9 ms·

Enterprise-level Chromium removes view-source to prevent students from cheating

52 points by nanis 5y ago

nanis 5y ago
This whole story is a shock to me: I wrote my first online quizzes and problem sets in the 20th century. Submissions were always graded on the server side and answers were never available to the browser. I was involved in a lot of crappy testing software people wanted to sell our university. That was the first criterion I insisted on these publishers satisfied. By the mid-aughts, everyone seemed to have understood it. ... WTF happened that now we are talking about disabling view-source in browsers as a security measure?! I wasn't even aware that was a thing (even though I've had to use Chrome in many enterprise settings). Is this just the `npm install` automatons not understanding the distinction between the client and server in client/server applications?
- db48x 5y ago
  Worse. It is apparently to protect teachers who create quizzes in Google Forms. They don’t know anything about servers or clients, just that Google Forms is easy to use.
  - btilly 5y ago
    It gets worse. Google Forms won't show the answers in Response view. It only happens in Editor view. See https://support.google.com/docs/thread/39605334/google-forms-quiz-page-source-shows-correct-answers?hl=en https://support.google.com/docs/thread/39605334/google-forms... to verify.
  - nanis 5y ago
    > quizzes in Google Forms. Idiocracy is here. This is only acceptable is the purpose is to provide practice questions that do not count for credit. Just like it is a good idea to provide answers to practice questions at the end of the book (sometimes printed upside down). Of course, to be useful as a learning tool, the answers to such practice question must include an explanation of why, say, (c) is a better answer than (a), (b), and (d). So, set up practice questions in Google forms, put actual answers/explanations on a web page for students to learn. You can still do exams in Google forms ... Just don't leave the grading to Google forms. Instead, grade asynchronously. Again, that would be actual work, so, no leave everything to Google, and accuse students of cheating and take away `view-source`. Right. That's what things have come to.
    - daviddever23box 5y ago
      If you can view the answers in view-source, that's a failing grade for the test writers, whether it's Forms or any other tool. Fail the teachers, pass the students smart enough to discover this (or, more well-versed in technology than those tasked to teach them). Unacceptable capitulation to poor educational quality.
      - YXNjaGVyZWdlbgo 5y ago
        The problem is that there are no platforms from the government or states. Schools or I bet individual teachers have to find a solution for themselves. There are solutions out there some cost a lot of money and some are just not easy to deploy. This is systemic and not anything we should put on teachers or individuals that have no chance to change the shitty work environments they are in.
        chromanoid 5y ago
        I totally agree. After 30h of teaching, (depending on the teacher) around 10h to 40h of preparation per week I don't see any room for dealing with shitty software problems. Simple cheap solutions directly benefit the children.
josephcsible 5y ago
If I were in charge of Google, anyone who approved this change instead of saying something like "WONTFIX, this is ridiculous, fix your app to not put answers in the page source instead" would be fired.
- gwern 5y ago
  Bonus points for the bug reporters complaining that it's taking years to 'fix' this (which seems like plenty of time to fix their quizzes, given how much free time they apparently have to lobby Google), and for someone observing that the 'solution' is, like all security-by-obscurity fails, already broken (because of devtools). Meanwhile, the code complexity and unintuitive behavior (who would ever expect 'view-source' to have a blacklist or be controllable by the web page?!) will get externalized onto all Chrome users forevermore.
  - lima 5y ago
    > who would ever expect 'view-source' to have a blacklist or be controllable by the web page This is about enterprise policy in a managed environment. It was already able to block a URL - like https://google.com https://google.com - but not view-source:https://google.com https://google.com. Blocking devtools was already possible.
    - azeirah 5y ago
      does this prevent you from pasting js like this into the URL bar? javascript:let $code=document.createElement('textarea');let source=document.body.outerHTML;$code.innerHTML = source;document.body.appendChild($code); For those who don't feel like reading a js oneliner, it reads the page source and adds an element to the page that displays all of it.
      - sbierwagen 5y ago
        Does pasting javascript into the URL bar execute it?
can16358p 5y ago
So they embed answers in page source, blame students with basic common sense skills for viewing page source, and trying to "fix" _that_ instead of fixing the whatever quiz system they are using to not send the answers to the client? Great move /s
- mhh__ 5y ago
  At least the kids who have the gumption to know how to inspect the source now get a neat lesson about how the grown-ups really work.
- chromanoid 5y ago
  > whatever quiz system they are using Google Forms
wildpeaks 5y ago
