6 ms·

"self-XSS" (the thing this malfeature is purportedly protecting people from) is a made-up concept. It's basically "don't run your own scripts to interfere with

by gergles 13y ago

"self-XSS" (the thing this malfeature is purportedly protecting people from) is a made-up concept. It's basically "don't run your own scripts to interfere with our site, and we'll use scary-sounding security words in an attempt to discourage you from doing it." I don't believe for a second this is about helping the user - more likely is that FB and Netflix want to prevent users running scripts that add features or do functions they find inconvenient, like exporting your address book or movie rating info. I get to run code just as much as you do - it's MY computer, MY browser, and MY bandwidth. Making up a scare word (that just means "users running code I don't like") in an attempt to legitimize disabling access to development and exploration tools is beyond the pale. There is absolutely no reason to permit this kind of behavior, and I'm frankly a little appalled a community of startup founders and hackers would ever defend this kind of behavior, as some of the comments here have done. If you want to protect users from themselves and limit and restrict what they can do, write a mobile app. Don't try and put your shit on the web if you want it to be a walled garden.

FiloSottile 13y ago
I don't see exactly how it is a concern for Netflix, but sadly "self-XSS" is real on Facebook. Not among us tech-savvy people obviously, so consider how much you look from inside a bubble. If people read of a "h4x0r trick to read their bf/gf private messages", they will execute it. And hey, "it has this l33t keyboard shortcut that will make a strange window pop up, it must be what the hackers in the movies use!!". And then "Oh well, thanks to this friend of mine for sharing this cool trick that gives me the stuff to paste there, I would not know how to use it!". And finally "Booooo, Facebook sucks, my account got hacked". I remember of the internet making fun of a girl that believed to be enrolled in some secret police because she popped up the Dev console. Well, that is just normal people, not uncommon. I trust that actual developer can find their way around blocks and warnings, that however raise the bar for social engineering.
- gcb0 13y ago
  right, because patching one of 1000 is the right solution? please give back your engineer card. - just download this file to see your gf private messages. ok, lets remove download from the browser (actually, ios did this) - just run this long string in the address bar to see whatever. ok, let prevent javascript: schema in url bar (actually, android stock browser did this) anyway you go at it, is ineffective. the only solution is to educate. trying to prevent idiots from harming themselves will just lead to annoyance to the non-idiots and more sophisticated attacks until you cant prevent them. people who implement those dumb thing disgusts me. your comment disgusted me.
  - cpayne 13y ago
    I understand that you disagree, but I can't see why you have to be rude about it.
    - gcb0 13y ago
      Sorry if offended too much. intended for just a little because that behavior is awful and must be treated as such. Also if you want to learn how to do it right, look at Mozilla. They mostly do the right thing. E.g. telling user and in extreme cases making him wait a very short time before accepting something that may be dangerous.
      - tantalor 13y ago
        In Comments Be civil. http://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html
  - userbinator 13y ago
    > the only solution is to educate. Exactly. The more things you do to restrict users so "it's safer for them", the more reckless and stupid they'll become - "because $security_feature will protect me" - and they won't ever learn anything. On the other hand, if we give them the freedom to make mistakes, those that do will learn from them. Instead of trying to block "self-XSS" or telling everyone "don't listen to anyone telling you to paste something into the URL bar", we should be encouraging them with "if you don't know what it does or don't trust the one who told you to do that, then don't do it - or find out what it really does." That last part is particularly important, since it encourages curiosity and that motivates learning. I understand that many people would just want to use something and not want to learn all that much, but I feel we should also not be encouraging this "lack of thought" mentality either.
    - brokenparser 13y ago
      See http://boardofwisdom.com/togo/Quotes/ShowQuote/?msgid=35154 http://boardofwisdom.com/togo/Quotes/ShowQuote/?msgid=35154
- rwaldron 13y ago
  If Facebook made use of smart OCAP practices, none of that would be possible. Use of object identity as a "security key" would prevent code that doesn't have access to the "key" object from being successful.
  - tantalor 13y ago
    What? What's OCAP? Object identity? How does that have to do with XSS? Links, references, sources?
  - comex 13y ago
    The developer console has access to everything the origin does. If the user can do it, the console can do it.
    - Drakim 13y ago
