would implement the CompressionStream API incorrectly 6 months later. However, it is extremely likely that an exception was indeed raised when this bug was triggered. I was never made aware of the existence of this bug. Besides, zip.js does its best to rely on fallback implementations in case of errors. I'm not supposed to integrate the entire CompressionStream API test suite (and all the other APIs) into zip.js either.

> It doesn't matter if it's been available for 10 years on Chrome—if it's not reliable on other platforms, don't use it.

As an author you have two main options:

1. Feature detection: check to see if the API exists in the browser, and gracefully fall back if not.

2. UA-sniffing: use the API only on browsers where you've verified that your program works correctly with its implementation.

There's pretty strong consensus on the web that authors should be doing (1), and that (2) is harmful to minority browsers. Every time someone says "the new feature works fine in Firefox if I set my UA to Chrome" they're complaining that the site didn't go with (1).

Yes, using (1) means trusting browsers to get their implementations correct, but they are usually very good about this and getting better. The http://wpt.fyi tests have been a big help here.

I don't disagree with any of that, but you have another option:

0. Wait: Don't adopt the API at all if it is only supported in Chromium, because it's highly probable that the API will have behavioral or API differences if it's implemented by other browsers in the future.

Please read the documentation of the API and you might think the probability would be very low [1]. Note also that zip.js works totally fine in all stable browsers, Safari 16.4 included. There are no known issues [2]. I have absolutely no idea what we are talking about because it looks like the bug has been fixed by Apple in the stable version of Safari. And maybe zip.js helped them to do so.

[1] https://developer.mozilla.org/en-US/docs/Web/API/Compression...

[2] https://github.com/gildas-lormeau/zip.js/issues

Waiting doesn't work when Apple do things like ship a working and spec-compliant WebAssembly API which works great so you start using it, then they completely break it in a subsequent update, and leave it both enabled and broken for months. No amount of foresight or caution will save you in that case. It's ultimately the browser maker's responsibility to make sure APIs work.

Chromium-based browsers make up a large portion of many people’s marketshare. It absolutely makes sense to use APIs that are available in them and then polyfill the feature with “the old way” if you feature-detect that it isn’t there.

If browser vendors are releasing the feature unprefixed, that is their signal that they view the feature as stable. It is the responsibility of the browser vendor to ship unbroken features and use vendor prefixes to unambiguously mark if something isn’t fully baked. It is not the responsibility of developers to stick their finger in the wind and try to divine when a feature has subjectively “reached stability”.

Actually, the developer's primary responsibility is to deliver working software to their client or customer.

If you ship a bunch of features based on an assumption about how browsers "should" implement an API in the future and it breaks, you can't tell your customers "it's the browser's fault!" Regardless of what's "fair," it's your software that looks broken. So you can navigate that however you want. I choose not to adopt single-vendor APIs for this exact reason.

> you can’t tell your customers “it’s the browser’s fault!”

Indeed you can’t! Which is the core of my argument for why we also need to be able to properly UA-sniff browser versions. If browsers aren’t holding up their end of the stability bargain, they need to give us a way to version-detect and handle the problem on our end.

Right now what’s pissing me off about Safari is that with their left hand they’re delivering buggy implementations of standardized features and with their right hand they’re cutting off our ability to detect which version of their browser we’re running in (and soon, no doubt, whether we’re running in Safari at all).

I'm not unsympathetic, but I would quibble with your use of the word "standardized" here. Just because one vendor is pushing an API through the standards process does not mean it is "standardized."

Option 3: Allow dependents to enable it explicitly with a feature flag.

Options 1 and 3 are implemented.

Browser makers always recommend feature detection (i.e. use a feature if it's available) over hacks like user-agent sniffing to selectively enable features. Web developers can't look in to a crystal ball and pre-emptively code around APIs with unexpected issues.

But you can avoid adopting APIs that have been Chrome-only until 5 minutes ago…

That means avoiding features that can enhance your software, improve performance, and help get ahead of competitors.

Yeah, that's one of the many tradeoffs in developing a web app. It has not changed since the Netscape days.

Reply on news.ycombinator.com