It is the equivalent of using heavy marble blocks instead of paper to prevent flipping the page because answers are written on the back of the exam: it tries to hide the symptom of the problem instead of fixing the real problem.
- chromanoid 5y ago
  Your answer is the equivalent of whining about a stain on your shoes while the world is on fire. Hint: Your real problem is not of technical nature.
lostcolony 5y ago
Well, good thing there isn't some -other- way to view the source code of a webpage.
valine 5y ago
Rather than fixing the broken quiz, they’ve chosen to restrict access to a web browser feature with limitless educational value. Perhaps if the creators of the web service had spent more time with the view-source tool during their own schooling they would have designed a better quiz system, one that was less vulnerable to this “exploit”. The layers of incompetence are hilarious. Incompetent web developers restrict access to a valuable resource, which will inevitably lead to more incompetent web developers.
- phendrenad2 5y ago
  I don't agree that using view-source during a test is a critical event in the life of a web developer the lack of which could derail them into "incompetence". But what do I know?
  - grayhatter 5y ago
    > My friend said this tricked worked, he's such a liar computers are stupid. Vs > Woah it worked, this is so fucking cool, what else can I make the computer do? It's probably not critical for someone who's decided to be a web developer. It's the foundation that's created every self taught hacker ever.
    - chromanoid 5y ago
      Yeah maybe this is nice the first time. But do you know what? The second time everyone knows. The third time paper tests are back.
      - grayhatter 5y ago
        Is that a bad thing? Ignoring for the moment the idea of cheating on tests is a problem with the student or the test. Are paper tests a bad thing? Why do intelligent state voting systems depend on paper, or backups? Why do ultra high security computer systems still log to paper?
        5y ago
mftb 5y ago
Just another reason to use/advocate/support Firefox, and alternative browsers. Ultimately this is good for Google. Just like with hiding the url, as far as they're concerned, the less people look under the covers, the better.
- chromanoid 5y ago
  https://github.com/mozilla/policy-templates/blob/master/README.md#disabledevelopertools https://github.com/mozilla/policy-templates/blob/master/READ...
- agilob 5y ago
  Firefox isn't installed on many university computers. CS students don't have access to root/sudo and are forced to use existing software. Exams "don't work" on Firefox (UA-checks...) so when doing exam on your own PC, have to install Chrome, and yes, disconnect any external screen, allow software to record the screen and turn on webcam.
Brushfire 5y ago
Why is it acceptable to have a quiz where the answers are obvious from the HTML? Come on…
- chromanoid 5y ago
  Did you ever look at a Word document made by a non-STEM teacher?
bluecalm 5y ago
It's a good solution to protect NFTs from being copied as well. I expect it to gain traction.
- Shared404 5y ago
  If a portion of the Cryptocurrency community winds up having their tech used as a promotion for censorship[0] in this manner, I will die laughing from the irony. [0] I hate throwing out this word, as it's always used wrong - including my usage here - and tends to carry a lot of other connotations with it which I don't want to affiliate myself with. Is there a better word to use here?
- grayhatter 5y ago
  You're already getting downvoted by people who don't appreciate the sarcasm. Which really is a shame, because I thought this was hilarious!
  - Shared404 5y ago
    It is indeed quite funny, in a depressing sort of way :P .
jdofaz 5y ago
Schools have had the ability to disable devtools in chrome for at least a couple years
- watermelon0 5y ago
  Devtools yes, but not the view-source functionality, which is 'fixed' with this change.
chromanoid 5y ago
Seems to be a useful feature also when you want to use Chromium as Kiosk software. I honestly don't get why so many commentators are upset. They are using Google Forms for tests. And these tests leak answers through the source code. Schools are not well funded and this setup itself is not very professional. When you can fix this by giving admins such possibilities, why not? It's not like your Chrome will prevent you from viewing any sources. As you can also read in the article the restriction can be limited to certain URLs. IT ONLY AFFECTS MANAGED ENVIRONMENTS WHERE ADMINS CAN DO MUCH MORE RESTRICITNG THINGS ANYWAY.
- watermelon0 5y ago
  So much this. I think the issue is that the fix was packed up as the solution for broken test-taking software (or misuse of Google Forms for that intention), and people everywhere are complaining that it's not a valid reason, with which I agree. However, there are legit environments where people might want to prevent users from accessing devtools and view-source functionality, like when using it as a kiosk software. From security standpoint, it might be also reasonable to disable at least devtools in enterprise environments, since users can not necessarily be trusted with such access (which is the reason why many sites, such as Facebook, display warning to not enter anything in the console, especially if someone instructed them or they found it online).
