4 ms·

It's not "the browsers" it's primarly the culture of including "whatever" on the pages one maintains. It's so easy as it typically doesn't affect negatively tho

by acqq 9y ago

It's not "the browsers" it's primarly the culture of including "whatever" on the pages one maintains. It's so easy as it typically doesn't affect negatively those who decide to do so. And it's typically not a decision of one person.

michrassena 9y ago
I was giving this matter some thought early today after getting some stupid malware popup on my phone (where the phone vibrates, says it has lots of viruses, etc) while using Chrome. It wasn't even on any kind of dodgy site, but most likely it was part of a banner rotation for an ad network. There has to be a way for website creators to sandbox content which comes from third parties. I think we have to accept that all of these ad networks and third-party scripts aren't going away, so until everyone uses adblocking, what can be done in the meantime? It's problematic that including content from elsewhere in your page (like in an iframe) would grant it "first class" behavior with equivalent privileges to one's page. I know it's opening a can of worms, but why not implement a way to show untrusted content? On the other side of things, I'm using a relatively recent version Chrome. Why is it vulnerable to this dumb sort of popup alert? Why can't I escape from it easily? The back button doesn't work. The UI hangs so I can't close the tab. If I close and re-open my browser it just re-opens my tabs.
- phkahler 9y ago
  Several parts of your comment resonate with me: >> There has to be a way for website creators to sandbox content which comes from third parties. The whole 3rd party thing came about because advertisers needed to establish both ad-distribution and trust (they rightly don't want to pay for ads unless they're actually shown etc...). >> It's problematic that including content from elsewhere in your page (like in an iframe) would grant it "first class" behavior with equivalent privileges to one's page. I agree, this one is on the browser devs and the standard creators. Safety by default is the way to go but then people have nifty ideas that would not be possible with limitations. >> I know it's opening a can of worms, but why not implement a way to show untrusted content? That's exactly what the browser is supposed to be in the first place. >> Why can't I escape from it easily? The back button doesn't work. Because browser devs decided there was some reason the content should be able to alter or override the design of the viewer. I can think of no legitimate (to the user) use case for this. The list of stuff like this is long and ridiculous. They keep doubling down on it too. First we had cookies, but that wasn't enough so now there's a whole client-side database...
  - michrassena 9y ago
    I guess what I find frustrating is that it's the same class of problem as Captain Crunch's whistle, in-band control. But, I think we're getting to the point where it has to be sandboxes all the way down (running things in sandboxes, inside of VMs, with memory protection, etc). But it's still not enough. This class of problem must be extremely difficult to solve. How do you run Turing-complete code which might be hostile? All these layers upon layers sophisticated tools, and to what end. To create a merger of TV and magazine advertising. But one could always turn the page or change the channel.
    - pdkl95 9y ago
      > How do you run Turing-complete code which might be hostile? That's the key problem that (almost) nobody wants to talk about. We've been trying to solve the decision problem for a long time, and we already know that even relatively simple problems are provably undecidable[1]. Any real program will be much more complex[2]. An unknown program could generate any output it wants and we cannot know that without running it. The only solution is to remove output methods. If a program can only e.g. draw to a framebuffer without the ability to trigger future network activity, the worst it can do is waste CPU & RAM. Allowing literally any interface to generate network activity (even indirectly) and people will find ways to tunnel data over that interface. The original design for the web was (probably) safe. It didn't require anonymous Turing complete code, and provided quite a bit of functionality with declarative markup. It even allowed simple (but still useful) server-side applications with 3270-style forms (again, no code needed). This was wonderfully useful, reasonably safe, and most importantly it was understandable by both humans and machines. Today's web requires trusting a new set of undecidable software on each page load. We're supposed to trust 3rd parties even though trust is not transitive. We're supposed to accept the risk of running 3rd party software even though risk is transitive. Without some sort of miraculous total reversal where browsers revert back to pre-javascript days, this is going to end badly. [1] https://www.scottaaronson.com/blog/?p=2725 https://www.scottaaronson.com/blog/?p=2725 [2] If your program uses >7918 Turing machine states, [1] proves that it's behavior cannot be analyzed by ZF set theory.
      - 9y ago
- roywiggins 9y ago
  There's some limited ways to sandbox with iframes. https://www.w3schools.com/tags/att_iframe_sandbox.asp https://www.w3schools.com/tags/att_iframe_sandbox.asp
  - michrassena 9y ago
    This is something I was hoping would be possible in the future, but didn't realize an implementation was already in place. I'm surprised I've never heard of it. There's one problem though. Here's how it should be implemented, in my opinion. <iframe src="this_iframe_is_sandboxed.htm"> <iframe src="this_iframe_is_not.htm" nosandbox> I disagree with making security opt-in.
ptaffs 9y ago
Agreeing with you. Customer service sites are prime targets for solutions where JavaScript is used to enable training, screen sharing, user tracking and advertising, and the up-side is so compelling, especially to non-technical customer service operations managers "those who decide to do so", that they can't conceive of how this little widget can scrape the whole screen, or worse, be maliciously tipped to steal or inject information. The site owners are at fault, but also the browsers should make it easier to disable active content. We can presume that most users aren't discerning, but I'd switch to both plain text e-mail and plain-text browsing, if possible, switching to bloated sites when i can't find an alternative, and like the other comment here, using Lowes instead of Home Depot because their site is less awful. I'll be sharing the link to No Boundaries page next time i'm talking with someone who wants to add a tracking feature to a page.

