6 ms·

I do wish there was an option to safely disable all connectivity in a browser tab (forever) like with Javascript or camera access. Yes, saving the page, discon

I do wish there was an option to safely disable all connectivity in a browser tab (forever) like with Javascript or camera access. Yes, saving the page, disconnecting your network connection, then deleting the page would work, but it's a real bother.

mholt 5y ago
Yep, I kind of wish browser permissions let you gate access to the network just like they do the camera, mic, location, etc. (Though, network permission would probably need to be enabled by default to not break the Web.)
toomuchtodo 5y ago
Perhaps https://github.com/ray-lothian/Block-Site/ https://github.com/ray-lothian/Block-Site/ could be adapted to your needs.
floatingatoll 5y ago
I do too. Even the web extension APIs don’t seem to comprehend this. It’s super disappointing and it’s holding back extension development and enabling a massive malware problem.
mrfusion 5y ago
Airplane mode?
- fulafel 5y ago
  The page might start a service worker and exfiltrate the data when connectivity returns even after the tab is closed.
  - deleted 5y ago
    [deleted]
  - kortilla 5y ago
    Can any website start service workers that outlive their tabs? That seems like a huge change
    - fulafel 5y ago
      A cursory web search didn't provide information about restrictions that would apply. I remember seeing service workers in browser devtools or task manager without having given explicit permission.
    - deleted 5y ago
      [deleted]
    - ComputerGuru 5y ago
      Yes, but not directly via a service worker (aren't they blocked from network access in general?) - you'd have to trigger the main thread to sync with the service worker, then perform the exfiltration for you. The original way to do this via a synchronous XHR request in visibilitychange/beforeunload/unload handlers gave you a 1-2s window to exfiltrate the data. That's been deprecated in exchange for a more insidious "invisible background connection to the server maintained after closing the tab or navigating away" that doesn't involve any UI delays. (For "a better experience" of course, not for stealth! Never!) It's called the beacon API [0] and it's supported by basically all browsers [1]. This was introduced because, chiefly among others, Google Analytics was stuck between blocking in head to record the page view or moving to the end of the html document and using documentready but with a fairly high risk of user navigating away before all that had a chance to trigger at all or after it triggered but before it could exfiltrate the data. [0]: https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API [1]: https://caniuse.com/?search=beacon%20api https://caniuse.com/?search=beacon%20api
      - Pick-A-Hill2019 5y ago
        Wow - that is just sad to see from Mozilla (sighs, where did all the good guys go?) Excerpt from their KB Navigator.sendBeacon() .... It’s intended to be used for sending analytics data to a web server, and avoids some of the problems with legacy techniques for sending analytics, such as the use of XMLHttpRequest. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon https://developer.mozilla.org/en-US/docs/Web/API/Navigator/s...
dheera 5y ago
Also another nitpick: > View the source code It would be really nice if the source code in the browser (no, not the Github repo; how do I know the web server served the same thing as the Github repo?) were displayed in a human-readable format with proper tabbing, comments if applicable, and not an obfuscated, minified form. In fact if your goal isn't specifically obfuscation, it's not necessary to minify JS in general. Web servers do a good job gzipping stuff.
- ThePadawan 5y ago
  Hm, we could have the best of both worlds if source maps (can already be served to browsers and are supported fine) could be proven authentic. I believe right now, I could use foo.min.js and serve you a cruddy foo.min.map.js to mislead you. If I served you the original sources foo.concat.js and a build script to go from foo.concat.js => foo.min.js instead, we could have both the speed of the minified version and the (proven by the browser) accurate source code and maps!
- ComputerGuru 5y ago
  We’re moving far, far away from the observability and introspection that once made the web a transparent medium. First it was minified JS, then it was minified and obfuscated JS, then it was using a canvas instead of the DOM to prevent even HTML inspection, and now it’s binary executable payloads (WASM) rendering to a WebGL context with zero introspection possible.
  - kenneth 5y ago
    Is there actually a popular site that uses WASM / WebGL the way you mention it?
    - ayewo 5y ago
      If you are willing to accept web sites (or rather web apps) that are popular among designers, then Figma is one notable example. https://www.figma.com/blog/webassembly-cut-figmas-load-time-by-3x/ https://www.figma.com/blog/webassembly-cut-figmas-load-time-...
rhn_mk1 5y ago
uMatrix kind of does this. Once you forbid everything, requests will get filtered out. I'm not sure if this affects service workers though.
- gpvos 5y ago
  Can uMatrix do that only for the current tab?
  - rhn_mk1 5y ago
    Yes, until reload. Permanent settings are always per domain.
avel 5y ago
DevTools -> network -> Change the throttling to "offline"
- 41b696ef1113 5y ago
  Offline is not an option in Firefox, just progressively worse connection options.
  - jacobmischka 5y ago
    It's a bit less convenient, but I think you can accomplish the same using a `*` request blocking rule: https://i.imgur.com/SYgAxuW.png https://i.imgur.com/SYgAxuW.png
    - treszkai 5y ago
      That works, but you need to keep the "Developer tools" frame open. Once it's closed, the blocking is gone. (Try it with an infinity feed.)
  - ajsnigrutin 5y ago
    File -> work offline?
  - TameAntelope 5y ago
    You could also just see that no network requests are sent when you type.
    - ganafagol 5y ago
      And once you see them, you do what? Rollback reality?
      - TameAntelope 5y ago
        I'm confused. Are you suggesting you should test with "real" data first?
dzhiurgis 5y ago
Same for apps. And it's crazy you can't disable phone service on iPhone. Also, if you worried about someone accessing your network then you probably need to isolate your devices from seeing each other. TBH other than pwning my router or misusing my IP address in some way I don't see much problem having my devices on public net. All of them run firewall and are up to date. Most traffic is HTTPS and I'm not sure if you can MITM with just Wifi password lol.
pryce 5y ago
I think the risk model for this sort of thing is still... complicated, even though the site as it stands is safe and does not transmit credentials. After first gaining popularity, the domain could later pass to someone with malicious intent quite easily, eg: 1. Tech people like HN verify the site as credible and approve of it 2. The site gains popularity and goes viral / receives significant use 3. The original author abandons the site because of costs, or simple boredom 4. A malicious actor acquires the domain and begins recording users credentials alongside IP addresses. Conceivably, an enormous amount could be captured before the malicious recording became exposed, and (importantly) most of those whose credentials were compromised would have no straightforward path by which they could be alerted. Other scenarios: site is malicious to begin with but set up to not transmit credentials during its first ~28 days. Mirrors of this site with credential capture added, (hard to claim that's a flaw of this site itself, just a flaw with "this type of site being normalized").