dang 5y ago
Recent and related: Chromium: Permit blocking of view-source: with URLBlocklist - https://news.ycombinator.com/item?id=29170886 https://news.ycombinator.com/item?id=29170886 - Nov 2021 (126 comments) View-Source in Chromium - https://news.ycombinator.com/item?id=29193561 https://news.ycombinator.com/item?id=29193561 - Nov 2021 (1 comment)
infogulch 5y ago
This is sickening. The person who landed this "fix" posted about it couple days ago: https://news.ycombinator.com/item?id=29171599 https://news.ycombinator.com/item?id=29171599
- chromanoid 5y ago
  Why is this sickening? The same admin can also restrict your browser to just one valid URL or make your whole machine usable by left mouse clicks only. Being not able to view the source in this context is sickening? Do teachers really have to create an electron app for this stuff?
grayhatter 5y ago
> It was fixed by Microsoft principal program manager Eric Lawrence So rarely do you get to learn the name of the person who willingly make applications user hostile. The defective code is obviously^1 the test, not the browser. Yet, Eric decided to break the usefullness of an existing feature to try to prevent kids who are smarter then the test from beating the test. The reason everything is broken, is because of these types of decisions. I just wish fewer people like Eric would make decisions to break stuff to try to fix other more broken stuff. I wonder what someone will have to break now to get around this new defect in Chromium :( ^1: Obvious to anyone that understands the basics of web and computer security.
- chiefalchemist 5y ago
  I think the article said the disabling of view source is an enterprise feature that's limited to specified URLs. Prior, the bug was, it wasn't working. That is, you could not disable view source for list of URLs. I agree. View source is generally a good thing. But if an org wants to disable it for some limited set of URLs that's not really an issue. This feature doesn't effect everyone. My takeaway of the news here was that this bug was open for so long and was finally fixed. But perhaps I read with the wrong lens.
  - alpaca128 5y ago
    Can someone tell me a reason why an organization would want to block this feature? And blocking this in Chrome wouldn't be enough; they'd also need to whitelist execution for programs so people can't just use a portable browser. Then whitelist permitted websites and network connections to prevent use of other online workarounds. This all can't be easier than solving the root issue.
    - grayhatter 5y ago
      It's not, they're not trying to solve all issues. Just the ones they're aware of. You're thinking too deeply if you're trying to understand their motivation. Occams' Razor also applies to understanding motivation. Students are cheating by viewing source -> block viewing source. Is much easier to understand than fixing the actual problem, which looks like. Students are cheating by reading the source code -> the source code contains the test -> the test shouldn't also contain the answers -> the source code shouldn't contain the answers -> we need to remove the answers from the source code.
l3s2d 5y ago
Can the HN post title be changed to the article title? The post title is inaccurate and misleading. No functionality was removed, just a fix added for Chromium not respecting `view-source` URLs in the URL blocklist.
- nanis 5y ago
  The full title and subtitle of the article are: > Microsoft engineer fixes enterprise-level Chromium bug students could exploit to cheat in online tests > Ability to block 'view source' for specific URLs hasn't actually worked for years The post title is a decent summary.
  - l3s2d 5y ago
    The post title can be interpreted as being done at a global level, instead of per enterprise instance by an admin.
jimmyluo 5y ago
Y’all need to chill out with the hyperbole. Eric Lawrence, who I’ve worked with and wrote FIDDLER btw, which does the opposite of what anyone down here is proportions he’s intending, specifically noted that he was fixing a bug in the Blocklist policy. Basically the policy works for all schemes except view-source. He fixed the policy so that it does what it should do, which is work for all schemes. There are uncountable other ways to look at the source of webpages, many of which can also be blocked by enterprises, but it’s completely silly to imply that this change is causing a closed or evil ecosystem. Jeeeesus people need to think critically.
l0b0 5y ago
There are plenty of people out there who would love to see this feature more widespread. See all the fuss about making sure end users can't look under the carpet, like disabling copying, obfuscating JS, and DRM.
sebazzz 5y ago
Reminds me of SCORM based exams at work which also had the results in code, easily requested by iterating over some array in the browser console.
poopooracoocoo 5y ago
Good god, organisations/enterprises really have too much control over the browser. I believe that only top secret organisations like... The NSA need such a locked down browser for employees/students. I also believe that locking down internet access only limits ones ability to work and be happy, ultimately being detrimental to efficiency. While there are plenty of outlets for distraction, workers have managers and the work that's been done can be seen. Team chats exist.

