4 ms·
Cool hack. May be it is time for browsers to disable iframes by default and ask the end user if they want to run them via the standard browser confirmation mec
by EastSmith 8y ago
Cool hack.
May be it is time for browsers to disable iframes by default and ask the end user if they want to run them via the standard browser confirmation mechanisms site by site.
- nerdponx 8y agoThere are so many individual pieces of HTML and JS that I wish I could do this with. Mostly web APIs. On a URL-by-URL basis.
- gcb0 8y agoyou all should install uMatrix webextension and stop just "wishing". the future is now :)
- nerdponx 8y agoDoes uMatrix let me block specific JS web APIs and HTML elements like iframes? It never could in the past.
- clear_dg 8y agouMatrix can block frames and js requests on a domain/sub-domain level. afaik, it can't block at url level, if that's what you meant. That said, uMatrix, from what I remember, uses the webRequest api which does work from urls. So if you know JS, you can always create an extension and add your own filter.
- nerdponx 8y agoTo be clear, on the JS side I'm talking about providing whitelist-only access to things like the ambient light level, which is provided through a standardized browser API.
- gcb0 8y agoyes. I block iframes globally and the web never been better. it will show a checkered pattern with a link to open the frame in another window. so you don't even have to whitelist sites or anything. if you care about the frame, like for a embedded video, just open it on its own tab with a single click
- notriddle 8y agoDid they fix the problem where disabling javascript didn't enable the `<noscript>` tag?
- JustThrowMeAway 8y agoSites can already send an 'X-Frame-Options: deny' header to prevent being framed.
- lol768 8y agoOr use CSPv2's frame-ancestors.
- gsnedders 8y agoAnd then you have a confirmation on almost every page, and then you run into dialog box fatigue where users will blindly click through them, and you've gained nothing.