11 ms·

Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

163 points by EpicEng 8y ago

pmoriarty 8y ago
Yet another reason to use an extension like uMatrix to disallow javascript by default, and only allow the absolute minimum that sites you trust need to function.
- comma-ampersand 8y ago
  I don't believe this requires javascript to work.
- ryanmccullagh 8y ago
  Not allowing JavaScript turns into a chore when you find out that websites break in non obvious ways. I do not want to manually enable/disable JavaScript when the browser is a means to an end for me.
  - pmoriarty 8y ago
    I consider dealing with the consequences of hacked-in accounts or a hacked-in laptop to be the bigger chore.
  - narag 8y ago
    I've used a few solutions: privoxy, noscript, uMatrix and now uBlock origin. The later was a little confusing when I started using it, but now I get it and love it. A very good thing is that most websites use external javascript to implement the most annoying "features" like asking for consent, tracking, autoplay and diverse pop-up junk. Also it includes the "cosmetic filtering" that allows me to block html elements by name, very useful for subscription requests. Only when I browse in other people's computer, I'm reminded how screwed the web really is.
  - TheChaplain 8y ago
    It's only a chore at the start? Once I give a site permissions I make sure to save them, so on next visit it just works. The impact on amount of traffic and load speed is considerable IMO and well worth the pain at start.
  - jdc 8y ago
    I'm surprised there's no presets to subscribe (like AdBlock) for uMatrix.
  - ori_b 8y ago
    Yet another reason to do it -- so that bug reports about websites not working without Javascript are taken seriously, and fixed.
    - lsh 8y ago
      ha! a typical response is "we thank you for taking the time to contact us and value your opinion. our website is best used with Google Chrome and javascript enabled. Do you have any other problem I can stonewall you about?" I've registered my fair share of complaints about javascript problems, nobody does anything ever. Except once when I complained a bug triggered epilepsy, that got their attention real quick.
    - hrktb 8y ago
      On a previous job, we had a “be a one day support desk” mandatory training, but I took only months after I entered. One of the funny discoveries was supported platforms and setup bugs are filtered very fast and just flagged as such. The only monitoring was the up or down trends for that kind of complaints. It includes people on IE6, those using their fridge browser to open the site, or apps that showed the site under some broken in app browser. So people blocking javascript are just a drop in that global number, and if the number is mostly constant it just won’t matter what happens in it and reports won’t even get to the devs.
    - SquareWheel 8y ago
      Or they'll continue to be ignored, because they're not bugs with the website.
      - ori_b 8y ago
        It's a bug with the website as long as users start looking for alternatives. That's why there needs to be a lot of advocacy.
  - zeveb 8y ago
    That's why I'd like to suggest a three-phase solution: the first phase is advocating for using JavaScript for progressive enhancement only; the second phase is a JavaScript blocker; the third phase is using three-phase power to deliver mild electrical shocks to web developers who abuse JavaScript. Seriously, though, you're right — and every time I'm forced to enable a new JavaScript source in uMatrix, I'm angered at the site which requires it. In some cases, I just don't even bother using such sites — why buy something from someone who respects neither me nor the Web enough to provide a usable site without tons of JavaScript?
- jimbo1qaz 8y ago
  This dialog seems to operates off HTTP authentication, so disabling Javascript will probably not prevent it from appearing.
  - fl0wenol 8y ago
    Not probably, but definitely. HTTP auth modal dialogs are a pre-Javascript feature from the earliest Netscape versions.
- tgsovlerkhgsel 8y ago
