[whatwg] [WF2] Objection to autocomplete Attribute

[Lachlan Hunt]

Ian Hickson wrote:
> On Mon, 21 Mar 2005, Matthew Raymond wrote:
> 
>>Actually, now that I think about it, why do we need to have a spec 
>>saying that it's not depreciated or that it should be non-trivial to 
>>deactivate if the banks are going to blackmail UAs to support it?
> 
> Because to be useful, specs have to be realistic.

Yes, they should be realistic in documenting what markup should and 
should not be supported, but the spec is crossing the line by dictating 
what options should and should not be trivially accessible in a user 
agent.  I recommend at least moving that statement to the note at the 
end of the section, perhaps changing it to something like this:

# A UA may allow the user to disable support for this attribute. Support
# for the attribute *should* be enabled by default, as there are
# significant security implications for the user if support for this
# attribute is disabled.

(Note: the *should* in the second sentence above has been changed from 
*must*, for the same reason that specs must not dictate user-hostile 
behaviour, and to allow for any user agent vendor to correctly decide to 
disable support by default (as *there are valid reasons* to do so) and 
not violate this specification as a result.)

And the note below could become:

# Note: In practice, this attribute is required by many banking
# institutions, who insist that UAs with auto-complete features
# implement it before supporting them on their Web sites. For this
# reason, it has been implemented by most major Web browsers for many
# years and it is advised that the ability to disable support should not
# be trivially accessible.

Although I still recommend leaving out the statement about disabling 
support and strongly object to the inclusion of autocomplete, it seems 
I've already been overruled for those request, so I'm willing to compromise.

However, I would like to point out that user agents that don't allow the 
user to override autocomplete, are in direct violation of the User Agent 
Accessibility Guidelines 1.0, Guideline 5 [1]:

| Guideline 5. Ensure user control of user interface behavior
| ...
| Ensure that the user can control the behavior of viewports and user
| interface controls, including those that may be manipulated by the
| author (e.g., through scripts).

Although the remainder of the guideline mainly discusses the viewport, a 
form field is still a user interface control [2], and thus I believe 
this guideline applies.

In a previous post, Ian Hickson also wrote:
> Deprecating the feature would indicate that there is a chance the feature 
> will be dropped in a future version, which there isn't.

Why isn't there a chance it will be removed?  I accept it being included 
as a way to document what UAs should support, but not as an attribute 
that authors should ever use; and I hope, if this spec is ever accepted 
by the W3C or other standards organistion, that it is removed before it 
becomes anything official.

Those of us that often contribute to peer support forums, newsgroups, 
mailing lists, etc. for authoring HTML, have enough difficulty 
convincing some authors (newbies) to not use other user hostile 
extensions, such as disabling IE's image toolbar, Smart Tags (with the 
proprietary meta element values, though smart tags were never 
implemented in IE anyway), Google's AutoLink, controlling window sizes, 
status bars, toolbars, disabling context menus, etc.  Do you realise how 
difficult it is going to become, and thus how much more innaccessible 
the web will become, if such authors find that this attribute is 
approved by a standards organistion?

> It would also make any site using the feature non-conformant,

So what?  Any site using it now is non-conformant, what difference does 
it make?

> which is pointless: the sites are going to use these features regardless, why
> make people have to violate the spec to do so.

Then why is the size attribute deprecated now?  Sites are going to use 
it regardless of the ability to specify such details using stylesheets, 
just like people continue to use <font>, <b>, etc, why make people have 
to violate the spec to do so?

The point is: "Documents must not use deprecated features. User agents 
should support deprecated features."  That statement, from appendix C, 
applies to both the size and autocomplete attributes equally, so please 
deprecate autocomplete.

[1] http://www.w3.org/TR/UAAG10/guidelines.html#gl-user-control-ui
[2] http://www.w3.org/TR/UAAG10/glossary.html#def-ui-control

-- 
Lachlan Hunt
http://lachy.id.au/
http://GetFirefox.com/     Rediscover the Web
http://GetThunderbird.com/ Reclaim your Inbox