The good folks at 37signals are once again up in arms about Google Web Accelerator (GWA). David Heinemeier Hansson (DHH), in particular, writes in a recent post to Signal vs. Noise that “[GWA] was evil enough the first time around, but this time it’s downright scary.”
The problem, it seems, is that GWA automatically, silently, and unblockably follows hypertext links to web pages that are linked to by the pages you visit. It does this in order to cache those pages so that if you visit them later, it will have cached copies ready in an instant, thus “accelerating” your web surfing. But some web developers use hypertext links to trigger potentially unsafe actions, such as deleting records in a database, and when GWA automatically follows such links, it triggers the actions.
Oops.
Let’s do the time warp again…
Now, if this story sounds familiar, that’s because half a year ago, the exact same thing happened. GWA was unveiled to the public. People started using it. And some of those people started losing data from their accounts with popular web applications, such as 37signal’s own Backpack. 37signals publicized the problem in their blog and DHH even called for a recall on GWA.
And then the community responses came in. For the most part, the responses could be divided into two camps, based on who was blamed for the problem. The first camp blamed the web designers who used links to trigger unsafe actions (in violation of applicable standards), and the second camp blamed Google for unleashing GWA upon a web where standards aren’t always followed.
Both viewpoints had some merit, but I was in the first camp and thus argued for following the standards and against unsafe linking practices:
- Google Web Accelerator offers web developers an important opportunity
- Taking the unsafe GETs out of Rails
What surprised me was that so many people in the second camp argued in defense of unsafe linking practices, which I had thought indefensible. I didn’t have any problem with arguments against Google’s unleashing GWA on an imperfect web, but arguing for the web’s imperfections seemed like an odd way of making the case. The supportive arguments boiled down to the following:
- Lots of web sites use action-triggering links, so the practice is de facto acceptable.
- The existing palette of user-interface options is too limited for today’s web applications; thus, designers are justified in breaking the rules.
- The standards don’t actually prohibit the practice (they say “SHOULD NOT,” not “MUST NOT”); thus, the practice is allowable.
None of the arguments seem to withstand scrutiny. The first argument breaks down like so: That lots of web sites do it only means that those sites get away with it, not that the practice is acceptable. Further, as GWA demonstrates, those sites may not get away with the practice much longer.
The second argument breaks down when one examines the uses of unsafe linking practices. Most of them could be replaced by safe practices through modest UI refactoring. Given that safe alternatives exist, the unsafe practices are not justified by virtue of being the only realistic option.
The third argument breaks down when one actually reads the relevant standards. Then it becomes clear that one should not use links to trigger potentially unsafe actions. The wiggle room created by the use of “SHOULD NOT” instead of “MUST NOT” does not admit the large problems caused by unsafe linking.
Finally, even if there were some justification for unsafe linking, the practice would still be a bad idea: its costs and risks outweigh its benefits. Why hold back the potential of efficient caching architectures for the web? Why risk data loss for your users? It’s not worth it.
Back to the Future
So where are we now? Given how little justification there is for unsafe linking practices, one would hope that we would have abandoned them by now. But, as the recent cries about the second coming of GWA suggest, the web-development community is not yet ready to give up those sexy, action-triggering links.
It’s not that the means aren’t available. Rails, for example, has plenty of support for sane and safe practices for triggering actions. Rather, the problem is cultural. Too many influential people, especially in the Rails community, are unrepentant users of – and, dare I say it, apologists for – action-triggering links. Until this changes, I expect many new web developers to pick up dangerous habits from the very people they respect most.
Fortunately, many other respect-worthy people are pointing toward a better way:
- Sam Ruby: “I’m on the other side of this debate. While this appears to be a purely philosophical concern, in reality this stuff matters.”
- Bill de hÓra: “The GWA is back and following GET links again… The technology itself is interesting insofar as we are going to see more and more highly automated robots enter the web over the next few years…. Even more interesting is the kind of outrage holding forth in places like Signal v Noise….”
- Joe Gregorio : “And now we begin the next chapter in which Pooh discovers that five months after the first time Google turned on GWA that standards still matter.”
I hope that this time around the web-development community answers the wake-up call. It’s time to abandon action-triggering links.