  If you're a power user, this kind of "can't leave me" sites are a rare and minor annoyance - you know that they're sandboxed and can't do anything bad unless you allow it, and you'll have it cleaned up WAY faster than the time you'd have spent managing JS exceptions and debugging sites that broke in non-obvious ways. And if you're setting a computer up for a non-poweruser, you can't deploy uMatrix because you really can't expect the user to do said debugging.
danShumway 8y ago
Pure curiosity, what's the advantage of this? What am I missing? The user can't leave the malicious domain, but they also can't interact with the page, because the dialog is in the way. And even if they could, are they really more likely to trust the site after it's made a bunch of random popups appear in a row? Is it just malice? What does the malicious site gain?
- Wowfunhappy 8y ago
  I assume the idea is that on the page visible behind the dialog are instructions to call some number, or open the download, or approve the extension the site wants to install.
  - zeta0134 8y ago
    Having spent a couple of years working for tech support for a large retail chain, I can confirm that this happens much more often than you might think. Non-technical users are floored the browser locking up, especially if the site starts to do something alarming like play an audio file telling them their computer is infected. If they were lucky and brought it to me in that state, I'd teach them about their task manager and how to close the browser, and warn them about visiting suspicious sites. But if they actually called the number, and in some cases, allowed the scammers to remote into the machine... all bets were off. There was no telling what we would find.
    - walrus01 8y ago
      Some pretty good examples of different scammer scripts, of a wide variety, from a guy who has made a hobby out of trolling them: https://www.youtube.com/channel/UCm22FAXZMw1BaWeFszZxUKw/videos https://www.youtube.com/channel/UCm22FAXZMw1BaWeFszZxUKw/vid...
      - chris_wot 8y ago
        You should see The Hoax Hotel. Much more amusing!
microcolonel 8y ago
I say it every time that people say "Firefox is great now!". Just look at the Bugzilla, and tell me that among the thousands of reports (many of which have gone untriaged for around a decade!) there aren't at least a handful of serious issues like this. One, among many, of the reasons I use Chromium is that I see reports taken absolutely seriously, especially any report with any potential security outcome. Even seemingly minor issues or feature requests I've filed with Chromium get thoughtful and prompt responses. I wish Mozilla the best, but the quality of Firefox is low in a way that I notice every time I use it; I'd appreciate it if they go back to basics and actually try to address at least the known issues with the software.
- zapzupnz 8y ago
  I'd like Firefox to stop focusing on revamping the user interface every five minutes, that's all. Might be a start.
  - nikbackm 8y ago
    When was the last time they revamped the UI? Honestly cannot remember.
    - jgh 8y ago
      they changed it this year didn't they? Weren't people making jokes that now firefox is square and chrome is round?
      - nikbackm 8y ago
        Right, had forgotten about that. Was thinking about more substantive changes like Australis though, the look of tab corners seem pretty trivial.
    - dzhiurgis 8y ago
      It's still horrible. #1 reason I don't like FF.
    - 8y ago
pcunite 8y ago
I have really been enjoying FireFox 62+ ... so fast. To hear about a long-standing bug is disappointing.
- dao- 8y ago
  Pretty much any complex piece of software has known and unknown long-standing bugs.
rubatuga 8y ago
I thought this was a solved problem in most web browsers. Just show a nonmodal dialog for popups like in safari and chrome.
- pragmatick 8y ago
  The solution is simple and there are other problems with having a modal dialog (I can't think of many dialogs that should be modal when they only affect one tab). For example if you want to lookup a password for the dialog you have to open a new window.
- jasode 8y ago
  >Just show a nonmodal dialog for popups like [...] chrome. But in some cases, Chrome has modal dialog popups that Firefox does not. I made a previous comment about this and you can test that behavior on a safe site like regex101.com: https://news.ycombinator.com/item?id=17046268 https://news.ycombinator.com/item?id=17046268
