13 ms·
Chromium: Permit blocking of view-source: with URLBlocklist
- crakenzak 5y agoWhat are the implications of this? Can’t you just curl/wget the html?
- magicalist 5y agoChrome uses a `view-source` scheme to trigger showing the source of a web page. This change allows Chrome Enterprise administrators to add `view-source:*` to their blocklist so Chrome instances governed by an enterprise policy with that enabled (like at a school or company) wouldn't be able to visit those pages and so wouldn't be able to view source in the browser.
- grayfaced 5y agoWould also need to block ctrl+s/save. Which seems pretty drastic for anything other then a dedicated testing machine.
- tyingq 5y agoAlso pasting "javascript:whatever" in the omnibar. I'm sure there's some nice version of: javascript:alert(document.body.innerHTML);
- birdman3131 5y agoYou can't actually paste that into the omnibar in chrome. It will eat the first part.
- tyingq 5y agoYes, you have to manually type "javascript:" then paste the code. Or copy everything but the leading 'j' and hand type that after pasting. Or put it in a bookmark. Also, alert() truncates the text, but makes for a nice short demo. You could append a <pre> element to the page, or similar.
- colejohnson66 5y agoTaking advantage of a long-lost HTML tag (<plaintext>) that tells the parser to switch the tokenizer to "PLAINTEXT" state[0] with no escape: javascript:document.body.innerHTML="<plaintext>"+document.body.innerHTML From MDN[1]: > The <plaintext> HTML element renders everything following the start tag as raw text, ignoring any following HTML. There is no closing tag, since everything after it is considered raw text. You could use the <pre> tag, but that can be "escaped" from if a </pre> tag exists on the page. Escaping the angle brackets with < and > would fix it, but <plaintext> is more elegant IMO. [0]: https://html.spec.whatwg.org/#plaintext-state https://html.spec.whatwg.org/#plaintext-state [1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/plaintext https://developer.mozilla.org/en-US/docs/Web/HTML/Element/pl...
- tyingq 5y agoYeah, that works great. Then the kids just put that in a bookmark called "view-source". Probably also easy enough to make another bookmark that puts it back to normal.
- missblit 5y agoThis kind of stuff can make sense when you consider "enterprise" environments like school labs. Notice on the bug report that the reproduction steps include setting a "DeveloperToolsDisabled" registry entry. Curl / wget wouldn't always be accessible in this kind of locked down setup (and they're probably trying to make it difficult even if it's impossible to block completely).
- vagrantJin 5y agoDoesnt this solution strike you as scorched earth? Kids figure out things, instead of improving said software, lockdown the actual browser? It's nearsighted to the point of disbelief.
- benjamir 5y agoAt that level of pay you stop caring for anything making sense? Just saying. Apart from drug addicts doing blunt cybercrimes, I find the most creapy things are done by devs that got used to a big paycheck -- additionally, sometimes got fkd in academia before and just became a well trained cynic.
- jamesfinlayson 5y agoOr look in the network tab too?
- verdverm 5y agoYou can block devtools as well it looks like
- verdverm 5y agoSeems like they have added the ability to block devtools on sites as well... Certainly seems like we'll need tools which don't close things off like this.
- josephcsible 5y agoOn computers that would use this "feature", curl and wget wouldn't be available for use.
- selcuka 5y agoYou have to be logged in to Google to use Google Forms. You can emulate a login using curl/wget but it's harder. You could also install another browser if that was allowed.
- panic 5y agoSome more context at https://bugs.chromium.org/p/chromium/issues/detail?id=895462 https://bugs.chromium.org/p/chromium/issues/detail?id=895462: > With Schools using Google Forms as a testing platform, students are able to use this shortcut to search through the source of the page, and determine the correct answers.
- kam 5y agoSounds like these students are learning more in the process of cheating than they'd learn from the multiple-choice quiz.
- yjftsjthsd-h 5y agoThat feels like some hardcore X Y problem.
- SamBam 5y agoDear StackOverflow, students keep cheating by looking at the page source and finding the multiple choice option with the id "correct-answer". How do I add a new feature to Chromium, submit a pull request to Google, get it past their various layers of checks and policies, and mandate that all schools use this new option?
- saba2008 5y agoNot really, if you consider that X is not 'ensure quizzes work', but rather 'how do we cover our asses'.
- 2Gkashmiri 5y agoWhy do I feel like everyone will do this in the quest for "protecting ad money" and will once again have the case of that man charged with hacking for doing CTRL+u
- deleted 5y ago[deleted]
- ryanmcdonough 5y agoIt's a computer level browser policy rather than something the website can request the browser to honour.
- 2Gkashmiri 5y agowho says this isnt normalized in regular chrome as a security feature and later into firefox because "industry"
- ericlaw 5y agoThe many many upstart browsers (including mine) that are eager for Chrome to do something so foolish so we can collect all of their irate users?
