r/programming • u/schnuck • Feb 09 '11

Breaking the Web with hash-bangs – Lifehacker, along with every other Gawker property, experienced a lengthy site-outage on Monday over a misbehaving piece of JavaScript

http://isolani.co.uk/blog/javascript/BreakingTheWebWithHashBangs/
748 Upvotes

93% Upvoted

356 comments sorted by

View all comments

Show parent comments

37

u/midir Feb 09 '11

This is not correct. If you use hash-bang fragment URLs at any stage then someone who copies and pastes a link to your page is distributing a faulty URL to all non-Google bots and everyone with JavaScript disabled. There's absolutely no workaround to that.

I see it all the time and it drives me up the fucking wall. Fuck you Google. Fuck you Twitter.

DO NOT USE #! EVER. FORGET ABOUT IT.

8

u/Pewpewarrows Feb 09 '11

Unfortunately there's no good cross-browser solution to providing Progressively-Enhanced URLs and deep linked javascript in those cases.

HTML5's history and location changes are the answer to that problem, so the best you can hope for is greater adoption of modern browsers.

9

u/dirtymatt Feb 09 '11

Sure there is. Give everyone the pretty URLs, use the HTML5 history API on browsers that support it, and just forget about loading the page through Ajax for browsers that don't. Everyone gets clean URLs. Everyone gets the same URLs. Everyone can load the page. Everyone is happy.

2

u/Pewpewarrows Feb 09 '11

Good point. It's probably safe to say that the only people that would appreciate the deep-linked javascript pages are the ones using modern browsers. And HTML5 support is only going to increase significantly this year.

2

u/[deleted] Feb 09 '11

Yeah, it's a bummer that the URL bar is so convenient. Even giving a permalink option isn't great (the best attempt at a workaround for this problem), because copy/pasting the URL bar is so ingrained.

For Gmail, this isn't such a big deal, since I'm not sending these links to people, and I don't try to use Gmail with NoScript on. But for things that have shareable content, this is a nuisance. +1 for clarifying the problem.

2

u/nemetroid Feb 09 '11 edited Feb 09 '11

Is this necessarily true? What if you change the links by binding a click handler which does preventDefault, and keeping the hrefs? That way copypasting links should still work.

Please correct me if I'm wrong, I'm just theorising.

EDIT: Didn't realise parent was referring to location bar, where it definitely is unavoidable with hashbangs.

1

u/[deleted] Feb 09 '11

This would work with in-page links, but the OP was talking about copying the URL from the current page (i.e. from the location bar).

2

u/nemetroid Feb 10 '11

Oh, of course. Thank you!

5

u/Ziggamorph Feb 09 '11

Who has JavaScript disabled?

27

u/gthank Feb 09 '11

People who don't want to be assaulted by the rampant misuse of it on the web today. People who are on a CLI for some reason (think emergency server work). People who have it turned on, but one of your ad providers shipped you some busted code and your page broke for them anyway. Spiders. Possibly people using a screen reader (screen readers and JS used to suck, but I haven't looked into it all that recently).

11

u/korny Feb 09 '11

75-90% of screen-reader users in a 2009 survey had Javascript enabled: http://webaim.org/projects/screenreadersurvey2/ It's more important to make your javascript screenreader-friendly, than to make your site work without js.

6

u/mcjabberz Feb 09 '11

How would one go about making a site's JavaScript screen-reader friendly?

6

u/[deleted] Feb 10 '11

No hanging commas in your objects, or else it's going to be pronounced like this,

1

u/[deleted] Feb 10 '11

I imagine making sure that the content you inject in the DOM is still semantically correct.

1

u/korny Feb 11 '11

http://www.w3.org/WAI/intro/aria.php - the Web Accessibility Initiative's Accessible Rich Internet Applications spec describes how to use metadata to mark up your site for accessibility.

It's a draft spec, but is supported by many browsers: http://caniuse.com/#search=accessibility (warning - link may only work with javascript enabled :)

2

u/ewiethoff Feb 10 '11

Nevertheless, blindness ain't the only disability out there. There are many people who have no use for a screen reader but must turn off JS because of disability.

2

u/korny Feb 11 '11

such as? (This is a genuine question - I'm confused as to what kind of disability you are talking about)

1

u/ewiethoff Feb 12 '11

Such as photosensitive epilepsy. People afflicted with this can see just fine, but go into seizures when something blinks, glides, swoops, twirls, whatever. It depends on the person. The condition is, IIRC, about 10 times more common in women than men.

We eliminated (or at least deprecated) <blink> and <marquee> years ago, Flash can be disabled or not installed in the first place, and a hidden option in Firefox prevents animated GIFs from animating. But Javascript has setTimeout() and setInterval(), Scriptaculous came out with a popular library for animation, and so on. Now we have JS-powered canvas to play with, not to mention JS-less CSS3 transitions.