      Not necessarily, because you can limit how certain values can be accessed due to your scope. For JavaScript, if a key is saved in a variable inside an anonymous function, it's inaccessible for somebody who has a console that sits at the root of the document.
      - tantalor 13y ago
        document.getElementsByTagName('script')[0].innerText
        brokenparser 13y ago
        .innerText is an MSIE extension, .textContent is a DOM standard property.
      - chrisfarms 13y ago
        > fn = function(){ var key = "shhhhh" } > fn.toString() 'function (){ var key = "shhhhh" }' Nothing is sacred in JS.
- mfukar 13y ago
  So, is the best next step disabling the developer console "for security reasons"?
bsamuels 13y ago
I don't think they added the blocking script to actually keep people out. Rather, it makes more sense for them to add it so that if someone does debug their site, it gives Netflix a legal precedent to press charges against them for hacking their site by bypassing a security system.
- cpayne 13y ago
  So many times people forget the legal principal. It's like those tacky trailers at the start of a movie "pirating movies is illegal". First question the judge asks - what steps did you do to prevent pirating and when did you notify your customers.
  - peterwoo 13y ago
    Well, if true it's a surprising principal... Theaters have to inform their occupants that pirating is illegal? What case set that precedent?
    - manuletroll 13y ago
      He may have been referring to the trailers included in DVDs and such. But here in France I think we also have piracy warnings in theatres now. As usual, the customer is the victim.
    - Derpdiherp 13y ago
      Yes, here in the UK we have adverts before the movie, and messages that say "You may not record with any device", or something to that effect.
- peterwoo 13y ago
  By using developer consoles you're accessing to your own computer, and as long as you aren't circumventing DRM, or committing some other criminal act, it's not illegal. Not by my reading of the situation, but IANAL... What is the legal precedent to which you're referring? These companies lose more money to fraud in a quarter than they have ever lost due to people exporting their movie ratings, or whatever other non-criminal acts people have been committing at the console. I don't understand why we need to posit a 2nd (more sinister) motivation.
randartie 13y ago
> I don't believe for a second this is about helping the user - more likely is that FB and Netflix want to prevent users running scripts that add features How does that even make sense given that Facebook clearly gives the opt-out link which is easy to use, and works? I don't believe for a second that you aren't being completely cynical.
- gergles 13y ago
  If it was actually about helping the user, there wouldn't be an opt-out link, because the first instruction in the new "self-XSS" instructions is going to be "go to this page and opt-out - yeah, it says a bunch of scary bullshit but that's just because they don't want you to know about $feature!" The opt-out is there to boil the frog until they can remove it in the guise of "security". I also agree with bsamuels that it provides a convenient CFAA lever to hit in the event you do run a script they don't like. ("They had to deliberately bypass our 'protection' to paste the javascript into the console!")
  - peterwoo 13y ago
    None of that makes sense, at all. Asking targets to first go to the account->security settings to disable the option named "Allow my account to be hijacked if I paste malicious JavaScript", and then to paste this JavaScript, seems to me to be quite clearly less effective than the simpler "paste this JavaScript". Furthermore I strongly suspect that compromised accounts cause more harm to Facebook's bottom line than users who are exporting their address books. Millions lost every quarter due to fraud vs... what, exactly?
Houshalter 13y ago
Same thing happens in video games with anti-cheat systems.
Zak 13y ago
Facebook provides a link to disable this behavior in the message that appears when you try to use the console: https://www.facebook.com/selfxss https://www.facebook.com/selfxss Furthermore, a Facebook employee involved with the feature explained it on StackOverflow: http://stackoverflow.com/a/21693931/62628 http://stackoverflow.com/a/21693931/62628 It seems that users were being duped in to running malicious scripts that gave attackers control of their accounts. Sure, Facebook could be evil and not offer the option to re-enable the console and I'm sure other sites will do exactly that until browser makers prevent it, but at this time, Facebook is not being evil. I'm not sure about Netflix. If people are being successfully duped in to running malicious scripts this way, perhaps browser developers should put a first-run warning on the dev tools saying that running code there supplied by a third-party is dangerous.
joesmo 13y ago
It seems to me, it's just the laziness of the programmers working on the front end that leads to them needing this. The code should be designed with the idea that the end user will run arbitrary JS of all kinds. If it can't handle that without negative side effects, it has huge problems. I hope Chrome fixes this bug once and for all and takes steps to prevent overwriting window.console by user code.