c8g 8y ago
> Edge: The delay between authentication modals in Edge is large enough to allow the user to close the tab or the browser. it seems it can be fixed in 11 minutes. mozilla just don't give a f&ck.
Uhrheber 8y ago
Why does nobody target the root cause? The possibility to show popups and popovers in browsers should be removed completely. There are little to no legit uses for them. Even reputable websites use them only to nag and annoy their users. And don't get me started about Javascript. This is a plague, that causes more problems than it solves.
- oliwarner 8y ago
  This is an absurd overreaction. Popovers are CSS. Just a positioned element. And both up-and-overs are "legitimately" used as modals in apps.
  - ashelmire 8y ago
    I think these are using alert rather than modals. Alert is pretty awful.
  - black_puppydog 8y ago
    And even in those cases 99% of the time they're a PITA. Modals are as bad in web UI as they are in desktop UI.
    - oliwarner 8y ago
      But this isn't a discussion about whether or not modals are good idea. The OP was arguing —without any idea what the mechanics are, I'm sure, because that's how we decide how technology works these days— that CSS should not be allowed to layer and position one thing over another. Modals have a place, but like everything, they get abused by people with no idea about how things should work. But that isn't a good standalone argument for going back to pre-1997 CSS.
- Frondo 8y ago
  What gets me, and makes me sad, is how javascript-enabled browsers (and really the magic happened with IE and its XMLHttpRequest) are clearly addressing a need the vast majority of the computing world has: running applications simply (without installing, because that's been made complicated) and with a reasonable expectation of security (sandboxed). For all the time browsers have been providing this, no one's ever come even close to a good alternative. That's why the JS-powered browsing experience will never go away, there's nothing like it for how people actually use computers now.
gregknicholson 8y ago
> this issue has gone unfixed, for unknown reasons The reason is just that no-one has thought it important enough to fix, and/or no-one has been able to get sufficient agreement on what the correct fix is. Let's not pretend there's a mystery.
- throwaway12iii 8y ago
  And yet issues that affect advertising revenue on Youtube get fixed same day.
  - PedroBatista 8y ago
    Something like 80-90% of their revenue comes from Google. Their higher-ups can spin it all day, but they know damn well their jobs depend on a good relationship with Google.
    - gsnedders 8y ago
      Or even indirectly, the YouTube team might choose to instead send them an IE6-era experience of YouTube instead of the current one to avoid the bug, which might push users away from Firefox.
- pengod 8y ago
  In my experience with Firefox devs, if it's not important enough to fix immediately, bugs will simply be closed and ignored. I've come across other bugs that exist for 10 years (not security related) which were closed again each time they were brought up every few years.
- gambler 8y ago
  Clearly, in the eyes of browser developers basic UI is far less important than 3d rendering, web assembly, progressive API and other features used by .000001% of all websites. AFAIK, there are still no usable built-in date pickers or upload controls.
  - 8y ago
danillonunes 8y ago
The bigger problem is that a authentication dialog is a window modal, which makes the entire browser inoperative. If it wasn’t for this, you could simply close the tab with the malicious site. This broader issue is reported on the bug #123913, which is 17 years old. The bug is old enough to drive.
- nolok 8y ago
  > The bug is old enough to drive. Where I'm from it can't drive, but it's been old enough to drink for a while now !
  - dagurp 8y ago
    Denmark?
    - nolok 8y ago