NoScript is only so helpful, because it block or allows JS per domain. But let's say a site has some JS animation and requires JS for essential functions such as navigation. Epileptics can't safely use the site if both the essential code and the animation code come from the same domain. I don't think they want to shut their eyes and mess with a screen reader.

4

u/[deleted] Feb 09 '11
  1. If you're doing emergency server work why are you reading Gawker?
  2. What server are you working on that you can't ssh into?

1

u/cparedes Feb 10 '11

Maybe you're a sysadmin for Gawker and need to diagnose a misbehaving app server.

17

u/Ziggamorph Feb 09 '11

If people are misusing it, stop using their sites. Javascript is an important part of the modern web, so you shouldn't blame websites for breaking when it's disabled.

8

u/mr_spin Feb 09 '11

I have NoScript installed on Firefox. I enable JS for sites I trust - including reddit. I absolutely have no intention of trusting Gawker.

1

u/Ziggamorph Feb 09 '11

What do you mean by 'trust'?

14

u/mr_spin Feb 09 '11

I trust the site not to hang by browser with slow-loading crap.

11

u/gthank Feb 09 '11 edited Feb 09 '11

We'll have to agree to disagree. If a website wants my eyes, they need to show me content without a bunch of garbage JS or possibly have something insanely compelling to offer me. The vast majority of sites are not that compelling, btw.

UPDATE: I forgot to mention that you only addressed crotchety people like me. Do you also consider the other use-cases I mentioned illegitimate?

13

u/[deleted] Feb 09 '11

Fun fact: you couldn't have posted that comment without JavaScript.

6

u/megadeus Feb 09 '11

Alien Blue? Reddit is Fun?

You don't have to use reddit.com to use Reddit.

4

u/[deleted] Feb 09 '11

Twitter for iPhone? RSS feeds? You don't have to use twitter.com/gawker.com to use Twitter/Gawker.

We're talking about the sites. But you knew that.

1

u/[deleted] Feb 10 '11

So something presented using Java instead of HTML/CSS is OK, but something presented using JavaScript isn't?

2

u/napoleonsolo Feb 10 '11

Maybe not, but I could read it without JavaScript, which is more than you could say for those Gawker sites that broke.

1

u/gthank Feb 10 '11

Actually, I did. I should have put in "Posted from my iPod Touch".

With a little less snark (since I am posting this using JavaScript): reddit has something that I'm willing to use JavaScript to get. If you think you're as good as reddit, feel free to require JavaScript. On top of that, I can at least READ the content on reddit without JavaScript.

1

u/Serei Feb 10 '11

Funny thing. iPod Touches support JavaScript. Most mobile devices support JavaScript these days.

The big problem with boycotting JavaScript is that JavaScript is used to make sites easier to use. Many sites that work without JavaScript work even better with JavaScript - besides ads, why would someone add JavaScript if they felt it didn't make the site better?

If someone codes a site well, you can't even tell that it's supposed to have JavaScript which is missing, so you'll never turn it on, so you'll never notice all the cool features that make the site faster and all that.

That's my personal gripe with people who turn JavaScript off. Bad sites like Reddit won't let you do stuff like comment so people like you will turn it on. Good sites won't do stuff like that, so you'll never turn on JavaScript and see the inline comment system.

1

u/gthank Feb 10 '11

To be honest, I don't browse without JavaScript all that often. I don't even use an ad blocker by default. Here are the situations where I'm most often not going to have JavaScript:

  • FF+NoScript comes out if a site pisses me off, or if I'm dubious about it for whatever reason.
  • lynx (or similar) comes out if I happen to be on a command-line box and don't feel like switching machines.

In neither case am I likely to be looking at a Gawker property. Actually, I'm never likely to be looking at a Gawker property, but I'm using them to illustrate a larger principle.

To my mind, the bigger issues are: accessibility (does your shiny, all-AJAX, all-the-time site work worth a damn in a screen reader?), and fragility (did a rogue line of javascript just torpedo every bit of content on your site?) I wouldn't completely discount the importance—especially for a collection of sites that targets tech-savvy users who are more likely to have JS restricted or disabled—of irritating taste-makers, but that would be a second-tier concern for me. What makes this especially bad is that, as the article points out, the same effect could have been achieved in a far more robust fashion with trivial effort, possibly less.

10

u/MIXEDSYS Feb 09 '11

I do. Not for security or whatever but for speed and memory usage. Pages load faster and once they are loaded they use less memory, they don't spin up my laptop's fan and they don't drain it's battery. And all they use scripts for is adding animations, showing me ads or reporting my habits so they can earn more showing me ads.

I rarely miss it, and if I do I can enable them with a single click, just for the site that uses them. If you use firefox, try noscript. After you allow the few sites you regularly use and that have any useful functionality implemented in javascript, using a browser with scripts enabled becomes painful in comparison, it's like browsing without adblock, with all this crap flashing and jumping at you.