- 2Gkashmiri 5y agonot sure if you forgot about floc?
- lucasyvas 5y agoThis makes me think of that ridiculous case in the US with the SSNs on the state website. Maybe just don't put things in source you don't want to be seen?
- advisedwang 5y agoThis is for the chromeos devices/managed chrome browsers [1]. From the bug [2] it looks like this was relevant in a school setting, where this is common. So the school hands out some chromebooks and wants to use that managed environment to prevent kids cheating on quizzes by looking at source code. DRM and related technologies are an effort to wrest control of devices away from their owners, and give control the manufacturers and software companies. For managed devices, this is a bit more reasonable (a school should be able to manage its devices I suppose) but the technological framework here also eliminates software freedom. [1] https://support.google.com/chrome/a/answer/7532419?hl=en https://support.google.com/chrome/a/answer/7532419?hl=en [2] https://bugs.chromium.org/p/chromium/issues/detail?id=895462 https://bugs.chromium.org/p/chromium/issues/detail?id=895462
- DaiPlusPlus 5y agoWhy would viewing HTML+JS source-code reveal correct answers to a school quiz? It certainly doesn’t have to.
- zelphirkalt 5y agoMaybe a case of shortsightedness, thinking, that they need to solve it in a javascript single page app framework and then forgot the basics about client server architecture, sending the solutions to the frontend, to check them right there. A beginner mistake.
- saba2008 5y agoOr just nobody did care. Contractor's main expense are kickbacks and actual product is made by cheapest subcontractor.
- _iziv 5y ago... then don't that behaviour lead to a browser that honours the cheap stakes? Any script that was doing a password comparison client-side was laughed at in the past -- rightly so --, but now that MS & Google see a business case it's fine? (And a password being a secret, is basically the same as the answer to a question).
- l0b0 5y ago> With Schools using Google Forms as a testing platform, students are able to use this shortcut to search through the source of the page, and determine the correct answers. So they're serving the answers with the questions, and get annoyed when the students figure this out. What a lark. How about using a system which doesn't do that?
- epmatsw 5y agoI’m not that surprised tbh. A couple of years back the Chrome Dev Summit quiz did the same thing. I thought that was the joke (“haha, they’re requesting allanswers.json at startup”), and didn’t realize it was apparently unintentional until they revealed I was in first place at the end of the day.
- kyleee 5y agoThis is also the type of thing that plants the seed of interest for a career or hobby of computing, which is another reason it's stupid. Reward people's curiousity instead of punishing it, especially in a schooling situation!
- smashah 5y agoPrecisely! I wonder what chain of events lead this PR being filed. How did the kid(s) get caught? Did a teacher decide to tell the IT department head? Did the head of department then tell the IT maintenance team? Then the IT maintenance team told the test vendor? Very odd chain of events to lead to such a dangerous change.
- rp1 5y agoThese types of "hacks" spread very quickly in school. Once the flaw is discovered, the entire class likely "aced" the test. From there, it's pretty obvious how the vendor found out: the school could no longer use the testing software and demanded an answer.
- deleted 5y ago[deleted]
- ericpauley 5y agoSeems like there are more ways to get past this, such as a javascript bookmarklet that extracts and displays page source.
- NationOfJoe 5y agoThis was my first thought as well. StackOverflow to the rescue https://stackoverflow.com/questions/9968680/view-source-bookmarklet-retrieve-original-source https://stackoverflow.com/questions/9968680/view-source-book... my next step was to look at the chromium bug tracker and apparently that was "fixed" in 2019. weather it still is or not, i don't know. https://chromium.googlesource.com/chromium/src.git/+/ccda1d802594efef77b88a408f595e65a9b34457 https://chromium.googlesource.com/chromium/src.git/+/ccda1d8...
- tmcneal 5y agoFor context, this is is not allowing websites to prevent View Source for all users. Rather it is a setting that administrators can set on Google Chrome installations within their company/school/etc. That said, I highly doubt that Google would take this feature request seriously if this were not associated with another Google property. For example, I can't imagine that if Typeform users opened a similar bug ticket that it would see any traction. To me this highlights a danger I had not considered before around the monopoly power of Google - inane requests that would benefit properties within the Google ecosystem get undue consideration despite it harming the broader ecosystem.
- jsnell 5y agoI don't think your theory fits the facts... The bug is from 2018, and was fixed three years later. So it doesn't seem like there was any kind of special prioritization going on here. It was also fixed by a person working at Microsoft, not by somebody at Google.
- josephcsible 5y agoI think the point that was if anyone but Google wanted this, it'd get laughed all the way to WONTFIX.