52 points by nanis 5y ago

This whole story is a shock to me: I wrote my first online quizzes and problem sets in the 20th century. Submissions were always graded on the server side and answers were never available to the browser. I was involved in a lot of crappy testing software people wanted to sell our university. That was the first criterion I insisted on these publishers satisfied. By the mid-aughts, everyone seemed to have understood it. ... WTF happened that now we are talking about disabling view-source in browsers as a security measure?! I wasn't even aware that was a thing (even though I've had to use Chrome in many enterprise settings). Is this just the `npm install` automatons not understanding the distinction between the client and server in client/server applications?

db48x 5y ago
Worse. It is apparently to protect teachers who create quizzes in Google Forms. They don’t know anything about servers or clients, just that Google Forms is easy to use.
- btilly 5y ago
  It gets worse. Google Forms won't show the answers in Response view. It only happens in Editor view. See https://support.google.com/docs/thread/39605334/google-forms-quiz-page-source-shows-correct-answers?hl=en https://support.google.com/docs/thread/39605334/google-forms... to verify.
- nanis 5y ago
  > quizzes in Google Forms. Idiocracy is here. This is only acceptable is the purpose is to provide practice questions that do not count for credit. Just like it is a good idea to provide answers to practice questions at the end of the book (sometimes printed upside down). Of course, to be useful as a learning tool, the answers to such practice question must include an explanation of why, say, (c) is a better answer than (a), (b), and (d). So, set up practice questions in Google forms, put actual answers/explanations on a web page for students to learn. You can still do exams in Google forms ... Just don't leave the grading to Google forms. Instead, grade asynchronously. Again, that would be actual work, so, no leave everything to Google, and accuse students of cheating and take away `view-source`. Right. That's what things have come to.
  - daviddever23box 5y ago
    If you can view the answers in view-source, that's a failing grade for the test writers, whether it's Forms or any other tool. Fail the teachers, pass the students smart enough to discover this (or, more well-versed in technology than those tasked to teach them). Unacceptable capitulation to poor educational quality.
    - YXNjaGVyZWdlbgo 5y ago
      The problem is that there are no platforms from the government or states. Schools or I bet individual teachers have to find a solution for themselves. There are solutions out there some cost a lot of money and some are just not easy to deploy. This is systemic and not anything we should put on teachers or individuals that have no chance to change the shitty work environments they are in.
      - chromanoid 5y ago
        I totally agree. After 30h of teaching, (depending on the teacher) around 10h to 40h of preparation per week I don't see any room for dealing with shitty software problems. Simple cheap solutions directly benefit the children.

josephcsible 5y ago

If I were in charge of Google, anyone who approved this change instead of saying something like "WONTFIX, this is ridiculous, fix your app to not put answers in the page source instead" would be fired.

gwern 5y ago
Bonus points for the bug reporters complaining that it's taking years to 'fix' this (which seems like plenty of time to fix their quizzes, given how much free time they apparently have to lobby Google), and for someone observing that the 'solution' is, like all security-by-obscurity fails, already broken (because of devtools). Meanwhile, the code complexity and unintuitive behavior (who would ever expect 'view-source' to have a blacklist or be controllable by the web page?!) will get externalized onto all Chrome users forevermore.
- lima 5y ago
  > who would ever expect 'view-source' to have a blacklist or be controllable by the web page This is about enterprise policy in a managed environment. It was already able to block a URL - like https://google.com https://google.com - but not view-source:https://google.com https://google.com. Blocking devtools was already possible.
  - azeirah 5y ago
    does this prevent you from pasting js like this into the URL bar? javascript:let $code=document.createElement('textarea');let source=document.body.outerHTML;$code.innerHTML = source;document.body.appendChild($code); For those who don't feel like reading a js oneliner, it reads the page source and adds an element to the page that displays all of it.
    - sbierwagen 5y ago
      Does pasting javascript into the URL bar execute it?

can16358p 5y ago

So they embed answers in page source, blame students with basic common sense skills for viewing page source, and trying to "fix" _that_ instead of fixing the whatever quiz system they are using to not send the answers to the client? Great move /s

mhh__ 5y ago
At least the kids who have the gumption to know how to inspect the source now get a neat lesson about how the grown-ups really work.
chromanoid 5y ago
> whatever quiz system they are using Google Forms

wildpeaks 5y ago

It is the equivalent of using heavy marble blocks instead of paper to prevent flipping the page because answers are written on the back of the exam: it tries to hide the symptom of the problem instead of fixing the real problem.

