Coffee Space – Coffee Space

HTML Feature Missing

Idea

I was chatting with a friend about completely removing JS from the web entirely and coming up with the various conditions that would or wouldn’t work. One of the ideas was to build a lightweight browser that supported HTML and CSS features, but did not allow even a single line of JS to run. This is what we come up with:

Social media would survive. You would have to say goodbye to infinite scrolling, but for the most part the experience would be recognizable. As long as you’re doing authentication via cookies over TLS, it should be a smooth experience. There is for example mbasic that I personally use to access Facebook - it breaks all the time but actually much less than letting their crappy scripts run in your browser 24/7.
Banking websites should be okay for the same reason. I suspect the use of JS in banking software has actually caused more security issues than it has ever resolved. For example, there have been multiple times a banking site have been compromised by having a CDN changed under them.
Chat applications can work, but of course it currently requires manual reloading. That automatic loading of new content simply won’t work currently.
Many niche cases, like running web torrents, etc. Given how many niche cases there are, this would be a small minority of the web. Generally, most of these could probably be re-worked into a desktop application or run server side.

Feature

So the feature I am thinking of is a “automatic re-loader” capability. It wouldn’t be intelligent or based on some event, but instead time-based with several configuration options. I think the best candidate for this would be an <iframe>, it already has several nice sandboxing aspects and is well supported. In the grand-scheme of things, programs like Dillo or Lynx could be upgraded to support such a feature without too many changes to their codebase.

Essentially I think the HTML would look something like this:

0001 <iframe src="test.html" reload="auto">
0002 </iframe>

So the introduction would be:

Attribute	Value	Description
reload	none	The type of reload to be performed. The option `none`
	auto	is default and indicates that no reload should be
	timer	performed. `auto` allows the browser to select one
	delta	that it believes is most suitable. `timer` attempts to
		keep the reloads on a schedule, despite how low the
		networking or loading may take. If the networking or
		loading is too slow, it simply reloads when the
		previous load is finished. `delta` waits for the page
		to be fully loaded, then waits the specified time and
		then performs a reload. This ensures there is a
		minimal delta per reload time.

This is not without potential security issues:

DDoS external resources – Setting the timeout to 1 millisecond and then pointing it to some external resource of a popular server would potentially DDoS the external server. Therefore this should be an opt-in option.
DDoS own server – If your server is under a heavy traffic load, you may want to tell the reloader to slow down.
Recursive reloading – Potentially you could be asked to load an iframe, that loads an iframe, which… You get the point. If each one of these also has a reload timer, it could really bring your browsing experience down to a crawl.

Considering these possibilities and for the purpose of maintaining backwards compatibility, a web page that offers the ability to reload can throw a comment in the top of the webpage like so:

0003 <!DOCTYPE html>
0004 <!-- @timeout="50" -->
0005 <html>

Note: It would be nicer to have it in the “DOCTYPE” declaration, but I’m unsure what issues this would cause for backwards compatibility.

Only web pages that offer the timeout comment before the <html> tag (or first HTML element) will be allowed to perform the reload. A web server can thereby set this value to anything that is suitable during page generation. The values would be like so:

Attribute	Value	Description
timeout	milliseconds	The timeout of the element in milliseconds, where 0
		means timeout is disabled. The default is 0, so this
		value must be set to a positive integer to enable
		automatic reloads. The browser itself may want to set
		a sane minimum value.

Conclusion

I think such a web feature would be worth considering. It literally takes basic HTML and makes it interactive via a server, removing the need for quite a bit of JS currently used.

Some potential applications of this feature:

IRC in the browser using only HTML (or other chat features)
Auto-updating email interface using only HTTP
New feeds or status bars for websites
Some basic types of games
Checking for document changes