Chris Coyier is not too pleased about browsers changing the way cross-origin iframes handle certain native JavaScript calls such as alert and confirm:

Cross-origin iframes are essentially the heart of how CodePen works. You write code, and we execute it for you in an iframe that doesn’t share the same domain as CodePen itself, as the very first line of security defense. We didn’t hear any heads up or anything, but I’m sure the plans were on display.

The change is about security and performance, it seems. There’s a workaround using postMessage, but that comes with its own problems that Chris details. Overall, it seems the way this change is being rolled out is more of a concern than the change itself…

Believe it or not, I generally am a fan of Google and think they do a good job of pushing the web forward. I also think it’s appropriate to waggle fingers when I see problems and request they do better. “Better” here means way more developer and user outreach to spell out the situation, way more conversation about the potential implications and transition ideas, and way more openness to bending the course ahead.

This sounds too good to be true, because it kind of is. There is no escaping the cloud (because of email trust) or the requirement of sysadmin’ing this setup (sending/receiving email is critical). If you slack on the details or upkeep, it’s your email.

I have been on an ongoing quest to free myself from cloud services for years now. During this time, I have hosted my personal email (@bloomqu.ist) on a Google Apps G Suite Google Workspace account, which, while convenient, also means that my personal emails are at the whims of one of the world’s most privacy-hostile companies.

Don’t get me wrong – what Zach shared is quite possible, but it’s still too time consuming and difficult to host your own email. It’s untenable long-term. There’s a billion dollar business there waiting for someone to seriously compete with Google on email, and not be evil. Fastmail comes to mind. I could be wrong, but I would characterize them as being an alternative, not seriously competing with Google.

Open Source Insights is an experimental service developed and hosted by Google to help developers better understand the structure, construction, and security of open source software packages. The service examines each package, constructs a full, detailed graph of its dependencies and their properties, and makes the results available to anyone who could benefit from them. The goal is to provide developers with a picture of how their software is put together, how that changes as dependencies change, and what the consequences might be.

It currently indexes GitHub, npm, and pkg.go.dev. Plus they recently added a dedicated security advisory page. For an example, check out left-pad’s page which shows 441 direct dependents and 15315 indirect dependents.

Paul Bakaus teased this on JS Party #174, but the announcement landed even sooner than he said it would:

Chrome, at least in its experimental Canary version on Android (and only for users in the U.S.), is getting an interesting update in the coming weeks that brings back RSS, the once-popular format for getting updates from all the sites you love in Google Reader and similar services.

In Chrome, users will soon see a “Follow” feature for sites that support RSS and the browser’s New Tab page will get what is essentially a (very) basic RSS reader — I guess you could almost call it a “Google Reader.”

I sure do hope this is a small step on a longer journey to bring RSS (back) to the masses. It really is one of the web’s most virtuous technologies. Let’s not get too excited, though:

For now, though, this is only an experiment. Google says it wants to gather feedback from “publishers, bloggers, creators, and citizens of the open web” as it aims to build “deeper engagement between users and web publishers in Chrome.” Hopefully, it won’t stay this way.

My only question is: where can we spam submit this feedback that they’re after?!

Paul Bakaus from Google Web Creators joins Amal, Nick, & Jerod to talk about this new initiative to promote, educate, and equip people to create on the web.

Along the way we discuss Web Stories, AMP, RSS, Google Reader, and more, of course. Join us: for a more dope web!

This is a solid move in protecting people’s privacy, especially for those completely unaware. Sounds like WordPress is considering the same and a helpful Hacker News commenter typed up how to accomplish it on a bevy of popular web servers.

Related: I just deployed this to changelog.com as well. 😎

In a copyright decision that will undoubtedly have ripple effects on the software industry for years to come, the Supreme Court of the United States held that:

Google’s copying of the Java SE API, which included only those lines of code that were needed to allow programmers to put their accrued talents to work in a new and transformative program, was a fair use of that material as a matter of law.

This quote pulled from the linked opinion by a hacker news commenter drives right in to the heart of the matter:

“Google copied approximately 11,500 lines of declaring code from the API, which amounts to virtually all the declaring code needed to call up hundreds of different tasks. Those 11,500 lines, however, are only 0.4 percent of the entire API at issue, which consists of 2.86 million total lines. In considering “the amount and substantiality of the portion used” in this case, the 11,500 lines of code should be viewed as one small part of the considerably greater whole. As part of an interface, the copied lines of code are inextricably bound to other lines of code that are accessed by programmers. Google copied these lines not because of their creativity or beauty but because they would allow programmers to bring their skills to a new smartphone computing environment.”

Austin Henley:

I wanted to test my mastery of Node.js and my reliance on Google and Stack Overflow, so I set out on an adventure to make a todo list web app without touching any external resource for help. I just couldn’t do it…

But this got me thinking. How many people out there, especially professional web developers, can do this?

I used to google for things all the time while programming, but not anymore. 😉

You’ve likely heard a lot about Google’s monorepo and how it impacts the org’s development productivity, but have you heard how it makes managing their open source efforts easier as well?

A nice primer on Nextcloud, which is worth a second look if you haven’t kicked the tires in a couple years.

I recently revisited Nextcloud and was amazed by all the changes I saw. The project has evolved into a complete solution that can replace big-name solutions like Google Drive and Microsoft 365. Nextcloud’s new feature set, especially Nextcloud Hub, is outstanding, offering collaborative documentation editing, file version control, integrated chat and video calling, and more.

