[madeofpalk]

So over a year ago they did publish their "Intent to remove" for this https://groups.google.com/a/chromium.org/g/blink-dev/c/hTOXi...

Honestly, what is the right way to "notify the people affected" for changes like this, apart from publishing them to their mailing list. There is no centralised place for these sorts of things, apart from each developer's mailing lists, or the standards mailing lists.

I'm a web developer and I've never paid attention to the blink-dev mailing list, but perhaps I should more?

[gpm]

1. Blog posts on a real big corporate blog, not on some mailing list no one reads.

2. A few months later: Warnings in the dev tools.

3. A few months after 2, at least a year after 1: Warnings on websites using the feature, for this feature it would probably have made sense to make a yellow or red ex through the padlock.

4. A year after 3, at least 2 years after 1, maybe actually consider actually removing it.

It's folly to think that all important websites are actually maintained, it's certainly not the case that they can all roll out updates within months (think internal websites from vendored software that is rarely updated), and there's no reason to rush. I'd consider what I outlined here to be a very aggressive rollout schedule.

Better than removing it entirely, would be to permanently put in a version of the feature that is still functional but avoids the issues with it. E.g. change the alert dialog to something hideous that clearly explains "this might not be from where it claims it is", but don't entirely break backwards compatibility.

[gpm]

The more general version of this is

1. Tell people who read the news (blog)

2. Tell people who make the thing you're breaking (devtools)

3. Tell users, but without breaking it since it's not something they can solve (padlock)

4. Maybe finally break it

[Orphis]

I've removed some feature from the web in Chrome after a long deprecation phase with warnings in devtools, proper announcements in ALL the relevant mailing lists and release notes. Still, many major websites broke as they failed to implement the very simple required changes in their products.

Did they break in Chrome? No, we landed the change at a later date than announced. But Firefox did the same removal and it landed to stable a few weeks before Chrome. They also advertised for the removal extensively and were hit by all the "Major site X and Y are broken" bugs unfortunately. A couple days later, everything was fixed though, when Chrome's side of thing reached stable, no sites were really impacted.

The replacement API had been available for many years before, people used the old non-standard and deprecated way still.

So no, websites owner will not be proactive and fix their products no matter what you do unless they break. We do our best to be upfront with the changes, but both sides have to be willing to communicate for it to happen.

[gpm]

> proper announcements in ALL the relevant mailing lists and release notes.

I can't emphasize enough that mailing lists are worthless for this. Your average web developer reads no mailing lists, I'd be surprised if even 5% did, and those 5% are going to be clustered. Release notes (that anyone reads) come too late, since people only read them once users are already installing the broken browser.

Announcements that you actually expect to be read need to be in a much higher profile place, it looks like this is an appropriate blog: https://www.blog.google/products/chrome/ - even then it should be written with the goal of it being picked up by places like reddit/HN/twitter/news. Even then you should expect that most web developers won't find out, and most who do find out won't change anything in regards to your announcement that your new version of the browser is going to break compatibility with their perfectly functional website, incentives just won't align for many of them to fix it pre-emptively.

That last part is why I advocate for indicating the issue in a user visible but non-breaking way first, that's going to be the only way to get funding/time to update to your new version for many websites.

[danShumway]

I'll add onto this, putting an announcement out needs to be followed up by checking to see if the announcement has gained any traction.

Announcing breaking changes is not a checklist that can be filled out and then ignored. Put out an announcement, see if any other sites or prominent developers pick up on it, if they haven't picked up on it then the job isn't done and the change needs to be advertised more.

Maybe for some things posting it to the blog might be enough, and the major stakeholders that need to know will pick it up. Then you can move on to the next steps. But if they don't see it, and you don't see any reaction to the blog posts, then don't just move onto stage 2 because "they had their chance, if it breaks now it's their fault." :)

Have some standards of what level of conversation and preparation you expect to see from web developers before you consider the community adequately informed.

[TeMPOraL]

Another idea that could reach a significant fraction of web developers: have the crawler check for potential use of deprecated features and alert the website owners through Google Search Console e-mail flow (using a separate message from regular GSC updates). The people who read GCP reports are likely to get worried and forward it to devs responsible for the site.

