Comments on: Avoiding Evil JavaScript http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/ Sun, 07 Sep 2008 21:21:10 +0000 http://wordpress.org/?v=2.5 By: alec9111 http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-210877 alec9111 Sun, 25 Mar 2007 01:46:25 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-210877 Yeah, InfoWorld also reported today that JavaScript misuse leads to the major flaw on Internet these days: <a href="http://www.ebrandmarketing.com.au/2007/03/25/avoid-using-javascript/" rel="nofollow">JavaScript Misuse</a> Yeah, InfoWorld also reported today that JavaScript misuse leads to the major flaw on Internet these days: JavaScript Misuse

]]>
By: Doug http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-187291 Doug Fri, 23 Feb 2007 15:16:49 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-187291 Sorry, all that "solution" does is send HTTP headers to refresh. That is not a solution to the session timeout problem. In fact if it were pre-set (as your session duration is, it's not user-configurable) on page load, it could be an accessibility issue because refreshing content without the user's action is a no-no. It also breaks down in a multi-tab or child window setting just like the Javascript version. Example: Window 1 is opened and set to refresh to the logout page in 30 minutes (session length). 5 minutes later you open a link in a new window or new tab. The session is shared and session timeout is reset. But your first page will still refresh to the warning or logout page 5 minutes before the session will actually end. At least in Javascript you can attempt to cancel timers on parent windows when a child window is opened to prevent this annoyance, but there's still not a perfect solution. Sorry, all that “solution” does is send HTTP headers to refresh. That is not a solution to the session timeout problem. In fact if it were pre-set (as your session duration is, it’s not user-configurable) on page load, it could be an accessibility issue because refreshing content without the user’s action is a no-no. It also breaks down in a multi-tab or child window setting just like the Javascript version. Example: Window 1 is opened and set to refresh to the logout page in 30 minutes (session length). 5 minutes later you open a link in a new window or new tab. The session is shared and session timeout is reset. But your first page will still refresh to the warning or logout page 5 minutes before the session will actually end. At least in Javascript you can attempt to cancel timers on parent windows when a child window is opened to prevent this annoyance, but there’s still not a perfect solution.

]]>
By: AutisticCuckoo http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-185753 AutisticCuckoo Wed, 21 Feb 2007 17:42:39 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-185753 For those who want to see a JavaScript-free solution to tbm's problem, take a look at Mike Cherim's brilliant AutoRun at http://green-beast.com/build-css/ This handles user-settable timeouts without the need for JavaScript and it's fully accessible. (Note that the site <em>content</em>, the tutorial, is still under development.) <blockquote>Javascript is great and people who have javascript turn off should suffer,</blockquote> What a friendly and considerate person you seem to be ... For those who want to see a JavaScript-free solution to tbm’s problem, take a look at Mike Cherim’s brilliant AutoRun at http://green-beast.com/build-css/

This handles user-settable timeouts without the need for JavaScript and it’s fully accessible. (Note that the site content, the tutorial, is still under development.)

Javascript is great and people who have javascript turn off should suffer,

What a friendly and considerate person you seem to be …

]]>
By: Anonymous http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-185597 Anonymous Wed, 21 Feb 2007 13:42:22 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-185597 oh my god :| i have installed flash just because of youtube type of sites(flash games are boring to me) and flash block to not see/hear dumb flash stuff on sites(i was ok with flash advertisements until they started to use sound).If something is evil its flash. Javascript is great and people who have javascript turn off should suffer, people who have just one eye see less so sites should all be working best in 800x600? javascript allows websites to look better and work better(not refresh with ajax). And by the way nobody cares about people that use just keyboard or some weird browsers(i found many sites that work good only in IE). You gave only one good argument that Javascript could be insecure, but ... IE is also known for that and Firefox had more than one bug. oh my god :| i have installed flash just because of youtube type of sites(flash games are boring to me) and flash block to not see/hear dumb flash stuff on sites(i was ok with flash advertisements until they started to use sound).If something is evil its flash.

Javascript is great and people who have javascript turn off should suffer, people who have just one eye see less so sites should all be working best in 800×600? javascript allows websites to look better and work better(not refresh with ajax). And by the way nobody cares about people that use just keyboard or some weird browsers(i found many sites that work good only in IE).
You gave only one good argument that Javascript could be insecure, but … IE is also known for that and Firefox had more than one bug.

]]>
By: AlexW http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-184239 AlexW Tue, 20 Feb 2007 03:08:09 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-184239 <blockquote>Finally if a user disables JavaScript, they should expect a poor web browsing experience. JavaScript is the programming platform which has enabled Web 2.0, and revoking JavaScript is akin to staying on your horse because cars are too noisy.</blockquote> Certainly sounds like they should expect it from you. So, if I want to use my JS-less phone browser to access your online shopping list app, I shouldn't be cranky because it can't operate without Javascript? Or similarly, if I disabled JS on that phone browser because I didn't want it to connect to the server (at my expense) every time I ticked an item off the list, and the app then doesn't work, 'bad luck'? Regardless of the fact that if I'd been using the same application 18 months earlier -- before it had been '<em>improved</em>' with AJAX -- it would have run perfectly? Evolution, I say!

Finally if a user disables JavaScript, they should expect a poor web browsing experience. JavaScript is the programming platform which has enabled Web 2.0, and revoking JavaScript is akin to staying on your horse because cars are too noisy.

Certainly sounds like they should expect it from you.

So, if I want to use my JS-less phone browser to access your online shopping list app, I shouldn’t be cranky because it can’t operate without Javascript?