      France. We have no law about age of consumption but we have a law about a minimal age of buying; it has almost no sanction though and the worst you risk in spending a few hours or a night in a "drunken" cell at the police station. On the other hand we do have strong sanction for selling to someone under the legal age. About the age of buying it used to be 16 years old but the law was changed to put it at 18 for liquors and hard alcohol back in 2009, since then most maps you can find on the internet about drinking age often put us at 18 but in reality it's still 16 for wine/beer/cider/... The change was to fight whisky/vodka/rhum/... binge drinking by high schoolers. (driving age is 18, or 16 is you're accompanied by an adult and passed a specific kind of driving permit)
- SilasX 8y ago
  Not to defend Mozilla's inability to prioritize, but ... Isn't that a common issue across browsers? I know on iOS, I get burned by shady sites on Safari that do redirects and pop up a browser-level modal that somehow stops me from closing the tab until I turn off Javascript and restart the browser.
  - 8y ago
giancarlostoro 8y ago
This has been something that irritates me. If I want to copy a password for a site in another tab. Oh look I can't. This isn't just a stupid bug, it's terrible UX. I have to open either another Firefox window, or another browser entirely (better safe than sorry!) in order to find that password for a site that didn't intend to hijack focus for the login screen.
codedokode 8y ago
One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. Another problem is that browsers are tol complicated. Building Firefox from source requires you to have a powerful machine with multicore CPU and lot of memory and comilation would take a lot of time. This could stop people from contributing fixes. [1] https://www.chromestatus.com/feature/5642959835889664 https://www.chromestatus.com/feature/5642959835889664
- Santosh83 8y ago
  > Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. What possible justification is there for this? Looks like this can become an ideal way to 'force' unsuspecting users to interact with a malicious site...
  - franga2000 8y ago
    > What possible justification is there for this? If I had to guess, I'd say games. Browser games just refuse to die. I thought they'd die with Java applets, then with Flash, but they just keep coming back...
    - crysin 8y ago
      Why the language of refuse? Are you inferring there is inherently something bad about games on the web?
      - franga2000 8y ago
        No, that's just my opinion. One of the main reasons wouldn't like to see browser games come back is that they are usually basically 100% tied to a server. They're not like standard games, where even if the servers go down, you still have the files and can either keep playing offline or even hack together a server implementation. Once the server goes down, that game is gone[1]. Not to mention, that if an industry were to arise around web-based games, most would probably either be the "free but pay-to-win and with ads" kind, or on Netflix-style subscription platforms where you don't actually own anything and you're just paying for the access. [1] - not saying it's impossible to preserve it, just that it's not preserved by default, like a locally-installed game is
SilasX 8y ago
Ironically enough, when I go to that site, I immediately (feel like I) lose control of the browser because it pops up the "do you want to allow notifications on this site" which stops me from scrolling down on the keyboard.
- e40 8y ago
  With uBlock Origin and uMatrix it looks extremely clean to me.
  - SilasX 8y ago
    I wasn't complaining about the bloat (already have uBlock), I think I just need to turn off requests for notifications. (Or even better, have intermediate option where I can be aware that it wants to send me notifications, but where it doesn't take the focus off and interfere with my plugins like Vimium.)
gambler 8y ago
Why are modal popups still a thing at all? Yes, I know all the excuses. They are not good enough. Also, websites should not be able to block browser UI unless I explicitly allow them to. In any way.
octosphere 8y ago
for(a=0;a<9001;a++){ prompt('',''); }
- ArrayList 8y ago
  I almost forgot prompt() was ever a thing!
cronix 8y ago
Or how about sites like the one where this article actually appeared (zdnet) making it very difficult (some are impossible) to use the back button? I clicked the article on HN, read it on zdn, and had to hit "back" about 10 times to get back to HN, which was the "previous page visited."

