[RFC] Registration & Login Overhaul

Note: We are moving the topics of this forum and it will be deleted at some point

Publish your own request for comments/change or patches for the next version of phpBB. Discuss the contributions and proposals of others. Upcoming releases are 3.2/Rhea and 3.3.
phynixx
Registered User
Posts: 22
Joined: Thu Sep 22, 2011 12:18 am

Re: [RFC] Registration & Login Overhaul

Post by phynixx »

naderman wrote:When I said
naderman wrote:phpBB must be able to operate without javascript
I meant exactly that. I did not say that we cannot add things like a javascript password check. All we need to make sure is that the board is still fully functional without javascript.
If that means spending a lot more time trying to make sure there's alternate code for every piece of javascript versus using that time to implement more features I disagree. IMO unless it is somehow discovered that the phpbb user base is disproportionately made up of that ~2% the time of developers is better spent elsewhere.

Put differently: there's this thing that does something cool/nice/convenient/<insert positive experience here>. Only 2% of the phpbb user base would make use of it and it would require a non-negligible amount of time to implement. What would the community say about spending that time to include it in the core distribution? Probably that while it may be cool/nice/convenient/etc., it's not a good use of developers time and someone should probably just write a mod for it.

My .02.

User avatar
DavidIQ
Customisations Team Leader
Customisations Team Leader
Posts: 1834
Joined: Thu Mar 02, 2006 4:29 pm
Location: Earth
Contact:

Re: [RFC] Registration & Login Overhaul

Post by DavidIQ »

Well the other side to what naderman said is that JavaScript can be manipulated client-side so the no JavaScript fallback prevents users from doing something they should not otherwise be able to do.
Image

phynixx
Registered User
Posts: 22
Joined: Thu Sep 22, 2011 12:18 am

Re: [RFC] Registration & Login Overhaul

Post by phynixx »

True but there should be a distinction made between ensuring coding is done in such a way that a user can't do something they shouldn't be able to via javascript, and ensuring that every single use of javascript is also coded with a non-JS version to be "friendly" to those that have it turned off.

That said, I believe we have really truly hijacked this thread. So, how about the Registration & Login Overhaul... :)

Perhaps the religious JS debate should be relocated so VSE+ can get on with his (her?) regularly scheduled programming? Just a suggestion since theoretically we should be focusing on the merits & specifications of the overhaul and this seems to have spun off into a (phpbb) global discussion.

Oleg
Posts: 1150
Joined: Tue Feb 23, 2010 2:38 am
Contact:

Re: [RFC] Registration & Login Overhaul

Post by Oleg »

VSE+ wrote: Turning off Javascript is akin to using a monochrome monitor these days. It's possible, but nobody in their right mind is doing it. To turn off javascript is to cripple your browser and absolutely diminish what the web has to offer. The option to disable it is an archaic vestige left over in browser preferences from a time when Javascript was new, untrustworthy and often used for illicit purposes. Those who do turn it off, deserve to have a limited and difficult experience (kind of like those who continue to use IE6 :lol: )
You have it backwards. Websites insist on using javascript for no good reason, rendering themselves useless when javascript is disabled, therefore people are forced to run javascript. Same thing as when one builds a website entirely in flash, anyone who wants to see the site has to have flash installed.

Javascript is untrustworthy. You may not realize it but any site that uses, for example, google analytics allows google to hijack sessions of any user visiting the site. You may expect google to not do that, but including javascripts from 5 or 10 different domains is not exactly uncommon today, and each of those domains has unrestricted access to user actions and data. Firefox crippled visited links styling because javascript allowed any site to check whether you visited any other site. How much of http://yro.slashdot.org/story/11/10/03/ ... ther-sites do you suppose is done via javascript? Have you seen http://www.clicktale.com/? And so on and so forth.

I installed noscript in my main firefox profile recently and I only allow javascripts for sites that 1) I trust, 2) I have to use, 3) where it is absolutely required. Most websites on the internet probably make some use of javascript, and most of them function either just fine or acceptably well without javascript.

