New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 643355 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 629964
Owner:
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug



Sign in to add a comment

Alert box does not have a close button on OS X version of Chrome

Reported by tja...@gmail.com, Sep 1 2016

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36

Steps to reproduce the problem:
1. Open the JavaScript console and type alert('hello') 

What is the expected behavior?
When the alert box appears, there should be a way to dismiss it, without having to click the "OK" button. For example, in the Windows of Chrome, there is an 'x' button in the corner of the pop-up, which appears to have exactly the same effect as clicking OK.

What went wrong?
In the OS X version of Chrome, there is no way to dismiss an alert without clicking "OK". There is no 'x' button in the pop-up. Additionally it is not possible to close the browser tab that spawned the alert box, because the computer bleeps instead - but that might be a separate issue (see comment below).

Did this work before? No 

Chrome version: 52.0.2743.116  Channel: stable
OS Version: OS X 10.11.6
Flash Version: 

It's important to allow users to dismiss an alert box without having to click "OK" because malicious websites often use alert boxes to intimidate and confuse users, and when users who are not technically-savvy are required to click OK to dismiss the alert, it has the unfortunate side-effect of training them that regularly saying "OK" to pop-ups they don't understand is a routine and expected part of using a computer. 

This goes against what the security and UX communities have been trying to achieve for years, particularly making pop-up dialogs in general easier to understand, and getting users out of the habit of mindlessly clicking OK all the time. Hence, this is a security-related UI issue.

For a technically advanced user, it's not an issue because they can just click OK knowing it won't harm their computer. But for a non-technically advanced user, who has taken the trouble to comprehend and apply basic security advice ("don't click OK on pop-ups you don't understand or trust!"), it is deeply undermining to find that, when faced with a obviously malicious, spammy or misleading alert box, Chrome actually prevents them from applying that advice!

This is related to, but distinct from,  Issue 456 . This issue could be fixed without changing the modality of the alert box, just by adding a close button like the Windows version has. It wouldn't matter if, technically, the close button did exactly the same thing as the OK button.

A separate but related question is why is it not possible to close the browser tab that spawned the alert, killing both at the same time?  Issue 456 #c67 has a convincing explanation for why the modality of the alert box cannot be changed, but it's not clear why this would prevent tab closure in order to simultaneously kill both the tab and the alert.
 

Comment 1 Deleted

Comment 2 by tja...@gmail.com, Sep 1 2016

Here's an example. And no, it's not "OK".
alert.png
165 KB View Download

Comment 3 by tja...@gmail.com, Sep 1 2016

Here's the Windows version for comparison.

I forgot to mention in the bug report that on OS X, pressing Escape doesn't work either (as a substitute for clicking OK).
alert.png
9.1 KB View Download
Cc: tapted@chromium.org ellyjo...@chromium.org
Components: -UI UI>Browser>Core
Labels: Hotlist-CocoaBrowser
Status: Untriaged (was: Unconfirmed)
+some views folks because they are familiar with dialogs.  Will macviews change the way we show these alert dialogs?
Owner: shrike@chromium.org
Status: Assigned (was: Untriaged)
#4: not in the near future.

For reference, Safari calls the button "Close" instead of "Ok" and has no X icon.

shrike, what do you think we should do here?

Comment 6 by tja...@gmail.com, Sep 6 2016

Just a note that even though Safari has no "x' icon within the alert pop-up itself, there are multiple other ways to close the alert box in Safari without having to click its button:
 * Press Esc
 * Click the little 'x' to close the tab, which makes the entire web page tab plus its alert box disappear at the same time (my favourite method, if the alert is at all suspicious or intrusive)
 * Press Command-W, which does the same thing

All of these work in Safari; none work in Chrome.

Regarding the last two options, see the comment at the end of my bug report.
There are two issues mentioned in this bug: the inability to close the dialog without clicking an OK button, and being able to close a tab that has a modal dialog. The bug title refers to the former issue.  If closing a tab that has a modal dialog is a concern, that should be filed in a separate bug.

Long term, avi@'s working on changing how these dialogs work in the browser, which will solve this problem.