163 points by EpicEng 8y ago

Yet another reason to use an extension like uMatrix to disallow javascript by default, and only allow the absolute minimum that sites you trust need to function.

comma-ampersand 8y ago
I don't believe this requires javascript to work.
ryanmccullagh 8y ago
Not allowing JavaScript turns into a chore when you find out that websites break in non obvious ways. I do not want to manually enable/disable JavaScript when the browser is a means to an end for me.
- pmoriarty 8y ago
  I consider dealing with the consequences of hacked-in accounts or a hacked-in laptop to be the bigger chore.
- narag 8y ago
  I've used a few solutions: privoxy, noscript, uMatrix and now uBlock origin. The later was a little confusing when I started using it, but now I get it and love it. A very good thing is that most websites use external javascript to implement the most annoying "features" like asking for consent, tracking, autoplay and diverse pop-up junk. Also it includes the "cosmetic filtering" that allows me to block html elements by name, very useful for subscription requests. Only when I browse in other people's computer, I'm reminded how screwed the web really is.
- TheChaplain 8y ago
  It's only a chore at the start? Once I give a site permissions I make sure to save them, so on next visit it just works. The impact on amount of traffic and load speed is considerable IMO and well worth the pain at start.
- jdc 8y ago
  I'm surprised there's no presets to subscribe (like AdBlock) for uMatrix.
- ori_b 8y ago
  Yet another reason to do it -- so that bug reports about websites not working without Javascript are taken seriously, and fixed.
  - lsh 8y ago
    ha! a typical response is "we thank you for taking the time to contact us and value your opinion. our website is best used with Google Chrome and javascript enabled. Do you have any other problem I can stonewall you about?" I've registered my fair share of complaints about javascript problems, nobody does anything ever. Except once when I complained a bug triggered epilepsy, that got their attention real quick.
  - hrktb 8y ago
    On a previous job, we had a “be a one day support desk” mandatory training, but I took only months after I entered. One of the funny discoveries was supported platforms and setup bugs are filtered very fast and just flagged as such. The only monitoring was the up or down trends for that kind of complaints. It includes people on IE6, those using their fridge browser to open the site, or apps that showed the site under some broken in app browser. So people blocking javascript are just a drop in that global number, and if the number is mostly constant it just won’t matter what happens in it and reports won’t even get to the devs.
  - SquareWheel 8y ago
    Or they'll continue to be ignored, because they're not bugs with the website.
    - ori_b 8y ago
      It's a bug with the website as long as users start looking for alternatives. That's why there needs to be a lot of advocacy.
- zeveb 8y ago
  That's why I'd like to suggest a three-phase solution: the first phase is advocating for using JavaScript for progressive enhancement only; the second phase is a JavaScript blocker; the third phase is using three-phase power to deliver mild electrical shocks to web developers who abuse JavaScript. Seriously, though, you're right — and every time I'm forced to enable a new JavaScript source in uMatrix, I'm angered at the site which requires it. In some cases, I just don't even bother using such sites — why buy something from someone who respects neither me nor the Web enough to provide a usable site without tons of JavaScript?
jimbo1qaz 8y ago
This dialog seems to operates off HTTP authentication, so disabling Javascript will probably not prevent it from appearing.
- fl0wenol 8y ago
  Not probably, but definitely. HTTP auth modal dialogs are a pre-Javascript feature from the earliest Netscape versions.
tgsovlerkhgsel 8y ago
If you're a power user, this kind of "can't leave me" sites are a rare and minor annoyance - you know that they're sandboxed and can't do anything bad unless you allow it, and you'll have it cleaned up WAY faster than the time you'd have spent managing JS exceptions and debugging sites that broke in non-obvious ways. And if you're setting a computer up for a non-poweruser, you can't deploy uMatrix because you really can't expect the user to do said debugging.

danShumway 8y ago

Pure curiosity, what's the advantage of this? What am I missing? The user can't leave the malicious domain, but they also can't interact with the page, because the dialog is in the way. And even if they could, are they really more likely to trust the site after it's made a bunch of random popups appear in a row? Is it just malice? What does the malicious site gain?

Wowfunhappy 8y ago
I assume the idea is that on the page visible behind the dialog are instructions to call some number, or open the download, or approve the extension the site wants to install.
- zeta0134 8y ago
  Having spent a couple of years working for tech support for a large retail chain, I can confirm that this happens much more often than you might think. Non-technical users are floored the browser locking up, especially if the site starts to do something alarming like play an audio file telling them their computer is infected. If they were lucky and brought it to me in that state, I'd teach them about their task manager and how to close the browser, and warn them about visiting suspicious sites. But if they actually called the number, and in some cases, allowed the scammers to remote into the machine... all bets were off. There was no telling what we would find.
  - walrus01 8y ago
    Some pretty good examples of different scammer scripts, of a wide variety, from a guy who has made a hobby out of trolling them: https://www.youtube.com/channel/UCm22FAXZMw1BaWeFszZxUKw/videos https://www.youtube.com/channel/UCm22FAXZMw1BaWeFszZxUKw/vid...
    - chris_wot 8y ago
      You should see The Hoax Hotel. Much more amusing!

microcolonel 8y ago

I say it every time that people say "Firefox is great now!". Just look at the Bugzilla, and tell me that among the thousands of reports (many of which have gone untriaged for around a decade!) there aren't at least a handful of serious issues like this. One, among many, of the reasons I use Chromium is that I see reports taken absolutely seriously, especially any report with any potential security outcome. Even seemingly minor issues or feature requests I've filed with Chromium get thoughtful and prompt responses. I wish Mozilla the best, but the quality of Firefox is low in a way that I notice every time I use it; I'd appreciate it if they go back to basics and actually try to address at least the known issues with the software.