Another variant of this: surface such warnings on Google Analytics page/report. The easiest way to get software developers to do something is to convince sales&marketing that conversions will drop if they don't do it.

[Orphis]

Here's an example of a major bank website with some user visible non-breaking issue I saw recently: https://youtu.be/GFvaRgFf4LU?t=482 . It seems that it's been visible for a while, yet is not fixed. It's actually quite common to see errors unfixed in software as you may know.

No matter what you do, some websites will only be fixed a long time after very obvious warnings are displayed. Some will never be fixed until they actually stops working. Some will just never be updated at all.

Maybe you're one of the people who take their car to the repair shop when the engine light is on, but there are also many others who will just ignore it as the car still drives "fine" (for now at least).

Regarding your suggestion of using Reddit, HN, Twitter, news, it's not always possible or relevant. I've seen a lot of very interesting publications just not getting any traction on those are they're boring in nature or cater to experts mainly. They're also read only by a fraction of users.

Unfortunately, if you're hit by any issue, you shouldn't be only asking what others should do for you, but also what you can do to catch those issues in the future yourself. All sides can maybe do better at broadcasting information about some changes, or voice their opinion better and sooner, but it's not an easy problem with an easy solution.

[danShumway]

> No matter what you do, some websites will only be fixed a long time after very obvious warnings are displayed.

Okay, let's try another angle. Does the Chrome team have any stats at all about how many developers were informed about this change and were able to adapt to it before it went live?

You're right, some people are going to slip through the cracks, that's inevitable. How many people? How does the Chrome team determine if they're doing a good enough job with communication, what metrics for developer uptake are even being measured here? Is the Chrome team watching any public spaces like Twitter or Reddit to see whether or not changes are actually being seen and disseminated in developer communities?

You're phrasing this as if it's just a subset of developers who didn't realize what was going on. I would surprised if that's the case, I suspect the vast majority of developers did not realize what was going on.

> I've seen a lot of very interesting publications just not getting any traction on those are they're boring in nature or cater to experts mainly. They're also read only by a fraction of users.

Also can't stress this enough, still more users than read the mailing lists. They will still get more traction than Chrome's existing announcements. You don't have to stop posting to the mailing lists, just put a little bit of effort into going into communities where developers actually spend time.

We know that developers don't read the mailing lists. So let's try to find out what they do read.

> Unfortunately, if you're hit by any issue, you shouldn't be only asking what others should do for you, but also what you can do to catch those issues in the future yourself.

Definitely, but this is a really tone-deaf response to people telling the Chrome team that they have a problem with communication.

This is also one of my evergreen complaints about how breaking changes work in Chrome -- it always ends up being phrased as either the developers fault or an unsolveable problem. The best we can get is "all sides can maybe do better at broadcasting information". Yes, we have to treat Chrome like it might break our stuff randomly. We have to constantly be engaged in the web standards process, even when it's exhausting, even when it means we're drinking a firehose of information. Yes, we need to set up automated testing for all of our projects, we can't put sites up online and expect them to keep working.

We do our best to mitigate the problems that the Chrome team is causing by refusing to proactively reach out, by refusing to do anything beyond just posting their changes and giving people time to read them. And we don't get any indication that the process is ever going to improve.

Please meet us halfway.

Or at least the Chrome team could take your own advice and ask itself what it can do to make messaging more effective, rather than "only asking what developers should do for them" to make breaking changes go more smoothly.

[fomine3]

Announcement of SameSite=Lax by default was good. They were posted on web.dev.

[danShumway]

There's always room for improvement on all of this stuff, but I'm generally in agreement, I thought the SameSite=Lax rollout went a lot more smoothly, and I saw people outside of Chrome mailing lists talking about it and sounding alarms that sites might break.

I try to pay attention to upcoming potentially breaking changes, but I didn't know about the iframe changes (luckily they didn't affect any of my projects). I did hear about the SameSite changes from multiple sources, it felt like there was a real effort there to try and break the news into the mainstream.

I also think a big part of what made SameSite=Lax better was that it wasn't just Chrome notifying people about the changes, it was other developers in the community helping to spread the word. I saw multiple blog posts and Twitter threads warning about it.