by acqq 9y ago

michrassena 9y ago

I was giving this matter some thought early today after getting some stupid malware popup on my phone (where the phone vibrates, says it has lots of viruses, etc) while using Chrome. It wasn't even on any kind of dodgy site, but most likely it was part of a banner rotation for an ad network. There has to be a way for website creators to sandbox content which comes from third parties. I think we have to accept that all of these ad networks and third-party scripts aren't going away, so until everyone uses adblocking, what can be done in the meantime? It's problematic that including content from elsewhere in your page (like in an iframe) would grant it "first class" behavior with equivalent privileges to one's page. I know it's opening a can of worms, but why not implement a way to show untrusted content? On the other side of things, I'm using a relatively recent version Chrome. Why is it vulnerable to this dumb sort of popup alert? Why can't I escape from it easily? The back button doesn't work. The UI hangs so I can't close the tab. If I close and re-open my browser it just re-opens my tabs.

phkahler 9y ago
Several parts of your comment resonate with me: >> There has to be a way for website creators to sandbox content which comes from third parties. The whole 3rd party thing came about because advertisers needed to establish both ad-distribution and trust (they rightly don't want to pay for ads unless they're actually shown etc...). >> It's problematic that including content from elsewhere in your page (like in an iframe) would grant it "first class" behavior with equivalent privileges to one's page. I agree, this one is on the browser devs and the standard creators. Safety by default is the way to go but then people have nifty ideas that would not be possible with limitations. >> I know it's opening a can of worms, but why not implement a way to show untrusted content? That's exactly what the browser is supposed to be in the first place. >> Why can't I escape from it easily? The back button doesn't work. Because browser devs decided there was some reason the content should be able to alter or override the design of the viewer. I can think of no legitimate (to the user) use case for this. The list of stuff like this is long and ridiculous. They keep doubling down on it too. First we had cookies, but that wasn't enough so now there's a whole client-side database...
- michrassena 9y ago
  I guess what I find frustrating is that it's the same class of problem as Captain Crunch's whistle, in-band control. But, I think we're getting to the point where it has to be sandboxes all the way down (running things in sandboxes, inside of VMs, with memory protection, etc). But it's still not enough. This class of problem must be extremely difficult to solve. How do you run Turing-complete code which might be hostile? All these layers upon layers sophisticated tools, and to what end. To create a merger of TV and magazine advertising. But one could always turn the page or change the channel.
  - pdkl95 9y ago
    > How do you run Turing-complete code which might be hostile? That's the key problem that (almost) nobody wants to talk about. We've been trying to solve the decision problem for a long time, and we already know that even relatively simple problems are provably undecidable[1]. Any real program will be much more complex[2]. An unknown program could generate any output it wants and we cannot know that without running it. The only solution is to remove output methods. If a program can only e.g. draw to a framebuffer without the ability to trigger future network activity, the worst it can do is waste CPU & RAM. Allowing literally any interface to generate network activity (even indirectly) and people will find ways to tunnel data over that interface. The original design for the web was (probably) safe. It didn't require anonymous Turing complete code, and provided quite a bit of functionality with declarative markup. It even allowed simple (but still useful) server-side applications with 3270-style forms (again, no code needed). This was wonderfully useful, reasonably safe, and most importantly it was understandable by both humans and machines. Today's web requires trusting a new set of undecidable software on each page load. We're supposed to trust 3rd parties even though trust is not transitive. We're supposed to accept the risk of running 3rd party software even though risk is transitive. Without some sort of miraculous total reversal where browsers revert back to pre-javascript days, this is going to end badly. [1] https://www.scottaaronson.com/blog/?p=2725 https://www.scottaaronson.com/blog/?p=2725 [2] If your program uses >7918 Turing machine states, [1] proves that it's behavior cannot be analyzed by ZF set theory.
    - 9y ago
roywiggins 9y ago
There's some limited ways to sandbox with iframes. https://www.w3schools.com/tags/att_iframe_sandbox.asp https://www.w3schools.com/tags/att_iframe_sandbox.asp
- michrassena 9y ago
  This is something I was hoping would be possible in the future, but didn't realize an implementation was already in place. I'm surprised I've never heard of it. There's one problem though. Here's how it should be implemented, in my opinion. <iframe src="this_iframe_is_sandboxed.htm"> <iframe src="this_iframe_is_not.htm" nosandbox> I disagree with making security opt-in.

ptaffs 9y ago

Agreeing with you. Customer service sites are prime targets for solutions where JavaScript is used to enable training, screen sharing, user tracking and advertising, and the up-side is so compelling, especially to non-technical customer service operations managers "those who decide to do so", that they can't conceive of how this little widget can scrape the whole screen, or worse, be maliciously tipped to steal or inject information. The site owners are at fault, but also the browsers should make it easier to disable active content. We can presume that most users aren't discerning, but I'd switch to both plain text e-mail and plain-text browsing, if possible, switching to bloated sites when i can't find an alternative, and like the other comment here, using Lowes instead of Home Depot because their site is less awful. I'll be sharing the link to No Boundaries page next time i'm talking with someone who wants to add a tracking feature to a page.