User avatar
VSE
Extension Customisations
Extension Customisations
Posts: 673
Joined: Mon Mar 08, 2010 9:18 am

Re: [RFC] Registration & Login Overhaul

Post by VSE »

Oleg wrote: Websites insist on using javascript for no good reason
:shock: I don't agree with that statement. Javascript allows web developers to enhance usability in certain ways that would be impossible through markup alone. Websites insist on using javascript to make their web "sites" work more like web "apps".
Has an irascible disposition.

User avatar
callumacrae
Former Team Member
Posts: 1046
Joined: Tue Apr 27, 2010 9:37 am
Location: England
Contact:

Re: [RFC] Registration & Login Overhaul

Post by callumacrae »

VSE+ wrote:
Oleg wrote: Websites insist on using javascript for no good reason
:shock: I don't agree with that statement. Javascript allows web developers to enhance usability in certain ways that would be impossible through markup alone. Websites insist on using javascript to make their web "sites" work more like web "apps".
You'd be amazed what can be done without JavaScript - try my website in Chrome or Firefox - http://callum.x10hosting.com/
Made by developers, for developers!
My blog

User avatar
VSE
Extension Customisations
Extension Customisations
Posts: 673
Joined: Mon Mar 08, 2010 9:18 am

Re: [RFC] Registration & Login Overhaul

Post by VSE »

callumacrae wrote:You'd be amazed what can be done without JavaScript - try my website in Chrome or Firefox - http://callum.x10hosting.com/
that's just CSS transitions :mrgreen: although, as you mention, you're limiting that "feature" to only a few modern browsers...with javascript you could make those same effects work in all browsers...and you can also use javascript to make those HTML5 tags work in older browsers too... but you already knew that :)
Has an irascible disposition.

phynixx
Registered User
Posts: 22
Joined: Thu Sep 22, 2011 12:18 am

Re: [RFC] Registration & Login Overhaul

Post by phynixx »

So much for a new thread :)
Oleg wrote:You have it backwards. Websites insist on using javascript for no good reason, rendering themselves useless when javascript is disabled, therefore people are forced to run javascript. Same thing as when one builds a website entirely in flash, anyone who wants to see the site has to have flash installed.
Again I don't think the question here is how good, or bad, the use of Javascript is but what the majority of the userbase has. As previously mentioned, it's enabled for the vast majority (as is Flash I think, however I could be wrong and it's not the topic of discussion). If phpbb wasn't so big, and catered to a more internet-savvy group then perhaps that would be less-so. But its popularity has resulted in adoption by users of just about every type.

You're probably entirely correct about why people have it enabled (use of JS all over the place when it isn't necessary). And to callumacrae's point, there is a *lot* that can be done without it. But... at the end of the day it's out there and just about everybody has it enabled.

As a result when faced with the choice of "Must we create the Registration & Login, and possibly the entire core of phpbb, with an alternate to every JS function or can we safely make JS the standard and allow for those that wish to provide alternates to do so outside the core?" I believe that providing alternates is a safe option. We can have the development team direct their time and efforts towards further functionality instead of those (numerous) alternate functionality.

phynixx
Registered User
Posts: 22
Joined: Thu Sep 22, 2011 12:18 am

Re: [RFC] Registration & Login Overhaul

Post by phynixx »

Should it come down to it though, I suppose we could set up a code-check with the next release to actually determine the % of JS enabled users... however IMO the stats presented by the rest of the web should probably be enough.

User avatar
naderman
Consultant
Posts: 1727
Joined: Sun Jan 11, 2004 2:11 am
Location: Karlsruhe, Germany
Contact:

Re: [RFC] Registration & Login Overhaul

Post by naderman »

I'm not sure how much clearer I can make this. For the reasons outlined phpBB must remain functional without javascript. Any sensible use of javascript adds UI improvements on top of a fully working renderable HTML page. So any sensible use of javascript will already allow the use of the page without javascript. I don't see any value in continuing this discussion since it is rather clear that a) we will not be adding javascript in a way that prevents the use of phpBB by people who have javascript disabled b) we already use javascript to improve the UI in some places and are planning on doing so in more places. Now please let's get back to the subject at hand ...

Post Reply