8 ms·

>Now the first line ends like this which is still a perfectly valid gif. How might that look? >Amazing! Stupendous! Wonderful! As of the time of this writing,

• OscarDC 5y ago
  Same here on Arch with Firefox (perhaps due to the fact that I'm using a Wayland compositor?). It was quite surprising!
  • Aardwolf 5y ago
    I see the desktop background through it on Archlinux with Firefox, using X with cinnamon. Even if there's another window behind, it shows the desktop background wallpaper
• amlib 5y ago
  Here (Firefox on Manjaro X11) I get a HOM effect inside the square while scrolling and with whatever window was previously on top of the square. Sometimes it also renders a little bit of what was behind the window too.. very curious indeed.
• gus_massa 5y ago
  Very interesting discovery. Can you share a screenshot?
  • Hitton 5y ago
    It's nothing special. Relevant part: https://snipboard.io/Izntmp.jpg https://snipboard.io/Izntmp.jpg
    • OscarCunningham 5y ago
      Maybe this screenshot is clearer since it shows the full desktop (Debian, KDE, X): https://i.imgur.com/Aqy3Twm.png https://i.imgur.com/Aqy3Twm.png.
      • Pxtl 5y ago
        Okay this had me giggling like an idiot. That's a hell of a bug.
        • d33 5y ago
          Curious if it's exploitable.
          • Pxtl 5y ago
            I think JS can only read pixels from the screen within a Canvas, which likely would just return the canvas colors not the background. Maybe there's some complicated ninja social engineering you could do using this, but I doubt it.
• ggeorgovassilis 5y ago
  Same here, FF on Ubuntu, it's like a rectangle was cut out of the browser window.
• ogurechny 5y ago
  I suppose that the graphical library simply copies the raw values to output pixels without interpreting them (as it should). In true 256 color mode (on old systems, before the effective deprecation of all the color conversion and matching routines) that would probably use the current palette. In the early 90s, if you had a lot of GIFs sharing the same palette, and knew that the program displaying them had already set it once, you could skip implementing all the palette handling.
• earthbee 5y ago
  Same for me, I can see my wallpaper and desktop icons. Very strange. Wonder if this is a risk for being exploited somehow to take photos of people's desktops
  • ta_2325r9e 5y ago
    I wrote a simple HTML and JS to test if that's possible: Load this GIF, then draw it into a canvas using drawImage[1], then read the canvas content with getImageData. Luckily it returns an array of zeros, so it at least not trivially exploitable. [1] https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/drawImage https://developer.mozilla.org/en-US/docs/Web/API/CanvasRende... [2] https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/getImageData https://developer.mozilla.org/en-US/docs/Web/API/CanvasRende...
    • Arnavion 5y ago
      The browser is rendering that region of its window as transparent, and the display compositor is obliging by showing the layers below the browser window. The browser window itself doesn't know anything about the pixels of the layers below it. So anything that looks at the browser window, like canvas.getImageData will not return those pixels. However screen-sharing API like getDisplayMedia() will screencopy at the compositor level, so they will include those pixels depending on what you choose to share.
• kevincox 5y ago
  If Firefox is maximized I just see other text on the page as I scroll. If I make it a floating window I sometimes see other page content and sometimes see the window below. Very strange. I wonder if this could be used for some sort of phishing attack by tricking the user into thinking it is some OS trusted dialog or just showing that you know something secret so you should be trusted (would be hard to set up to work with any sort of probability though).
  • sodimel 5y ago
    I took a screenshot[0] using the firefox utility and the result is a black rectangle. It's even funnier when I open the dev tools, the transparent image is replaced by a violet rectangle, blinks a few times then stay violet[1]! [0]: https://up.l3m.in/file/1646929301.png https://up.l3m.in/file/1646929301.png [1]: https://up.l3m.in/file/1646929762-a.webm https://up.l3m.in/file/1646929762-a.webm
• leokennis 5y ago
  Haha - it punctured your Firefox window!
• OscarCunningham 5y ago
  I've reported this as a bug here: https://bugzilla.mozilla.org/show_bug.cgi?id=1758975 https://bugzilla.mozilla.org/show_bug.cgi?id=1758975
  • nomel 5y ago
    Wow, with the line of code found in under an hour. Mozregression looks amazing: https://mozilla.github.io/mozregression/ https://mozilla.github.io/mozregression/
    • OscarCunningham 5y ago
      It's now 8 days later, and it's fixed in the nightly build. Although in contrast to what it says in the blog post, it's a perfectly white square.
  • anon_cow1111 5y ago
    This feels like the equivalent of patching the ai in GTA cars, so they can no longer randomly crash into each other and cause huge pileups. If no one can turn it into a working exploit, it should be left alone for the sheer weird/cool factor.
    • OscarCunningham 5y ago
      I agree, but it does feel like it has a lot of exploit potential.
• chungy 5y ago
  Same here with Firefox on GNOME on Arch. I do have amusement when the author says it's a black square on every renderer he's tried, but we trivially trigger something else :) Seems like he's on Mac OS X and so I guess it's down to platform quirks.
  • deleted 5y ago
    [deleted]
• deleted 5y ago
  [deleted]