I don't think the model of "Chrome announces something then wipes its hands and steps away" works in the real world. Developers need to be included in efforts to spread awareness, because there are communities that the Chrome team doesn't have access to, and not everyone pays attention to what the Chrome team posts. It's better if multiple stakeholders both inside and outside of Chrome are invested in getting the word out.

It sounds to me like a big part of the complaint about the removal is that there isn't currently a good replacement for `alert` in intro tutorials, or a clear process for sites that depend on `alert` to quickly move to something else. I don't expect the Chrome team to understand that in advance, the web is enormous and they are going to miss use-cases, no single team can predict the full impact of every browser change. But early awareness of changes and early interaction with communities outside of the main mailing lists will make it more likely that developers and communities raise these issues so they can be addressed before there's a PR fallout.

[danShumway]

> We do our best to be upfront with the changes, but both sides have to be willing to communicate for it to happen.

What processes did Chrome follow in this case to identify sites that might break, and did it reach out directly to any of the people who would be affected?

I'm seeing comments from people like Chris Coyier that they were caught off guard with this change: https://twitr.gq/chriscoyier/status/1420027533005836298#m

If the creator of CodePen didn't realize this was coming, and if it didn't register to anyone in charge of this change that he should be contacted about it and included in the discussion before late July, then to me it really doesn't seem like the communication breakdown here is happening because of website developers.

[Orphis]

There are archives you can sample to measure the impact of a change to some degree. We can use them to have an estimation of how common some patterns are. It's tricky to query so it may not work for advanced use cases or identify cross origin issues.

And it's not possible to reach out directly to those people. We can't just send deprecation notices to random contact emails (if there's any) on websites. We can't just open a "support request" to L1 customer support of websites telling them their site might not work soon. We're not going to send dead-tree mail to addresses listed on websites either.

If you want to support specific browsers, as part of your ongoing maintenance, you should test your site with canary and beta versions of browsers to catch issues before they go live at a minimum. You can also read the relevant mailing lists or blog posts for the major browsers to have an idea of the direction they're taking.

Chrome 91 went stable July 15. But the first beta was April 22. The change was probably in Canary before that as well. Quite a long time to catch issues with the right automation.

Personally, I wouldn't want to have to read the mailing lists and other articles. I would want a dashboard that tells me everything is tested and working fine automatically. And when it doesn't, I know I have many months to fix the issue before it hits stable and find the relevant documentation about the changes that might be causing the issues. Or just open an issue to the browsers, sometimes people are using APIs in very unexpected ways, or you know, a bug sneaked in despite the testing we have in place.

[danShumway]

> And it's not possible to reach out directly to those people. We can't just send deprecation notices to random contact emails (if there's any) on websites.

To be clear, we're talking about Chris Coyier right now. The Chrome team doesn't have any way to contact him? The team had to know that REPLs would be impacted by this, right?

You can blame people for not having the right automation and dev tools lined up and for not reading the right blogs, but it still seems to me like this is covering up the fact that the Chrome team does not view it as their job to reach out to web developers or put serious effort into marketing changes. If Chris didn't know about these changes, then I seriously doubt that the Chrome team was getting any kind of a representative sample of developer feedback during this process.

> Personally, I wouldn't want to have to read the mailing lists and other articles. I would want a dashboard that tells me everything is tested and working fine automatically.

What view of the web does the Chrome team have if they think the majority of site operators have this kind of testing setup running? It just feels so ridiculously out of touch with the reality of where web developers congregate and how news gets disseminated. I know it's a difficult problem, but the responsibility of Chrome is to work with the web community as it exists, not as the professional fully-automated community they'd like it to be.

Chrome couldn't send out some Twitter DMs? Chrome team couldn't post a heads up to HN? Any effort to post anything to the popular web dev communities on Reddit? Did the team reach out to any any popular bloggers or members of the community to ask them to spread the word? When the Chrome team is making changes to the dominant browser for what is (imo) the most important platform on the planet, it just is not enough to say "we put it in the mailing list, and you weren't testing well enough." The expectations for the Chrome team here are higher, because Chrome matters more than other products.