zapzupnz 8y ago
I'd like Firefox to stop focusing on revamping the user interface every five minutes, that's all. Might be a start.
- nikbackm 8y ago
  When was the last time they revamped the UI? Honestly cannot remember.
  - jgh 8y ago
    they changed it this year didn't they? Weren't people making jokes that now firefox is square and chrome is round?
    - nikbackm 8y ago
      Right, had forgotten about that. Was thinking about more substantive changes like Australis though, the look of tab corners seem pretty trivial.
  - dzhiurgis 8y ago
    It's still horrible. #1 reason I don't like FF.
  - 8y ago

pcunite 8y ago

I have really been enjoying FireFox 62+ ... so fast. To hear about a long-standing bug is disappointing.

dao- 8y ago
Pretty much any complex piece of software has known and unknown long-standing bugs.

rubatuga 8y ago

I thought this was a solved problem in most web browsers. Just show a nonmodal dialog for popups like in safari and chrome.

pragmatick 8y ago
The solution is simple and there are other problems with having a modal dialog (I can't think of many dialogs that should be modal when they only affect one tab). For example if you want to lookup a password for the dialog you have to open a new window.
jasode 8y ago
>Just show a nonmodal dialog for popups like [...] chrome. But in some cases, Chrome has modal dialog popups that Firefox does not. I made a previous comment about this and you can test that behavior on a safe site like regex101.com: https://news.ycombinator.com/item?id=17046268 https://news.ycombinator.com/item?id=17046268

c8g 8y ago

> Edge: The delay between authentication modals in Edge is large enough to allow the user to close the tab or the browser. it seems it can be fixed in 11 minutes. mozilla just don't give a f&ck.

Uhrheber 8y ago

Why does nobody target the root cause? The possibility to show popups and popovers in browsers should be removed completely. There are little to no legit uses for them. Even reputable websites use them only to nag and annoy their users. And don't get me started about Javascript. This is a plague, that causes more problems than it solves.

oliwarner 8y ago
This is an absurd overreaction. Popovers are CSS. Just a positioned element. And both up-and-overs are "legitimately" used as modals in apps.
- ashelmire 8y ago
  I think these are using alert rather than modals. Alert is pretty awful.
- black_puppydog 8y ago
  And even in those cases 99% of the time they're a PITA. Modals are as bad in web UI as they are in desktop UI.
  - oliwarner 8y ago
    But this isn't a discussion about whether or not modals are good idea. The OP was arguing —without any idea what the mechanics are, I'm sure, because that's how we decide how technology works these days— that CSS should not be allowed to layer and position one thing over another. Modals have a place, but like everything, they get abused by people with no idea about how things should work. But that isn't a good standalone argument for going back to pre-1997 CSS.
Frondo 8y ago
What gets me, and makes me sad, is how javascript-enabled browsers (and really the magic happened with IE and its XMLHttpRequest) are clearly addressing a need the vast majority of the computing world has: running applications simply (without installing, because that's been made complicated) and with a reasonable expectation of security (sandboxed). For all the time browsers have been providing this, no one's ever come even close to a good alternative. That's why the JS-powered browsing experience will never go away, there's nothing like it for how people actually use computers now.

gregknicholson 8y ago

> this issue has gone unfixed, for unknown reasons The reason is just that no-one has thought it important enough to fix, and/or no-one has been able to get sufficient agreement on what the correct fix is. Let's not pretend there's a mystery.

throwaway12iii 8y ago
And yet issues that affect advertising revenue on Youtube get fixed same day.
- PedroBatista 8y ago
  Something like 80-90% of their revenue comes from Google. Their higher-ups can spin it all day, but they know damn well their jobs depend on a good relationship with Google.
  - gsnedders 8y ago
    Or even indirectly, the YouTube team might choose to instead send them an IE6-era experience of YouTube instead of the current one to avoid the bug, which might push users away from Firefox.
pengod 8y ago
In my experience with Firefox devs, if it's not important enough to fix immediately, bugs will simply be closed and ignored. I've come across other bugs that exist for 10 years (not security related) which were closed again each time they were brought up every few years.
gambler 8y ago
Clearly, in the eyes of browser developers basic UI is far less important than 3d rendering, web assembly, progressive API and other features used by .000001% of all websites. AFAIK, there are still no usable built-in date pickers or upload controls.
- 8y ago

danillonunes 8y ago

The bigger problem is that a authentication dialog is a window modal, which makes the entire browser inoperative. If it wasn’t for this, you could simply close the tab with the malicious site. This broader issue is reported on the bug #123913, which is 17 years old. The bug is old enough to drive.

