38 ms·

There is no way that 'pointer lock' should be something you can just click and get your pointer hijacked. You could label that button anything or make it any cl

There is no way that 'pointer lock' should be something you can just click and get your pointer hijacked. You could label that button anything or make it any clickable element. Who the hell at web browser developers thought that was a good idea to implement? Why not have a "Do you want to allow this site to take control of your pointer?" prompt, same as when a site first wants to use your microphone or camera?

yyx 6y ago
Maybe it's used for fullscreen games?
- walrus01 6y ago
  I'm sure it is, and works great for that, I just think it needs one more layer of user consent and understanding before it's turned on.
- tyingq 6y ago
  I see it in emulators, like this one: https://www.pcjs.org/software/pcx86/sys/windows/3.10/ https://www.pcjs.org/software/pcx86/sys/windows/3.10/ (click one of the Windows apps once it boots)
alpb 6y ago
I think lots of stuff like RDP extensions, or browser-based gaming (e.g. Stadia) are using it.
kevingadd 6y ago
There are a ton of use cases that demand it, so it was added a long time ago (around the same time as Fullscreen, I think). The current user experience for it (opt-out instead of opt-in) has likewise been around for ages. I think I remember seeing an explicit permission prompt very early on but they got rid of it. "You could label that button anything" sadly applies to a significant number of dangerous things a website can do, pointer lock is not near the top of the list.
cyberdummy 6y ago
I was surprised by this too, now have in firefox about:config dom.pointer-lock.enabled = false
capableweb 6y ago
I get a "$WEBSITE has control of your pointer. Press Esc to take back control" message in Firefox when that happens, and the message is pretty big and in your face. Does other popular browsers not have this message? Solves the problem in an elegant way.
- maddyboo 6y ago
  Interestingly, in Firefox, if I trigger the Protocol Handler permission and then Pointer Lock, the Pointer Lock notification is hidden by the Protocol Handler bar. Seems like this could be abused. Screen recording: https://b-cdn.s3.maddison.io/99Q967Cnvz--2021-03-26_02-58-20_region.mp4 https://b-cdn.s3.maddison.io/99Q967Cnvz--2021-03-26_02-58-20...

yyx 6y ago

Maybe it's used for fullscreen games?

walrus01 6y ago
I'm sure it is, and works great for that, I just think it needs one more layer of user consent and understanding before it's turned on.
tyingq 6y ago
I see it in emulators, like this one: https://www.pcjs.org/software/pcx86/sys/windows/3.10/ https://www.pcjs.org/software/pcx86/sys/windows/3.10/ (click one of the Windows apps once it boots)

alpb 6y ago

I think lots of stuff like RDP extensions, or browser-based gaming (e.g. Stadia) are using it.

kevingadd 6y ago

There are a ton of use cases that demand it, so it was added a long time ago (around the same time as Fullscreen, I think). The current user experience for it (opt-out instead of opt-in) has likewise been around for ages. I think I remember seeing an explicit permission prompt very early on but they got rid of it. "You could label that button anything" sadly applies to a significant number of dangerous things a website can do, pointer lock is not near the top of the list.

cyberdummy 6y ago

I was surprised by this too, now have in firefox about:config dom.pointer-lock.enabled = false

capableweb 6y ago

I get a "$WEBSITE has control of your pointer. Press Esc to take back control" message in Firefox when that happens, and the message is pretty big and in your face. Does other popular browsers not have this message? Solves the problem in an elegant way.

maddyboo 6y ago
Interestingly, in Firefox, if I trigger the Protocol Handler permission and then Pointer Lock, the Pointer Lock notification is hidden by the Protocol Handler bar. Seems like this could be abused. Screen recording: https://b-cdn.s3.maddison.io/99Q967Cnvz--2021-03-26_02-58-20_region.mp4 https://b-cdn.s3.maddison.io/99Q967Cnvz--2021-03-26_02-58-20...