Remix.run Logo
chuckadams 19 hours ago

The issue in question is just one of the several long-unfixed vulnerabilities we know about, from a library that doesn't have that many hands or eyes on it to begin with.

sroussey 19 hours ago | parent | next [-]

And why doesn’t Google contribute to fixing and maintaining code they use?

kccqzy 18 hours ago | parent | next [-]

Because they don't want to use the code. They begrudgingly use it to support XSLT and now they don't use it.

lunar_mycroft 18 hours ago | parent [-]

Maintaining web standards without breaking backwards compatibility is literally what they signed up for when they decided to make a browser. If they didn't want to do that job, they shouldn't have made one.

spookie 17 hours ago | parent | next [-]

They "own the web". They steer its standards, and other browsers' development paths (if they want to remain relevant).

It is remarkable the anti-trust case went as it did.

17 hours ago | parent | prev | next [-]
[deleted]
will4274 17 hours ago | parent | prev | next [-]

According to whom?

Chromium is open source and free (both as in beer and speech). The license says they've made no future commitments and made no warrants.

Google signed up to give something away for free to people who want to use it. From the very first version, it wasn't perfectly compatible with other web browsers (which mostly did IE quirks things). If you don't want to use it, because it doesn't maintain enough backwards compatibility... Then don't.

lunar_mycroft 17 hours ago | parent | next [-]

The license would be relevant if I'd claimed that removing XSLT was illegal or opened them up to lawsuits, but I didn't. The obligation they took on is social/ethical, not legal. By your logic, chrome could choose to stop supporting literally anything (including HTML) in their "browser" and not have done anything that we can object to.

iIRC, lack of IE compatibility is fundamentally different, because the IE specific stuff they didn't implement was never part of the open web standards, but rather stuff Microsoft unilaterally chose to add.

shadowgovt 7 hours ago | parent | next [-]

We object with our feet, by switching browsers.

What odds would you put dropping XSLT support at for triggering a user migration?

will4274 9 hours ago | parent | prev [-]

> By your logic, chrome could choose to stop supporting literally anything (including HTML) in their "browser" and not have done anything that we can object to.

Literally this. Microsoft used to ship a free web browser. Then they stopped. That's not something anybody can object to.

> because the IE specific stuff they didn't implement was never part of the open web standards, but rather stuff Microsoft unilaterally chose to add.

Standards aren't holy books. It's actually more important to support real customer use cases than to follow standards.

But you know this. If standards are more important that real use cases, then the fact that XSLT has been removed from the html5 standard is enough justification to remove it from Chrome.

lunar_mycroft 6 hours ago | parent [-]

> Literally this. Microsoft used to ship a free web browser. Then they stopped. That's not something anybody can object to.

There is a fundamental difference between ceasing to make a browser and continuing to make a browser, while not meeting your expectations as a browser maker.

> If standards are more important that real use cases, then the fact that XSLT has been removed from the html5 standard is enough justification to remove it from Chrome.

Browsers very much have not depreciated support for non-HTML5 markup (e.g. the HTML4 era <center> tag still works). This is because upholding devs and users expectation that standards compliant websites that once worked will continue to work is important.

spookie 17 hours ago | parent | prev [-]

The license is the way it is not by choice. We should be clear about that and acknowledge KHTML, and both Safari and Chromium origins. Some parts remain LGPL to this day.

16 hours ago | parent | prev [-]
[deleted]
SoftTalker 18 hours ago | parent | prev | next [-]

Because in this case it doesn't contribute to their ability to deliver ads.

19 hours ago | parent | prev [-]
[deleted]
timeon 17 hours ago | parent | prev [-]

If that was case they would switch to (rust XPath/XSLT) Xee.