2 ms·
As a user, when I visit a site, I never invited some third party to run their code on my computer, and I certainly don't want some third party making requests t
by kerkeslager 7y ago
As a user, when I visit a site, I never invited some third party to run their code on my computer, and I certainly don't want some third party making requests to the server on my behalf. So screw websites that depend on this bug.
- olalonde 7y agoJust to clarify, CSRF is when a website you visit makes requests on your behalf to a third party (which you have visited/logged into). The third party is also a "victim" of the attack. > I never invited some third party to run their code on my computer This can be achieved by disabling JavaScript (e.g. NoScript extension). As far as I know, there's no extension that can entirely prevent a website from loading resources from other another domain name. If there is, I imagine it would cause a lot of websites to lack styling, images/videos not loading, etc.
- mehhh 7y agouMatrix can be used to block 3rd party resources from loading (like Facebook and Google, usually blockable with no ill effects).
- kerkeslager 7y agoYes, I knew this, and I said the wrong thing anyway, and I am sorry. I didn't think through what I was saying clearly. My intent was more of an "Old Man Yells At Cloud" thing; I was just kvetching because the internet isn't as user-focused as it could be. Calling a bunch of resources from all over the place is a user-hostile behavior, and I'm generally unsympathetic when sites break because browsers narrow the range of user-hostile behaviors they support.