- judge2020 5y agoAs shown in the changelog, the bug was filed by a user @amplifiedit.com, and was seen as a worthwhile bug to fix by Brian Malcolm "Taking ownership as the client team in BVE will work on this item"[0]; however, it was stalled for nearly 3 years until Eric submitted a patch for it[1]. While Google thinks it's worthwhile to fix, Microsoft is trying to have a faster-than-usual rise in adoption for their new Edge which is based on Chromium, so that means fixing as many things as possible that their business/EDU customers complain about. BTW Google already allowed MDM (device) admins to disable devtools, but everyone involved in the issue also wanted it to disable view-source since it allowed students to look at the HTML. 0: https://bugs.chromium.org/p/chromium/issues/detail?id=895462#c35 https://bugs.chromium.org/p/chromium/issues/detail?id=895462... 1: https://bugs.chromium.org/p/chromium/issues/detail?id=895462#c54 https://bugs.chromium.org/p/chromium/issues/detail?id=895462...
- jazzyjackson 5y agoShouldn't this be a bug report on google forms?
- ashwoods 5y agoWouldn’t this easily be circumvented by creating a website that shows you the source of any other website?
- BarryMilo 5y agoThis is hilarious, though it would likely only show you the public version of a page, so a basic login feature would "protect" against that. Unless people are willing to give their credentials to such a website, then I suppose it might become an arms race of sorts.
- em-bee 5y agoi was thinking of all sorts of ways how a testing platform could prevent this workaround. but then i realized that with the same effort they could just prevent answers showing up in the source...
- ahmeni 5y agoMy son has now done many months of homeschooling during Sydney's lockdown via Google Classroom and this feature request is completely unsurprising as the product is a complete joke.
- maxpert 5y agoWhy can’t these schools make simple electron apps with these things disabled? I thought these are solved problems instead of landing duds in Chrome!
- dusted 5y agoWith the current state of most websites, there's very little to be learnt from viewing the source anyway. On the other hand, with the current state of the source, one sees oneself having to use the debugger to get the damn things to even work.
- benjamir 5y agoSad, but sooooo true. That gibberish produced by the framework du jour, most of the time is creapily bloated, sometimes even shockingly redundant (read: you could strip 50% to 75% without loosing any functionality). Modern web: bloat website, than use clown cars full of dependencies to "minimize" instead of having a slim and readable source in the first place.
- ericlaw 5y agoTo answer a few questions here: 1. I landed this fix because there was a policy that did not work properly. We could instead document that the URLBlocklist policy works for every scheme but one, or we could fix it. Fixing it makes more sense. 2. This policy only can be set on managed machines. 3. This policy, in isolation, is trivially circumvented. Managed environments block many things, including many of the proposed circumventions here. 4. I've built one of the world's most popular tools for viewing and modifying web traffic. The narrative that this feature has broad implications for anything is absurd.
- joelthelion 5y agoYou guys are giving administrators way too much power without any good reasons. I realize that if they really wanted, they could give up on Chrome and use something else, but for many of them, they will simply lock everything down out of laziness and probably wouldn't without a convenient way of doing so. An example out of many: why give admins a simple way to disable the built-in password manager? This just enables dumb and archaic password policies for no good reason.
- tremon 5y agoAs to your last question, many organizations have a central password management system that lets them audit who uses which password and when. Having the passwords stored in a secondary system makes the audits useless.
- 5y ago
- Kenji 5y agoHow does that solve anything? Can't you just open the developer tools and read the source anyway?
- Nemo_bis 5y agoI was wondering the other day what impact Microsoft developers had on Chromium. Glad to have the answer now.
- artkiver 5y agoIf this were the script to a play and it read: "Villain enters from stage left" it would more or less have precisely this style of commit message I guess. h.f.s.
- TheIronYuppie 5y agoI have no idea what everyone’s problem is with this: - Active Directory/Group Policy/Managed Devices have hundreds of thousands of ways to lock machines down based on the IT staff’s needs (eg disabling USB ports, disabling devtools, etc) - You will not be affected by this in ANY way if you don’t have a managed machine - The feature is already there, just broken If you’re mad about this, get mad at your IT staff?
- freediver 5y agoSpeaking for myself, the problem is in the proposed solution to the issue that brought up this PR. It is to limit/change the way a fundamental browser feature works (view source), instead of simply fixing Google Forms website so that it does not expose answers in plain HTML code. Extrapolate this mindset into the future and you have removal/alternation of other browser features because someone can not code a website properly. Browser is supposed to be the 'user agent', the 'unstoppable force', and it has been that since the dawn of the web and it should stay that way.
- ParadisoShlee 5y agoThis feature is a slippery slope to the NFT people demanding we block right click.
- aorth 5y agoNo matter what the context or intentions were, this sets a terrible precident. I hate the web that Google are creating.