HN user

whylo

439 karma
Posts1
Comments49
View on HN

employ a security policy of reporting any security concerns via email

You don't have a security.txt, https://infisical.com/docs/security/overview doesn't mention it and it's not on your FAQ, so I don't blame ianpurton for not finding it. You have a 'Report a vulnerability' issue template on GitHub (https://github.com/Infisical/infisical/security/advisories/n...) but then your readme points to a security policy which says to email: https://github.com/Infisical/infisical/security/policy

For a prototype, sure, accessibility might not be top of the list. But everything about the way this is advertised makes it sound like a production-ready product ('it's a stable, rock-solid product') and your FAQs are actively misleading people by implying that it produces accessible output.

It's also orders of magnitude harder to make an inaccessible product accessible than it is to build it in an accessible way in the first place

From the FAQ:

Svija pages are fully-readable by screen readers, and you can add special text for each page in Svija Admin, visible only to screen readers.

I tested the accessibility with a keyboard and screen reader. With a keyboard, when you press the tab key, focus should usually go left-to-right, top-to-bottom. On this page the first link you tab to is 'Request Access'. From there the tab key goes backwards, to FAQ, Examples etc, then up to Vibe, Blazing Speed etc. Then it jumps down to the footer, does the same reverse order, then jumps all over the place.

The buttons in the main content to trigger animations aren't focussable at all, so aren't accessible without a mouse or touchscreen.

I explored the page with NVDA (a free screen reader) and found a number of sections and links where what was read out was different to what was shown in screen. It looks like you have a hidden HTML DOM that's exposed to screen readers and I assume this is out of sync somehow with what's on screen? I also got a bunch of links that didn't appear on the screen at all.

Exploring with the NVDA elements list (Insert+F7) shows a lot of junk in the Links list - links with text like 'id1584143858', 'UCmfF3YOMVyRcd0m-WpMUZ2g' etc. The Buttons list doesn't show the animation trigger buttons (because they're not marked up as buttons) and the Landmarks list is empty, meaning no easy way to jump to nav, header, footer etc.

Browser zoom is completely broken. The page looks the same at 500% zoom as it does at 100%.

Accessibility is important, and it's really disheartening when new page-building platforms like this pop up that clearly haven't been audited by an accessibility specialist or run past a disabled person who uses assisitve technology, especially when they specifically give the impression they're accessible as the FAQ answer does

Peanut butter is available now, but not that popular

I might be an outlier but my family eats peanut butter all the time, and you wouldn't have any trouble finding it even in small local shops. Peanut butter and j(elly|am) sandwiches are less popular but I maintain that they're America's greatest export.

DVLA systems seem to be an absolute mess, and many public-facing systems are still using the DirectGov styling (which was replaced by GOV.UK in 2012). A lot of their services are completely unavailable overnight from 7pm-7am. So if you sell a vehicle on the last day of the month and go to register the sale after 7pm, bad luck - you're getting charged another month of vehicle tax.

PaaS ran on AWS anyway, so it wouldn't be Amazon (I would guess? Unless they think they can charge more/upsell by departments procuring directly from them). Perhaps Google or MS were upset that by PaaS running atop AWS, AWS became the de facto 'official' cloud service for government?

The computer would randomly wake up from hibernate and drain the battery till it was dead.

I had exactly the same thing on my XPS 15. I'd take it out of my bag, it'd be warm and the battery would be dead. Plus one day it suddenly decided it didn't have a TPM module (didn't even show up in BIOS) so BitLocker stopped working, and of late the CPU is constantly throtling and fans running at full blast because it's overheating even with next to no load (I've checked the fans for dust).

Hopefully this starts supporting accessibility tools before it gets too much traction and people start shipping inaccessible apps. The WebAssembley output demos on the homepage just render to a <canvas> and are completely inaccessible with any of the usual tools (screen reader, keyboard-only, voice dictation etc) but there's a GitHub issue (https://github.com/slint-ui/slint/issues/32) so fingers crossed.

Yeah, I keep coming back to Concrete5 (now Concrete CMS). We don't often do CMS-based projects but when we do I test out all the big names and Concrete wins out every time. It had a block-based page editor years before Wordpress introduced Gutenberg and theming has always been pretty straightforward.

Do you ensure that the apps that are generated are compatible with accessibility tools on the target platforms? I tried the Split & Tip example app (https://www.bravostudio.app/made-with-bravo/split-tip) on Android with TalkBack enabled and labels for input fields aren't read out when the input gets focus (eg when I focus on the 'Tip %' field TalkBack reads 'e.g. 15, edit box' rather than 'Tip percentage, e.g. 15, edit box')

I'm more of a nut ;) but I think anyone selling a service like this, or building any kind of front-end framework, has even more of a responsibility than individual site owners to make their stuff accessible, because any issues are multiplied out across all of your customers, and ultimately affect any of their customers with accessibility needs.

Depending on the juristiction your customers operate in, any accessibility issues could also expose them to legal liability for non-compliance with various laws (eg ADA in the US, the Web Accessibility Directive in the EU for public sector bodies)

I'd really encourage you to download a screen reader such as NVDA (or use VoiceOver if you're on a Mac), make use of the Lighthouse accessibility audit in Chrome dev tools, and try using your site with just a keyboard to test for accessibility. At the moment the biggest problem is you've used divs with click handlers rather than <a> tags for your product links, which can't be focussed with the keyboard, so anybody using a keyboard to navigate (such as someone with reduced mobility or using a screen reader) won't be able to use the site.

A bit of feedback on accessibility. I tried the 'Hello' template and added a form component (the 'Let's get in touch!' one). It misuses placeholders as labels and the field text is in an extremely light grey against a white background - not just the placeholder text, when I'm typing in them too. It's nigh-on impossible to read, with a contrast ratio of 1.33:1 (WCAG requires 4.5:1).

Do you run accessibility tests on the templates and on the tool itself?

Interesting snippet from the terms of service:

For Services provided on Mars, or in transit to Mars via Starship or other spacecraft, the parties recognize Mars as a free planet and that no Earth-based government has authority or sovereignty over Martian activities. Accordingly, Disputes will be settled through self-governing principles, established in good faith, at the time of Martian settlement.