mholt 5y ago

Yep, I kind of wish browser permissions let you gate access to the network just like they do the camera, mic, location, etc. (Though, network permission would probably need to be enabled by default to not break the Web.)

toomuchtodo 5y ago

Perhaps https://github.com/ray-lothian/Block-Site/ https://github.com/ray-lothian/Block-Site/ could be adapted to your needs.

floatingatoll 5y ago

I do too. Even the web extension APIs don’t seem to comprehend this. It’s super disappointing and it’s holding back extension development and enabling a massive malware problem.

mrfusion 5y ago

Airplane mode?

fulafel 5y ago
The page might start a service worker and exfiltrate the data when connectivity returns even after the tab is closed.
- deleted 5y ago
  [deleted]
- kortilla 5y ago
  Can any website start service workers that outlive their tabs? That seems like a huge change
  - fulafel 5y ago
    A cursory web search didn't provide information about restrictions that would apply. I remember seeing service workers in browser devtools or task manager without having given explicit permission.
  - deleted 5y ago
    [deleted]
  - ComputerGuru 5y ago
    Yes, but not directly via a service worker (aren't they blocked from network access in general?) - you'd have to trigger the main thread to sync with the service worker, then perform the exfiltration for you. The original way to do this via a synchronous XHR request in visibilitychange/beforeunload/unload handlers gave you a 1-2s window to exfiltrate the data. That's been deprecated in exchange for a more insidious "invisible background connection to the server maintained after closing the tab or navigating away" that doesn't involve any UI delays. (For "a better experience" of course, not for stealth! Never!) It's called the beacon API [0] and it's supported by basically all browsers [1]. This was introduced because, chiefly among others, Google Analytics was stuck between blocking in head to record the page view or moving to the end of the html document and using documentready but with a fairly high risk of user navigating away before all that had a chance to trigger at all or after it triggered but before it could exfiltrate the data. [0]: https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API [1]: https://caniuse.com/?search=beacon%20api https://caniuse.com/?search=beacon%20api
    - Pick-A-Hill2019 5y ago
      Wow - that is just sad to see from Mozilla (sighs, where did all the good guys go?) Excerpt from their KB Navigator.sendBeacon() .... It’s intended to be used for sending analytics data to a web server, and avoids some of the problems with legacy techniques for sending analytics, such as the use of XMLHttpRequest. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon https://developer.mozilla.org/en-US/docs/Web/API/Navigator/s...

