6 ms·

When you open devtools, by default it will try to load source code maps for your JS and CSS. Very simple for a system to detect the request for the map file.

When you open devtools, by default it will try to load source code maps for your JS and CSS. Very simple for a system to detect the request for the map file. If that's their vector turn off the autoloader and try from a clean IP.

Karellen 4y ago
TIL about source code maps. ...and how to disable them from auto-loading. I mean, okay, I can see how they definitely have a use. But to try and auto-fetch js and css maps just because I want to have a look at the DOM? Why not wait until I actually try looking at js/css? Or even until I ask to see the source map? Prefetching never feels right to me. Even though I know GET requests are supposed to be side-effect free and idempotent (and if they're not, that's a choice by the server devs and they'd better have covered all the edge cases where clients correctly act as if they are...), it has the architectural equivalent of a "code smell" to my nose.
- JeremyBanks 4y ago
  [dead]
zamadatix 4y ago
Interesting to note. In Firefox "show original sources" seems to be enabled by default but in Chrome at least the settings checkbox is labeled "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons" and unchecked for me. Haven't checked Safari to see what its behavior is.
- djbusby 4y ago
  Hmm, I'm on Chrome 111 on Linux and there are two boxes for loading maps - one for JS and one for CSS. Could yours be a Windows Group Policy from $WORK?
  - zamadatix 4y ago
    I have 3 boxes: "Enable JavaScript source maps", "Enable CSS source maps", and "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons". The first 2 are checked but without the 3rd trying to load source maps doesn't seem to do anything unless I have them locally. It's very possible I'm just testing it wrong, I don't use source maps often. It's also very possible Firefox does something similar and I'm just overlooking the option/behavior there.
    - djbusby 4y ago
      Our Chrome are the same - and load the maps by default.
bilekas 4y ago
This is interesting as for a hackathon i was thinking of ways to identify this behavior too. The source map requests was a more successful option. Also played around with "snap" resize but it was too agressive. As for whatever the reason MailChimp would block your up is pretty ridiculous.
- status200 4y ago
  I can only imagine the amount of security pressure they feel since they are basically a backdoor into easily stealing one or more company identities once you pass the 2FA, with full address books of customers that will trust emails deployed through MC campaigns and blindly click on links in the emails sent out, so I am guessing they err on the side of caution and have tons of false positives instead of letting anything pass through or disrupt.
iudqnolq 4y ago
Unfortunately console.log(foo) calls foo.toString() if and only if the console is open, and there is no way to disable this in Chrome or Firefox. Edit: You can redefine console.log to be a noop, but that's also detectable.
- joeframbach 4y ago
  Theoretically you could also write a bookmarklet that could inspect or modify globals. Or a greasemonkey script.
  - iudqnolq 4y ago
    You could also fork Chrome.
    - quickthrower2 4y ago
      You could also fuck Mailchimp
      - iudqnolq 4y ago
        I stopped using them years ago for other reasons. We're talking about how to do research into their fuckery here, I'm not suggesting it's sane to fork a browser to make a company's crapware work.
- easrng 4y ago
  I can't repro, how are you getting it to call toString?
  - iudqnolq 4y ago
    const foo = () => {} foo.toString = () => console.warn("called") console.log(foo)
    - easrng 4y ago
chatmasta 4y ago
Similarly, here are some techniques for debugger detection [0]. I've seen some crypto mining malware in the wild that did this to make deobfuscation more difficult. [0] https://x-c3ll.github.io/posts/javascript-antidebugging/ https://x-c3ll.github.io/posts/javascript-antidebugging/

Karellen 4y ago

TIL about source code maps. ...and how to disable them from auto-loading. I mean, okay, I can see how they definitely have a use. But to try and auto-fetch js and css maps just because I want to have a look at the DOM? Why not wait until I actually try looking at js/css? Or even until I ask to see the source map? Prefetching never feels right to me. Even though I know GET requests are supposed to be side-effect free and idempotent (and if they're not, that's a choice by the server devs and they'd better have covered all the edge cases where clients correctly act as if they are...), it has the architectural equivalent of a "code smell" to my nose.

JeremyBanks 4y ago
[dead]

zamadatix 4y ago

Interesting to note. In Firefox "show original sources" seems to be enabled by default but in Chrome at least the settings checkbox is labeled "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons" and unchecked for me. Haven't checked Safari to see what its behavior is.

djbusby 4y ago
Hmm, I'm on Chrome 111 on Linux and there are two boxes for loading maps - one for JS and one for CSS. Could yours be a Windows Group Policy from $WORK?
- zamadatix 4y ago
  I have 3 boxes: "Enable JavaScript source maps", "Enable CSS source maps", and "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons". The first 2 are checked but without the 3rd trying to load source maps doesn't seem to do anything unless I have them locally. It's very possible I'm just testing it wrong, I don't use source maps often. It's also very possible Firefox does something similar and I'm just overlooking the option/behavior there.
  - djbusby 4y ago
    Our Chrome are the same - and load the maps by default.

bilekas 4y ago

This is interesting as for a hackathon i was thinking of ways to identify this behavior too. The source map requests was a more successful option. Also played around with "snap" resize but it was too agressive. As for whatever the reason MailChimp would block your up is pretty ridiculous.

status200 4y ago
I can only imagine the amount of security pressure they feel since they are basically a backdoor into easily stealing one or more company identities once you pass the 2FA, with full address books of customers that will trust emails deployed through MC campaigns and blindly click on links in the emails sent out, so I am guessing they err on the side of caution and have tons of false positives instead of letting anything pass through or disrupt.

iudqnolq 4y ago

Unfortunately console.log(foo) calls foo.toString() if and only if the console is open, and there is no way to disable this in Chrome or Firefox. Edit: You can redefine console.log to be a noop, but that's also detectable.

joeframbach 4y ago
Theoretically you could also write a bookmarklet that could inspect or modify globals. Or a greasemonkey script.
- iudqnolq 4y ago
  You could also fork Chrome.
  - quickthrower2 4y ago
    You could also fuck Mailchimp
    - iudqnolq 4y ago
      I stopped using them years ago for other reasons. We're talking about how to do research into their fuckery here, I'm not suggesting it's sane to fork a browser to make a company's crapware work.
easrng 4y ago
I can't repro, how are you getting it to call toString?
- iudqnolq 4y ago
  const foo = () => {} foo.toString = () => console.warn("called") console.log(foo)
  - easrng 4y ago

chatmasta 4y ago

Similarly, here are some techniques for debugger detection [0]. I've seen some crypto mining malware in the wild that did this to make deobfuscation more difficult. [0] https://x-c3ll.github.io/posts/javascript-antidebugging/ https://x-c3ll.github.io/posts/javascript-antidebugging/