Short term, we could consider renaming the OK button to Close. I'm not sure how I feel about making Esc dismiss the dialog as well as Return.

#7: renaming the OK button to Close sounds good to me. I'll put a CL up.
Cc: -ellyjo...@chromium.org f...@chromium.org shrike@chromium.org
Owner: ellyjo...@chromium.org
+cc felt

Actually, I'm going to ask security enamel, since this is sort of a security bug (?), and get their opinion on what we should do with this button.

felt@, what do you think we should do with this button text? Should we leave it as "Ok", change it to "Close" (this is what Safari does), change it to something else?

Changing it is not difficult: just modifications to JavaScriptAppModalDialogCocoa::JavaScriptAppModalDialogCocoa() and JavaScriptAppModalDialogViews::GetDialogButtonLabel().

Comment 10 by f...@chromium.org, Sep 12 2016

Cc: a...@chromium.org emilyschechter@chromium.org
+cc emilyschechter, avi

This will be a nice thing to have changed. I think we should either change it to "Close" or add an "x". I won't pretend to understand the nuances of Mac design philosophy so adding in product and UI people in case they have an opinion.
Cc: pinkerton@chromium.org
I agree with changing it to close (though I am neither a product or UI person).
Cc: rpop@chromium.org
+rpop for desktop -- do you know if there should be X's on mac dialogs?
Modal dialogs on the Mac (of which this is one) do not have X close buttons.

Comment 14 by a...@chromium.org, Sep 13 2016

Modal dialogs are NSAlerts. Changing "OK" to "Close" is wrong and is a web-facing change.

Clicking the [X] is _identical_ to clicking OK.

This bug reads to me as WAI; what are people agreeing to?

Comment 15 by a...@chromium.org, Sep 13 2016

FYI, Safari doesn't have this problem because they've switched to custom views for alerts with dismissal-on-closure. I'm working on changing Chrome to do that too.
I just spoke to avi@ - he is not suggesting in c#14 that we should add an X button to the Mac dialog. He was pointing out that in Views there is a close button and an OK button, and that there is no difference between clicking the close button and clicking the OK button.

He is skeptical of the value of changing the button name from OK to Close, and says that this is a web-facing change and needs to be run by UX.

Comment 17 by f...@chromium.org, Sep 13 2016

I agree it should be run by UX

My argument in favor of changing "OK" to "Close" (or adding an "X") is that the behavior of "OK" is unclear. Are you accepting whatever is in the dialog...? What does "OK" mean?

Comment 18 by a...@chromium.org, Sep 13 2016

Cc: ainslie@chromium.org
My argument against is that in a dialog, "OK" means acceptance of what it says. If we put verbs in the buttons, users are going to expect that action.

For example, take the dialog:

> Save your work? [Cancel] [Save]

then clicking the verb button ("save") _does_ something.

My fear is that if we have a dialog like

> Website says blah blah [Close]

that the user may be even more scared, because they are being forced into taking an action with no way out. At least "OK" is "meh, ok" whereas "Close" is "oh no, I'm being forced into closing this".

Also, it's not clear what "Close" would even mean as a button action. _We_ know that "close" would mean closing only of the alert box, but given that verbs in alert boxes always mean taking action on an item _outside_ the alert box (e.g. the save alert box, the onbeforeunload alert box), we'd be implying that something else would be closing, and again, causing user distress over being forced to close something.

So I'm definitely a no here. But we need to bring UX in.
Cc: hwi@chromium.org
+hwi@ is likely the right point person for this since she has the best view of the Harmony interaction design right now.
The confusing UI here caused https://crbug.com/644961, also.

I think fixing this has to be part of avi@'s JS modal rework. It's pretty clear that changing the text of the button isn't going to make sense by itself, and we need to redesign the idea of an alert dialog to make it very clear what the actual options are.
Cc: ellyjo...@chromium.org
Owner: a...@chromium.org
Sending this one over to avi@ for incorporation in their modal rework.

Comment 22 by a...@chromium.org, Sep 21 2016

Mergedinto: 629964
Status: Duplicate (was: Assigned)
I'm going to dup this into my work.

Sign in to add a comment