3 ms·

This explains why visiting twitter.com has been horribly broken for months. Literally every time I try to visit twitter.com in Safari, it would just load a blan

This explains why visiting twitter.com has been horribly broken for months. Literally every time I try to visit twitter.com in Safari, it would just load a blank page and do nothing, and I'd have to manually reload before it would come back to life. Though trying right now it's working. So either they changed something, or upgrading to Safari 12 fixed this issue (or turning off legacy extensions did, which was a side-effect of upgrading to Safari 12, though I wouldn't expect Ghostery or the DuckDuckGo extension to prevent twitter.com from reloading).

X-Istence 8y ago
Upgrading to Safari 12 fixed it for me too. Not sure why it was broken on Safari 11.
gcb0 8y ago
Sad that people today think that not flashing for a brief instant some text on a redirect page trumps usability on people that have browsers that might not follow the redirect correctly. Had they put a "<a href=twitter.com/ok>Twitter.com</a>" instead of a blank page, they (and their users) wouldn't have to worry about buggy browsers.
justacomme555 8y ago
The article describes that certain privacy extensions break the page from loading. It was probably ghostery. Honestly though the blank page fix seems horrible... especially when you consider twitter has worked very hard for the “above the fold” load times, at one point rendering it server side. I also wonder if the attacker just pops a new window ( after getting the user to click anywhere) and load the twitter page into it, if they can still time the request the same way.
- justacomme555 8y ago
  I feel one better fix is to just add a small random wait from the time </html> is served and the TCP socket is actually closed. I donnt think? this should impact loads of the page when it is rendered in an html context.
  - yorwba 8y ago
    The delay should not be simply random, it would need to be carefully chosen to make the load time distribution independent of the user loading the page. Otherwise an attacker could just average multiple requests to get rid of the randomness.
    - justacomme555 8y ago
      Youre right... the delay would basically have to be chosen dynamically to enforce a universal page load time for all html documents on twitter.com Still feels nicer than forcing a roundtrip
- eridius 8y ago
  The article says certain extensions block the referrer, thus producing the manual link to click. I don't believe Safari Extensions can muck with the referrer that way, in terms of affecting resource loads I think it's limited to allow/deny. And besides, Twitter never showed me a manual link, it was just a completely blank page.
realusername 8y ago
Same on Android, twitter.com works half of the time on my phone, the other half I have a blank page with only the top rendered. I don't know what they are doing exactly but it clearly does not work well.

X-Istence 8y ago

Upgrading to Safari 12 fixed it for me too. Not sure why it was broken on Safari 11.

gcb0 8y ago

Sad that people today think that not flashing for a brief instant some text on a redirect page trumps usability on people that have browsers that might not follow the redirect correctly. Had they put a "<a href=twitter.com/ok>Twitter.com</a>" instead of a blank page, they (and their users) wouldn't have to worry about buggy browsers.

justacomme555 8y ago

The article describes that certain privacy extensions break the page from loading. It was probably ghostery. Honestly though the blank page fix seems horrible... especially when you consider twitter has worked very hard for the “above the fold” load times, at one point rendering it server side. I also wonder if the attacker just pops a new window ( after getting the user to click anywhere) and load the twitter page into it, if they can still time the request the same way.

justacomme555 8y ago
I feel one better fix is to just add a small random wait from the time </html> is served and the TCP socket is actually closed. I donnt think? this should impact loads of the page when it is rendered in an html context.
- yorwba 8y ago
  The delay should not be simply random, it would need to be carefully chosen to make the load time distribution independent of the user loading the page. Otherwise an attacker could just average multiple requests to get rid of the randomness.
  - justacomme555 8y ago
    Youre right... the delay would basically have to be chosen dynamically to enforce a universal page load time for all html documents on twitter.com Still feels nicer than forcing a roundtrip
eridius 8y ago
The article says certain extensions block the referrer, thus producing the manual link to click. I don't believe Safari Extensions can muck with the referrer that way, in terms of affecting resource loads I think it's limited to allow/deny. And besides, Twitter never showed me a manual link, it was just a completely blank page.

realusername 8y ago

Same on Android, twitter.com works half of the time on my phone, the other half I have a blank page with only the top rendered. I don't know what they are doing exactly but it clearly does not work well.