4 ms·
This seems melodramatic for something as trivial as an audio request.
by jimmaswell 7y ago
This seems melodramatic for something as trivial as an audio request.
- yifanl 7y agoArbitrary code execution isnt really that trivial.
- jimmaswell 7y agoArbitrary javascript execution is generally meaningless. Very rarely you'll get a zero-day or something, or maybe a site will use too much battery when focused.
- JetSpiegel 7y agoBut if that page is Stack Overflow, with millions of views, you are collectively wasting tons of power. Granted, you don't pay those bills.
- jjeaff 7y agoReally? Malicious JavaScript can steal anything you can see and do anything you do. It can steal your passwords, bank account information, or transfer money out of your bank account. It just depends on what kind of page is serving up the arbitrary JavaScript.
- mikeash 7y agoIt’s incredibly disrespectful. Nobody wants some random ad listening to their microphone. That they’re trying it anyway indicates that they’re hoping to get some people with browsers that don’t block it, or trick some people into saying yes. It’s not harmful, as long as you’re not one of the people who gets tricked. But it does indicate that they want to do you harm, and try to. That they failed doesn’t make it all better.
- jimmaswell 7y agoIt's probably just a mistake and not actually trying to collect anything.
- mikeash 7y agoYou think it’s hitting the JavaScript microphone API by mistake? How?
- ladberg 7y agoIt's Google's fingerprinting for tracking you across the web. It won't actually listen to or play anything, it just opens it up to see if it's there.
- mikeash 7y agoWe have no way of knowing that when a permission alert comes up. The only reason we’d ever allow it is if we were tricked or exploited.
- deleted 7y ago[deleted]
- SilasX 7y agoWait, it was listening in on the microphone too? Doesn’t that break wiretapping laws?
- mort96 7y agoDid you click the link..? It's fingerprinting, not just trying to legitimately play audio.
- luckylion 7y agoIt's not just audio requests btw. Google regularly serves ads that automatically redirect users to scam sites. A client I work with gets hit with that about every six months. The ads are targeting only mobile users which makes it even harder to debug. There's nothing a publisher can do to prevent this but disabling Google Adsense completely. There is no support from Google. After a few days, a week maybe, Google disables the malicious ad (or they see that the credit card didn't work) and it stops.