nolok 8y ago
> The bug is old enough to drive. Where I'm from it can't drive, but it's been old enough to drink for a while now !
- dagurp 8y ago
  Denmark?
  - nolok 8y ago
    France. We have no law about age of consumption but we have a law about a minimal age of buying; it has almost no sanction though and the worst you risk in spending a few hours or a night in a "drunken" cell at the police station. On the other hand we do have strong sanction for selling to someone under the legal age. About the age of buying it used to be 16 years old but the law was changed to put it at 18 for liquors and hard alcohol back in 2009, since then most maps you can find on the internet about drinking age often put us at 18 but in reality it's still 16 for wine/beer/cider/... The change was to fight whisky/vodka/rhum/... binge drinking by high schoolers. (driving age is 18, or 16 is you're accompanied by an adult and passed a specific kind of driving permit)
SilasX 8y ago
Not to defend Mozilla's inability to prioritize, but ... Isn't that a common issue across browsers? I know on iOS, I get burned by shady sites on Safari that do redirects and pop up a browser-level modal that somehow stops me from closing the tab until I turn off Javascript and restart the browser.
- 8y ago

giancarlostoro 8y ago

This has been something that irritates me. If I want to copy a password for a site in another tab. Oh look I can't. This isn't just a stupid bug, it's terrible UX. I have to open either another Firefox window, or another browser entirely (better safe than sorry!) in order to find that password for a site that didn't intend to hijack focus for the login screen.

codedokode 8y ago

One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. Another problem is that browsers are tol complicated. Building Firefox from source requires you to have a powerful machine with multicore CPU and lot of memory and comilation would take a lot of time. This could stop people from contributing fixes. [1] https://www.chromestatus.com/feature/5642959835889664 https://www.chromestatus.com/feature/5642959835889664

Santosh83 8y ago
> Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. What possible justification is there for this? Looks like this can become an ideal way to 'force' unsuspecting users to interact with a malicious site...
- franga2000 8y ago
  > What possible justification is there for this? If I had to guess, I'd say games. Browser games just refuse to die. I thought they'd die with Java applets, then with Flash, but they just keep coming back...
  - crysin 8y ago
    Why the language of refuse? Are you inferring there is inherently something bad about games on the web?
    - franga2000 8y ago
      No, that's just my opinion. One of the main reasons wouldn't like to see browser games come back is that they are usually basically 100% tied to a server. They're not like standard games, where even if the servers go down, you still have the files and can either keep playing offline or even hack together a server implementation. Once the server goes down, that game is gone[1]. Not to mention, that if an industry were to arise around web-based games, most would probably either be the "free but pay-to-win and with ads" kind, or on Netflix-style subscription platforms where you don't actually own anything and you're just paying for the access. [1] - not saying it's impossible to preserve it, just that it's not preserved by default, like a locally-installed game is

SilasX 8y ago

Ironically enough, when I go to that site, I immediately (feel like I) lose control of the browser because it pops up the "do you want to allow notifications on this site" which stops me from scrolling down on the keyboard.

e40 8y ago
With uBlock Origin and uMatrix it looks extremely clean to me.
- SilasX 8y ago
  I wasn't complaining about the bloat (already have uBlock), I think I just need to turn off requests for notifications. (Or even better, have intermediate option where I can be aware that it wants to send me notifications, but where it doesn't take the focus off and interfere with my plugins like Vimium.)

gambler 8y ago

Why are modal popups still a thing at all? Yes, I know all the excuses. They are not good enough. Also, websites should not be able to block browser UI unless I explicitly allow them to. In any way.

octosphere 8y ago

for(a=0;a<9001;a++){ prompt('',''); }

ArrayList 8y ago
I almost forgot prompt() was ever a thing!

cronix 8y ago

Or how about sites like the one where this article actually appeared (zdnet) making it very difficult (some are impossible) to use the back button? I clicked the article on HN, read it on zdn, and had to hit "back" about 10 times to get back to HN, which was the "previous page visited."