3 ms·
The browser is the one actually opening up the connection in this case. That's why there's so much disagreement in this thread. Your browser opens the connecti
by bryan_w 5y ago
The browser is the one actually opening up the connection in this case. That's why there's so much disagreement in this thread.
Your browser opens the connection to the original website and downloads the base page. That base page references images and js and fonts hosted elsewhere, so your browser opens a connection to download those images. At this point the browser could pop open a dialogue box that says "Hey you said you wanted to communicate with foo.com but I need to grab a pic from bar.com is that cool?"
At no point in this use case does foo.com send anything to bar.com
- mananaysiempre 5y ago> At this point the browser could pop open a dialogue box that says "Hey you said you wanted to communicate with foo.com but I need to grab a pic from bar.com is that cool?" IE 6 in the default configuration did something like that with its yellow bar, IIRC, and all it amounted to was the fastest known method (minutes, for me) to provoke warning fatigue and make people vulnerable, seeing as the same UI was used for installing ActiveX controls. (Could be it did that all additional resources, though, not just those from a different origin? I don’t remember since I disabled the whole thing near-immediately even when I did actually use IE 6.) This is unworkable from a usability perspective for as long as hotlinking to external resources is so commonplace. And a user permission might not be an effective way to do this, anyway, given the imbalance in bargaining power, as already seen with adblocker-blockers and such. (See also the 2006 paper, “A pact with the devil”[1].) [1] https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-666.pdf https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-666.pdf