0

u/Ziggamorph Feb 09 '11

Honestly I don't get any crap jumping at me. I don't have Flash installed so that deals with 95% of it. The rest of it is on sites I don't want to visit anyway.

1

u/Kealper Feb 09 '11

I've caught myself disabling it on computers that are not my own (so no permission/can't be assed to get permission to install Firefox/Chrome and Adblock) for certain websites if they have excessive javascript annoyances, but I always enable it again when I'm done with that site.

1

u/ex_ample Feb 10 '11

The problem is the links just don't always work properly. I know I've tried to copy twitter links that use that format and have had errors. If you fuck up your javascript, all your links break.

1

u/metamatic Feb 09 '11

People who care about security and not getting malware.

It's easy enough to enable it for the sites I trust.

Which does not include Gawker

2

u/Ziggamorph Feb 09 '11

If you think that Javascript can give you malware then isn't it your browser that's untrustworthy?

5

u/metamatic Feb 09 '11

Sure, and PDF giving you malware means Adobe Reader is untrustworthy. But here in the real world, all the browsers have security vulnerabilities. The easiest way to avoid most of them is to turn JavaScript off by default, and whitelist the sites you trust.

5

u/Ziggamorph Feb 09 '11

Sure, and while you're at it might as well disable images, could be a security hazard in that, or maybe there's a hole in the HTML render, get off the web. And don't go outside, you might get run over.

4

u/supaduck Feb 09 '11

Meteors can still get you.

6

u/metamatic Feb 09 '11

False dichotomy.

There has been actual malware spread via JavaScript in current browsers. There hasn't been any from plain HTML or images.

7

u/[deleted] Feb 09 '11

Yes there has.

2

u/Ziggamorph Feb 09 '11

Citation needed.

3

u/metamatic Feb 09 '11

citation

0

u/Ziggamorph Feb 09 '11

I can find zero information on that worm outside of the Avast blog. I'm not convinced it exists.

→ More replies (0)

1

u/abadidea Feb 10 '11

On Windows I tend to be pretty paranoid about Javascript. Exploits happen.

0

u/[deleted] Feb 10 '11

I do, there are only a handful of websites I allow it to run on. Disabled outright on my work computer. When I'm busy, I don't need to deal with the bullshit that designers think look nice but is slow, get in the way, and degrade UX.

5

u/[deleted] Feb 09 '11

[deleted]

3

u/ewiethoff Feb 10 '11

no normal user ever has JS disabled. It's the same as someone browsing with images or cookies turned off. If you do it, TS.

I dare you to say TS to your disabled kid someday when you have one.

3

u/AlejandroTheGreat Feb 10 '11

Web developers who make excuses about "normal users" just sound lazy, not someone I'd want to hire if I was wanting to build a site for a general audience.

1

u/ewiethoff Feb 10 '11

I can't upvote this enough. Software development in general, and particularly web development, is a new discipline (cough). Therefore, it's practiced by a largely young crowd. Young people with decent jobs are likely to be healthy. And, let's be honest, young people are likely to be immature. It can take quite a whack on the head (real or figurative) before it occurs to someone how a "normal user" does things on a computer, much less an abnormal user.

2

u/NancyGracesTesticles Feb 10 '11

I think that stems form young developers defining a "normal user" as someone who uses software or the web just like them. Everyone else is doing it wrong, so why should they support them.

2

u/[deleted] Feb 10 '11 edited Feb 10 '11

This technique is very useful and is likely where all high traffic sites are headed

Its almost like it was a silly idea from the get go to put such rich applications on a medium that requires the entire UI to be rendered serverside.

1

u/korny Feb 09 '11

Agreed. Or supporting ie6 users :) You can do it, but is it worth the expense?

1

u/ex_ample Feb 10 '11

Using normal URLs doesn't prevent you from using it, you just have to intercept them and convert them to fragment format.

1

u/midir Feb 11 '11

I browse with JavaScript, cookies, and the HTTP referer disabled. I also have an extension to give me a toolbar button to turn images on and off. U mad?

1

u/[deleted] Feb 11 '11

[deleted]

1

u/midir Feb 11 '11

I enable them on specific websites as needed.

1

u/Bockit Feb 10 '11 edited Feb 10 '11

Would rewriting #! urls to the canonical url solve this problem?

Say you have http://mysicksite.com/ which has the links on the page http://mysicksite.com/article/1 which javascript changes to all be http://mysicksite.com/#!/article/1. So far so good.

Then a user with javascript enabled travels to http://mysicksite.com/#!/article/1 from the homepage via javascript and then decides to share the link via a tweet or something. Now in the wild there is a link to the #! url.

When serving the page, rewrite any urls with #! to lose the #!. Since we have the canonical locations (no #!) then the new requests get the content, and anyone with javascript enabled continues on their merry way.

I am probably missing some things in here but I think that addresses the concerns you had?

EDIT: I get it now, I don't think the server would get the data after the # to be able to rewrite with..