Comment by tda
9 months ago
I seriously thought that implementing some site specific custom rendering behaviour was meant as a joke. Why change html/css for a website when you can just implement some hardcoded site specific behaviour straight in the rendering engine? What could possibly go wrong?
But after having a closer look at the PR, the 1900 LOC monstrosity Quirks.cpp actually seems to exist with lots of things like
if (host == "tripadvisor.com"_s || host.endsWith(".tripadvisor.com"_s))
m_needsRelaxedCorsMixedContentCheckQuirk = true;
Fixing CORS issues has never been easier
That's messed up, why should I put up with CORS when others have a special treatment...
Its used here: https://github.com/WebKit/WebKit/blob/dc1354a1d26db54d17f7d3...
Seems to be specifically for (not) upgrading images and videos from http to https, nothing else.
If a browser has too many compatibility issues, users will switch away. Outreach to the sites in question takes time and is often unsuccessful. Quirks is the pragmatic answer.
WebKit is used by the second most popular browser after Chrome. Don't forget iOS users.
https://gs.statcounter.com/browser-market-share
25 replies →
I don't know about quirks specifically, but often it takes many, many months before a WebKit commit actually ships to end users in Safari.
Anyway, Apple engineers aren't known for their outreach.
I hate CORS. Garbage like this is a large reason why. CORS works differently in every browser and every website.
I don't hate CORS when writing my own stuff, to be clear. Adding Access-Control-Allow-Origin: * to my own website's headers is easy enough. I hate when I'm using a website and something doesn't work and I look at the console and see CORS errors. Opening the same website in Chrome usually works.
I hate CORS.
>CORS works differently in every browser and every website.
Do you have some examples of this?
Not anything concrete, just memories of things not working, me looking at the JS console, seeing CORS errors, and seeing it work in Chrome, as I described. And the comment I replied to showed that it works differently between websites, namely:
2 replies →
I guess a similar thing is happening with GPU drivers and games.
yes, and drivers (used to at least) check the filename of the exe causing unexpected behaviour like performance degradation or even gains in some cases
Still now I'd say - Counter-Strike 2's release was foreshadowed by nvidia or ATI having cs2.exe in some config files last year.
In cases like benchmarking software, I guess.
I wonder if any of those rules could be (mis)used to workaround or defeat iOs/macOs security features?