chromanoid 5y ago
Your answer is the equivalent of whining about a stain on your shoes while the world is on fire. Hint: Your real problem is not of technical nature.

lostcolony 5y ago

Well, good thing there isn't some -other- way to view the source code of a webpage.

valine 5y ago

Rather than fixing the broken quiz, they’ve chosen to restrict access to a web browser feature with limitless educational value. Perhaps if the creators of the web service had spent more time with the view-source tool during their own schooling they would have designed a better quiz system, one that was less vulnerable to this “exploit”. The layers of incompetence are hilarious. Incompetent web developers restrict access to a valuable resource, which will inevitably lead to more incompetent web developers.

phendrenad2 5y ago
I don't agree that using view-source during a test is a critical event in the life of a web developer the lack of which could derail them into "incompetence". But what do I know?
- grayhatter 5y ago
  > My friend said this tricked worked, he's such a liar computers are stupid. Vs > Woah it worked, this is so fucking cool, what else can I make the computer do? It's probably not critical for someone who's decided to be a web developer. It's the foundation that's created every self taught hacker ever.
  - chromanoid 5y ago
    Yeah maybe this is nice the first time. But do you know what? The second time everyone knows. The third time paper tests are back.
    - grayhatter 5y ago
      Is that a bad thing? Ignoring for the moment the idea of cheating on tests is a problem with the student or the test. Are paper tests a bad thing? Why do intelligent state voting systems depend on paper, or backups? Why do ultra high security computer systems still log to paper?
      - 5y ago

mftb 5y ago

Just another reason to use/advocate/support Firefox, and alternative browsers. Ultimately this is good for Google. Just like with hiding the url, as far as they're concerned, the less people look under the covers, the better.

chromanoid 5y ago
https://github.com/mozilla/policy-templates/blob/master/README.md#disabledevelopertools https://github.com/mozilla/policy-templates/blob/master/READ...
agilob 5y ago
Firefox isn't installed on many university computers. CS students don't have access to root/sudo and are forced to use existing software. Exams "don't work" on Firefox (UA-checks...) so when doing exam on your own PC, have to install Chrome, and yes, disconnect any external screen, allow software to record the screen and turn on webcam.

Brushfire 5y ago

Why is it acceptable to have a quiz where the answers are obvious from the HTML? Come on…

chromanoid 5y ago
Did you ever look at a Word document made by a non-STEM teacher?

bluecalm 5y ago

It's a good solution to protect NFTs from being copied as well. I expect it to gain traction.

Shared404 5y ago
If a portion of the Cryptocurrency community winds up having their tech used as a promotion for censorship[0] in this manner, I will die laughing from the irony. [0] I hate throwing out this word, as it's always used wrong - including my usage here - and tends to carry a lot of other connotations with it which I don't want to affiliate myself with. Is there a better word to use here?
grayhatter 5y ago
You're already getting downvoted by people who don't appreciate the sarcasm. Which really is a shame, because I thought this was hilarious!
- Shared404 5y ago
  It is indeed quite funny, in a depressing sort of way :P .

jdofaz 5y ago

Schools have had the ability to disable devtools in chrome for at least a couple years

watermelon0 5y ago
Devtools yes, but not the view-source functionality, which is 'fixed' with this change.

chromanoid 5y ago

Seems to be a useful feature also when you want to use Chromium as Kiosk software. I honestly don't get why so many commentators are upset. They are using Google Forms for tests. And these tests leak answers through the source code. Schools are not well funded and this setup itself is not very professional. When you can fix this by giving admins such possibilities, why not? It's not like your Chrome will prevent you from viewing any sources. As you can also read in the article the restriction can be limited to certain URLs. IT ONLY AFFECTS MANAGED ENVIRONMENTS WHERE ADMINS CAN DO MUCH MORE RESTRICITNG THINGS ANYWAY.

watermelon0 5y ago
So much this. I think the issue is that the fix was packed up as the solution for broken test-taking software (or misuse of Google Forms for that intention), and people everywhere are complaining that it's not a valid reason, with which I agree. However, there are legit environments where people might want to prevent users from accessing devtools and view-source functionality, like when using it as a kiosk software. From security standpoint, it might be also reasonable to disable at least devtools in enterprise environments, since users can not necessarily be trusted with such access (which is the reason why many sites, such as Facebook, display warning to not enter anything in the console, especially if someone instructed them or they found it online).