Oh, and ICYMI our conversation with Nextcloud’s Frank Karlitschek ~> #383

This is under heavy development but is available publicly as a ‘pre-alpha’ developer preview. Tsunami itself is a general purpose network security scanner, but it has a plugin system for detecting specific vulnerabilities. The plugins themselves are hosted in their own repo.

Will Schreiber:

I watched then-PM Sundar Pichai announce Chrome OS. My heart raced. It was perfect.

I got my email through Gmail, I wrote documents on Docs, I listened to Pandora, I viewed photos on TheFacebook. Why did I need all of Windows Vista?

In 2010, I predicted that by 2020 Chrome OS would be the most popular desktop OS in the world. It was fast, lightweight, and $0.

Will isn’t the only one that thought Chrome OS would change the game. 10 years later his usage patterns tell a much different story.

Have you ever wished you had a no-frills, word-processing desktop app dedicated to just Google Drive? Annoyed at having to click the Go to My Drive button everytime you visit https://drive.google.com? Want a Microsoft Word-esque experience for your Google Drive? Or simply looking to separate Google Drive from the other bajillion tabs that you opened for your research paper? Look no further!

I appreciate efforts like this because while I love web apps, I don’t always love running them in my web browser.

Yeah, this might be crazy… Crazy like a FOX

If you use (and abuse) Gmail’s filters in order to wrangle your inbox, this tool might help you keep your sanity as you maintain them over time.

This utility helps you generate and maintain Gmail filters in a declarative way. It has a Jsonnet configuration file that aims to be simpler to write and maintain than using the Gmail web interface, to categorize, label, archive and manage your inbox automatically.

If you’re concerned with the amount of data Google has on you, this list of alternative browsers, web apps, operating systems, and hardware may help you ween yourself from the company. Looking at this list, it’s amazing just how much value Google offers in trade for our data. A note from the author:

It’s a shame that Google, with their immense resources, power, and influence, don’t see the benefits of helping people secure themselves online. Instead, they force people like us to scour the web for alternatives and convince our friends and family to do the same, while they sell off our data to the highest bidder.

We’re talking with Sherol Chen, a machine learning developer, about AI at Google and AutoML methods. Sherol explains how the various AI groups within Google work together and how AutoML fits into that puzzle. She also explains how to get started with AutoML step-by-step (this is “practical” AI after all).

After I wrote about Stein earlier today, I got to wondering about open source alternatives to Google Sheets. Coincidentally, this article popped up in my RSS reader.

EtherCalc can be self-hosted or there are hosted offerings, including one at EtherCalc.org. It looks a bit rough around the edges, but that’s often the case with open source GUIs. Maybe kick the tires and blog about your experience? We’d happily log the results here on Changelog News.

This looks like a great option for proofs of concept or when you want to take an idea to market as fast as possible. It’s also probably empowering to non-developers on the team since so many people can slice-n-dice spreadsheets better than SQL databases. You can self-host the open source version or pay for the hosted offering. I’d love to see a comparison between this and Airtable.

JS Party listeners will find a familiar guest voice on this episode from the Google Webmasters channel.

Real life data on how Google indexes javascript-rendered websites today. This has been a controversial subject, and this article by no means settles it entirely, but provides some strong data for what types of dynamic content are well indexable and which are not.

Though to be honest, I think the most important conclusion the author makes might be this one:

If you need your site to perform on search engines other than Google, you will definitely need pre-rendering of some sort.

A clever hack that is now being investigated by Google’s internal forums. How it works:

1. Google Docs take up 0 bytes of quota in your Google Drive
2. Split up binary files into Google Docs, with base64 encoded text
3. Encoded file is always larger than the original. Base64 encodes binary data to a ratio of about 4:3.
4. A single doc can store ~1 million characters. This is around 710KB of base64 encoded data.

Google Analytics runs on over 56% of all websites. It’s the backbone of ad-tech across the web. Unfortunately, for site owners like me who just want to learn how people are using their website—while respecting their privacy—there simply aren’t any alternatives that meet all my requirements. So in two days, after a couple dead-ends, I built my own using React, AWS Lambda, and a spreadsheet. This is how.

It’s somewhat ironic that the datastore for this project is Google Sheets. That aside, this is a well-done effort and one that I wouldn’t mind adapting for use around these parts.

A little ingenuity paired with changes to ReCaptcha’s audio challenge allowed this hacker to create a Python ‘robot’ that defeats the ‘not a robot’ test with 90% accuracy. The approach is brilliant:

1. Navigate to Google’s ReCaptcha Demo site
2. Navigate to audio challenge for ReCaptcha
3. Download audio challenge
4. Submit audio challenge to Speech To Text
5. Parse response and type answer
6. Press submit and check if successful

The code is small enough to grok in 5-10 minutes. Love it!

Peter Bright writes for Ars Technica:

Microsoft adopting Chromium puts the Web in a perilous place. […] With Microsoft’s decision to end development of its own Web rendering engine and switch to Chromium, control over the Web has functionally been ceded to Google. That’s a worrying turn of events, given the company’s past behavior.

This post was mentioned in Slack by James Lovato about a former Microsoft Edge intern claiming Google callously broke rival web browsers. Then, Nick Nisi chimed in to mention this post by Jeremy Noring as “an interesting rebuttal/defense of what they’re doing.”