dheera 5y ago

Also another nitpick: > View the source code It would be really nice if the source code in the browser (no, not the Github repo; how do I know the web server served the same thing as the Github repo?) were displayed in a human-readable format with proper tabbing, comments if applicable, and not an obfuscated, minified form. In fact if your goal isn't specifically obfuscation, it's not necessary to minify JS in general. Web servers do a good job gzipping stuff.

ThePadawan 5y ago
Hm, we could have the best of both worlds if source maps (can already be served to browsers and are supported fine) could be proven authentic. I believe right now, I could use foo.min.js and serve you a cruddy foo.min.map.js to mislead you. If I served you the original sources foo.concat.js and a build script to go from foo.concat.js => foo.min.js instead, we could have both the speed of the minified version and the (proven by the browser) accurate source code and maps!
ComputerGuru 5y ago
We’re moving far, far away from the observability and introspection that once made the web a transparent medium. First it was minified JS, then it was minified and obfuscated JS, then it was using a canvas instead of the DOM to prevent even HTML inspection, and now it’s binary executable payloads (WASM) rendering to a WebGL context with zero introspection possible.
- kenneth 5y ago
  Is there actually a popular site that uses WASM / WebGL the way you mention it?
  - ayewo 5y ago
    If you are willing to accept web sites (or rather web apps) that are popular among designers, then Figma is one notable example. https://www.figma.com/blog/webassembly-cut-figmas-load-time-by-3x/ https://www.figma.com/blog/webassembly-cut-figmas-load-time-...

rhn_mk1 5y ago

uMatrix kind of does this. Once you forbid everything, requests will get filtered out. I'm not sure if this affects service workers though.

gpvos 5y ago
Can uMatrix do that only for the current tab?
- rhn_mk1 5y ago
  Yes, until reload. Permanent settings are always per domain.

avel 5y ago

DevTools -> network -> Change the throttling to "offline"

41b696ef1113 5y ago
Offline is not an option in Firefox, just progressively worse connection options.
- jacobmischka 5y ago
  It's a bit less convenient, but I think you can accomplish the same using a `*` request blocking rule: https://i.imgur.com/SYgAxuW.png https://i.imgur.com/SYgAxuW.png
  - treszkai 5y ago
    That works, but you need to keep the "Developer tools" frame open. Once it's closed, the blocking is gone. (Try it with an infinity feed.)
- ajsnigrutin 5y ago
  File -> work offline?
- TameAntelope 5y ago
  You could also just see that no network requests are sent when you type.
  - ganafagol 5y ago
    And once you see them, you do what? Rollback reality?
    - TameAntelope 5y ago
      I'm confused. Are you suggesting you should test with "real" data first?

dzhiurgis 5y ago

Same for apps. And it's crazy you can't disable phone service on iPhone. Also, if you worried about someone accessing your network then you probably need to isolate your devices from seeing each other. TBH other than pwning my router or misusing my IP address in some way I don't see much problem having my devices on public net. All of them run firewall and are up to date. Most traffic is HTTPS and I'm not sure if you can MITM with just Wifi password lol.

pryce 5y ago

I think the risk model for this sort of thing is still... complicated, even though the site as it stands is safe and does not transmit credentials. After first gaining popularity, the domain could later pass to someone with malicious intent quite easily, eg: 1. Tech people like HN verify the site as credible and approve of it 2. The site gains popularity and goes viral / receives significant use 3. The original author abandons the site because of costs, or simple boredom 4. A malicious actor acquires the domain and begins recording users credentials alongside IP addresses. Conceivably, an enormous amount could be captured before the malicious recording became exposed, and (importantly) most of those whose credentials were compromised would have no straightforward path by which they could be alerted. Other scenarios: site is malicious to begin with but set up to not transmit credentials during its first ~28 days. Mirrors of this site with credential capture added, (hard to claim that's a flaw of this site itself, just a flaw with "this type of site being normalized").