dang 5y ago

Recent and related: Chromium: Permit blocking of view-source: with URLBlocklist - https://news.ycombinator.com/item?id=29170886 https://news.ycombinator.com/item?id=29170886 - Nov 2021 (126 comments) View-Source in Chromium - https://news.ycombinator.com/item?id=29193561 https://news.ycombinator.com/item?id=29193561 - Nov 2021 (1 comment)

infogulch 5y ago

This is sickening. The person who landed this "fix" posted about it couple days ago: https://news.ycombinator.com/item?id=29171599 https://news.ycombinator.com/item?id=29171599

chromanoid 5y ago
Why is this sickening? The same admin can also restrict your browser to just one valid URL or make your whole machine usable by left mouse clicks only. Being not able to view the source in this context is sickening? Do teachers really have to create an electron app for this stuff?

grayhatter 5y ago

> It was fixed by Microsoft principal program manager Eric Lawrence So rarely do you get to learn the name of the person who willingly make applications user hostile. The defective code is obviously^1 the test, not the browser. Yet, Eric decided to break the usefullness of an existing feature to try to prevent kids who are smarter then the test from beating the test. The reason everything is broken, is because of these types of decisions. I just wish fewer people like Eric would make decisions to break stuff to try to fix other more broken stuff. I wonder what someone will have to break now to get around this new defect in Chromium :( ^1: Obvious to anyone that understands the basics of web and computer security.

chiefalchemist 5y ago
I think the article said the disabling of view source is an enterprise feature that's limited to specified URLs. Prior, the bug was, it wasn't working. That is, you could not disable view source for list of URLs. I agree. View source is generally a good thing. But if an org wants to disable it for some limited set of URLs that's not really an issue. This feature doesn't effect everyone. My takeaway of the news here was that this bug was open for so long and was finally fixed. But perhaps I read with the wrong lens.
- alpaca128 5y ago
  Can someone tell me a reason why an organization would want to block this feature? And blocking this in Chrome wouldn't be enough; they'd also need to whitelist execution for programs so people can't just use a portable browser. Then whitelist permitted websites and network connections to prevent use of other online workarounds. This all can't be easier than solving the root issue.
  - grayhatter 5y ago
    It's not, they're not trying to solve all issues. Just the ones they're aware of. You're thinking too deeply if you're trying to understand their motivation. Occams' Razor also applies to understanding motivation. Students are cheating by viewing source -> block viewing source. Is much easier to understand than fixing the actual problem, which looks like. Students are cheating by reading the source code -> the source code contains the test -> the test shouldn't also contain the answers -> the source code shouldn't contain the answers -> we need to remove the answers from the source code.

l3s2d 5y ago

Can the HN post title be changed to the article title? The post title is inaccurate and misleading. No functionality was removed, just a fix added for Chromium not respecting `view-source` URLs in the URL blocklist.

nanis 5y ago
The full title and subtitle of the article are: > Microsoft engineer fixes enterprise-level Chromium bug students could exploit to cheat in online tests > Ability to block 'view source' for specific URLs hasn't actually worked for years The post title is a decent summary.
- l3s2d 5y ago
  The post title can be interpreted as being done at a global level, instead of per enterprise instance by an admin.

jimmyluo 5y ago

Y’all need to chill out with the hyperbole. Eric Lawrence, who I’ve worked with and wrote FIDDLER btw, which does the opposite of what anyone down here is proportions he’s intending, specifically noted that he was fixing a bug in the Blocklist policy. Basically the policy works for all schemes except view-source. He fixed the policy so that it does what it should do, which is work for all schemes. There are uncountable other ways to look at the source of webpages, many of which can also be blocked by enterprises, but it’s completely silly to imply that this change is causing a closed or evil ecosystem. Jeeeesus people need to think critically.

l0b0 5y ago

There are plenty of people out there who would love to see this feature more widespread. See all the fuss about making sure end users can't look under the carpet, like disabling copying, obfuscating JS, and DRM.

sebazzz 5y ago

Reminds me of SCORM based exams at work which also had the results in code, easily requested by iterating over some array in the browser console.

poopooracoocoo 5y ago

Good god, organisations/enterprises really have too much control over the browser. I believe that only top secret organisations like... The NSA need such a locked down browser for employees/students. I also believe that locking down internet access only limits ones ability to work and be happy, ultimately being detrimental to efficiency. While there are plenty of outlets for distraction, workers have managers and the work that's been done can be seen. Team chats exist.