4 ms·

Hmm. Enabling this for any element regardless of full-screen state might be a bad idea. Is the warning popup modal? Can you use it to cause the user to click on

by jrabone 14y ago

Hmm. Enabling this for any element regardless of full-screen state might be a bad idea. Is the warning popup modal? Can you use it to cause the user to click on something other than the intended target by intentionally drawing the pointer in the wrong place? Like JavaScript, this needs a default-disable, on for trusted sites only mode.

Tmmrn 14y ago
Well, chromium pops up a bar on the top with buttons for denying or accepting the request of the website to disable the cursor before it does anything.
arasmussen 14y ago
I don't see why this is really a security issue. You can't control their pointer, it just becomes disabled. The popup and the pointer lock are managed by the browser, so you can't trick them into doing anything and they can always get out of it by just pressing escape. Seems pretty solid to me.
- jrabone 14y ago
  Read the article - they specifically talk about drawing your own pointer. You don't need to control the pointer, you just need to make it appear to be somewhere else. Remember all the shitty spam adverts themed to look like Windows XP dialog boxes? I can't wait to see what the bottom-feeders can come up with given this sort of feature. At least it sounds like Chromium uses a modal yes/no question bar.
  - Shorel 14y ago
    It is necessary that way. The mouse sends high DPI information to the OS, and the OS sends the applications the mouse info they request. For drawing the pointer in the GUI, lots of DPIs correspond to moving just one pixel. However, that's just too low resolution for gaming, where the full DPI information is preferable. Also, for gaming, mouse acceleration should be disabled. The solution in other games is to read the original high DPI info, instead of the mouse screen coordinates. Of course you are right about spam, but there's a technical reason for this implementation.

by jrabone 14y ago

Tmmrn 14y ago

Well, chromium pops up a bar on the top with buttons for denying or accepting the request of the website to disable the cursor before it does anything.

arasmussen 14y ago

I don't see why this is really a security issue. You can't control their pointer, it just becomes disabled. The popup and the pointer lock are managed by the browser, so you can't trick them into doing anything and they can always get out of it by just pressing escape. Seems pretty solid to me.

jrabone 14y ago
Read the article - they specifically talk about drawing your own pointer. You don't need to control the pointer, you just need to make it appear to be somewhere else. Remember all the shitty spam adverts themed to look like Windows XP dialog boxes? I can't wait to see what the bottom-feeders can come up with given this sort of feature. At least it sounds like Chromium uses a modal yes/no question bar.
- Shorel 14y ago
  It is necessary that way. The mouse sends high DPI information to the OS, and the OS sends the applications the mouse info they request. For drawing the pointer in the GUI, lots of DPIs correspond to moving just one pixel. However, that's just too low resolution for gaming, where the full DPI information is preferable. Also, for gaming, mouse acceleration should be disabled. The solution in other games is to read the original high DPI info, instead of the mouse screen coordinates. Of course you are right about spam, but there's a technical reason for this implementation.