Yes, developers need to meet Chrome halfway on communication, but frankly, Chrome is not coming halfway right now to meet us. It should not have been a surprise to some of the biggest REPL sites on the web that their products were about to break. I don't know what to say about this, I'm not trying to be mean, but if the Chrome team's perspective is that developer communication isn't at least partially their problem to solve, and they think that if they roll out a feature and nobody knows about it that developers are the problem, then those people shouldn't be in charge of the dominant web browser.

[Orphis]

> To be clear, we're talking about Chris Coyier right now

People are just human, they will fail to understand changes sometimes and their impact. Or maybe, they're just not going to be listening at all. Or they saw it, and then a coworker interrupted them and they forgot. If you tell people that the Earth temperature is going to raise 1 degree, most will just glance over it and not understand the ramifications.

In the end, I don't know that much about this specific change, it's not my domain of expertise, but I know you can't expect random people to receive random messages from random sources. First it doesn't scale, and second it would be preferential treatment which doesn't seem to me in line with the healthy platform the web should be.

> What view of the web does the Chrome team have if they think the majority of site operators have this kind of testing setup running?

No, it's a personal opinion.

And yes, I believe that if you have expectations on the availability of your website, it should be tested frequently enough, with automation or simply having the regular team working on the product or QA use newer browser versions on the regular. If you're only reacting to breakage instead of being proactive, you'll never be able to have a service continuously running and should lower your expectations. The platform is evolving and changing. Most of the time, the impact will be negligible, but sometimes it's not, and you should be prepared. Or you should just freeze all software updates in your company context until you can vet that every critical component works fine.

> It should not have been a surprise to some of the biggest REPL sites on the web that their products were about to break

REPL websites are still largely working though, my samples are still working the same, I just don't use the affected APIs which I've avoided for a long time already. If they care deeply about some specific scenario, they should probably be tested. And every failure to catch an error is an opportunity to learn, for all sides involved.

[svieira]

Testing base, stable (from my perspective) infrastructure? Should I have tests that validate that JPGs still render? How about when used as a CSS background image? Does Chrome test the register reads assembly code produced by the C++ compiler in case there's a breaking change that gets missed?

[danShumway]

I don't mean to hammer this point too hard, but when Chrome released click-to-play breaking changes for web audio, they broke alarms/timers on Google search.

So the "you'd catch all these changes if you were testing" excuse honestly kind of rubs me the wrong way, because as far as I can tell Google itself has trouble meeting that standard for even its biggest products.

[lstamour]

> We can't just send deprecation notices to random contact emails (if there's any) on websites. We can't just open a "support request" to L1 customer support of websites telling them their site might not work soon.

What about folks who've registered for either origin trials or Google Search Console? Or Google Analytics?

That said, I'd love it if telemetry APIs were baked into the web, perhaps OpenTelemetry API support? Then website owners could set up their own error reporting OTLP endpoints or services to receive sampled deprecation alerts in a standard way, rather than assuming everybody can read the developer console in an end-user's browser (especially when it's hidden most of the time...)

Bonus points if we can ignore errors caused by extensions, or have extra feedback as to which extensions might be causing problems. Double bonus points if there's a UI so end users can choose whether to share this data or not, or to cache and sync the data so it only gets shared when on wifi or idle, in an extremely compressed way, and to provide a settings screen where you can browse what telemetry or errors are shared from/to websites in your history.

[cxr]

> If you want to support specific browsers

This is a pretty arrogant position. If this is your perspective, please go work on Android team or something with a traditional SDK churn cycle. The Web is special.

[svieira]

I read chromestatus every week or so and the intended landing date for this change caught me off guard.

[Orphis]

But do you use Chrome Canary, Dev or Beta for development purposes? Would you have then noticed the change? Do you have continuous testing on the websites you maintain with those versions?

I presume you're only human, so it's almost expected you will skip over a change as you don't think it's relevant or might even take days off work, in which case, it's easy to forget to read it. ChromeStatus is just one of the many signals you should use to filter issues before they reach customers.

[svieira]

Yes, and I used to use it as my daily driver. But I switched to Firefox a year ago to make sure I wasn't ignoring the minority experience.

Yes, we have CI (700+ machine hours for runs-on-master integration tests). No, we don't have a test that would have caught this (we are an app building platform and some of our features which our users use to deliver features to their users use iframes)