Or similarly, if I disabled JS on that phone browser because I didn’t want it to connect to the server (at my expense) every time I ticked an item off the list, and the app then doesn’t work, ‘bad luck’?

Regardless of the fact that if I’d been using the same application 18 months earlier — before it had been ‘improved‘ with AJAX — it would have run perfectly?

Evolution, I say!

]]>
By: CA http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-184158 CA Tue, 20 Feb 2007 00:29:04 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-184158 Whenever I see a blanket sweep like this I shudder. It would be great if every website (and application) conformed to accessibility standards, but the cost of doing so would render many of those websites impractical. Furthermore, many new websites relies on interactivity that would not be possible without a mouse and without JavaScript. I am part of a team developing an 'Ajax' Asset Management package. It is a spatial application, whose primary benefit is the ability for ordinary people to be able to visualize their assets. It would make absolutely no sense to provide a version that can be used without a mouse, as spatial input (x,y co-ordinates which are most logically input via a mouse) is critical for its usability. Finally if a user disables JavaScript, they should expect a poor web browsing experience. JavaScript is the programming platform which has enabled Web 2.0, and revoking JavaScript is akin to staying on your horse because cars are too noisy. Whenever I see a blanket sweep like this I shudder. It would be great if every website (and application) conformed to accessibility standards, but the cost of doing so would render many of those websites impractical. Furthermore, many new websites relies on interactivity that would not be possible without a mouse and without JavaScript.

I am part of a team developing an ‘Ajax’ Asset Management package. It is a spatial application, whose primary benefit is the ability for ordinary people to be able to visualize their assets. It would make absolutely no sense to provide a version that can be used without a mouse, as spatial input (x,y co-ordinates which are most logically input via a mouse) is critical for its usability.

Finally if a user disables JavaScript, they should expect a poor web browsing experience. JavaScript is the programming platform which has enabled Web 2.0, and revoking JavaScript is akin to staying on your horse because cars are too noisy.

]]>
By: AN http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-184119 AN Mon, 19 Feb 2007 23:10:37 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-184119 All these points are great, and you should absolutely follow these guidelines whenever possible, but it completely depends on what you're building. Can you use Photoshop with a screen reader? Is Photoshop "evil" if you can't? Developing content sites, you are publishing information, that ideally anyone ought to be able to read. But developing web applications can be a rather different animal. In applications, there is a continuum of possibilities. On one end you have apps like photo editing and Visio, where it might not even be clear what an accessible application for a screen reader would do. On the other end, you have simple applications like a web version of Notepad, where no real functionality would be lost by eliminating client-side interaction altogether. In between, of course, you have an enormous range of cases. And that's even without considering building games: for example, web Tetris. Is it evil to build web Tetris? If you build web Tetris, are you responsible for building a version for screen readers that can post back after each action? As someone responsible for the web port of a Windows application, I can honestly say that I have no idea how to develop a version of my application that could degrade gracefully down to a screen reader. It would require a completely parallel coding solution. I would even be in favor of this option, except that the small company I work for can't possibly afford this. I'm certainly with you in spirit, but everyone needs to realize that different types of websites have different situations and impose different practical constraints. All these points are great, and you should absolutely follow these guidelines whenever possible, but it completely depends on what you’re building. Can you use Photoshop with a screen reader? Is Photoshop “evil” if you can’t?

Developing content sites, you are publishing information, that ideally anyone ought to be able to read. But developing web applications can be a rather different animal.

In applications, there is a continuum of possibilities. On one end you have apps like photo editing and Visio, where it might not even be clear what an accessible application for a screen reader would do. On the other end, you have simple applications like a web version of Notepad, where no real functionality would be lost by eliminating client-side interaction altogether. In between, of course, you have an enormous range of cases.

And that’s even without considering building games: for example, web Tetris. Is it evil to build web Tetris? If you build web Tetris, are you responsible for building a version for screen readers that can post back after each action?

As someone responsible for the web port of a Windows application, I can honestly say that I have no idea how to develop a version of my application that could degrade gracefully down to a screen reader. It would require a completely parallel coding solution. I would even be in favor of this option, except that the small company I work for can’t possibly afford this.

I’m certainly with you in spirit, but everyone needs to realize that different types of websites have different situations and impose different practical constraints.

]]>
By: jr http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-183865 jr Mon, 19 Feb 2007 14:49:38 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-183865 A colleague of mine surfs without css, flash, java and javascript; even graphics turned off.. Evil! sounds like a witchhunt to me - sorry. A colleague of mine surfs without css, flash, java and javascript; even graphics turned off..
Evil! sounds like a witchhunt to me - sorry.

]]>
By: Themaninblue http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-181139 Themaninblue Sat, 17 Feb 2007 00:59:40 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-181139 Quite funny Kev, this page kept crashing my browser until I turned off JavaScript :D Quite funny Kev, this page kept crashing my browser until I turned off JavaScript :D

]]>
By: Silvestr http://www.sitepoint.com/blogs/2007/02/09/avoiding-evil-javascript/#comment-180141 Silvestr Thu, 15 Feb 2007 12:37:13 +0000 http://www.sitepoint.com/blogs/?p=1849#comment-180141 I absolutely agree with Sam Barber few posts above, especially with the last line. It's time for a clever screen reader, that could translate into speech what the javascript should do. I know that's a mad wish, though. I absolutely agree with Sam Barber few posts above, especially with the last line.
It’s time for a clever screen reader, that could translate into speech what the javascript should do. I know that’s a mad wish, though.

]]>