by gergles 13y ago

FiloSottile 13y ago

I don't see exactly how it is a concern for Netflix, but sadly "self-XSS" is real on Facebook. Not among us tech-savvy people obviously, so consider how much you look from inside a bubble. If people read of a "h4x0r trick to read their bf/gf private messages", they will execute it. And hey, "it has this l33t keyboard shortcut that will make a strange window pop up, it must be what the hackers in the movies use!!". And then "Oh well, thanks to this friend of mine for sharing this cool trick that gives me the stuff to paste there, I would not know how to use it!". And finally "Booooo, Facebook sucks, my account got hacked". I remember of the internet making fun of a girl that believed to be enrolled in some secret police because she popped up the Dev console. Well, that is just normal people, not uncommon. I trust that actual developer can find their way around blocks and warnings, that however raise the bar for social engineering.

gcb0 13y ago
right, because patching one of 1000 is the right solution? please give back your engineer card. - just download this file to see your gf private messages. ok, lets remove download from the browser (actually, ios did this) - just run this long string in the address bar to see whatever. ok, let prevent javascript: schema in url bar (actually, android stock browser did this) anyway you go at it, is ineffective. the only solution is to educate. trying to prevent idiots from harming themselves will just lead to annoyance to the non-idiots and more sophisticated attacks until you cant prevent them. people who implement those dumb thing disgusts me. your comment disgusted me.
- cpayne 13y ago
  I understand that you disagree, but I can't see why you have to be rude about it.
  - gcb0 13y ago
    Sorry if offended too much. intended for just a little because that behavior is awful and must be treated as such. Also if you want to learn how to do it right, look at Mozilla. They mostly do the right thing. E.g. telling user and in extreme cases making him wait a very short time before accepting something that may be dangerous.
    - tantalor 13y ago
      In Comments Be civil. http://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html
- userbinator 13y ago
  > the only solution is to educate. Exactly. The more things you do to restrict users so "it's safer for them", the more reckless and stupid they'll become - "because $security_feature will protect me" - and they won't ever learn anything. On the other hand, if we give them the freedom to make mistakes, those that do will learn from them. Instead of trying to block "self-XSS" or telling everyone "don't listen to anyone telling you to paste something into the URL bar", we should be encouraging them with "if you don't know what it does or don't trust the one who told you to do that, then don't do it - or find out what it really does." That last part is particularly important, since it encourages curiosity and that motivates learning. I understand that many people would just want to use something and not want to learn all that much, but I feel we should also not be encouraging this "lack of thought" mentality either.
  - brokenparser 13y ago
    See http://boardofwisdom.com/togo/Quotes/ShowQuote/?msgid=35154 http://boardofwisdom.com/togo/Quotes/ShowQuote/?msgid=35154
rwaldron 13y ago
If Facebook made use of smart OCAP practices, none of that would be possible. Use of object identity as a "security key" would prevent code that doesn't have access to the "key" object from being successful.
- tantalor 13y ago
  What? What's OCAP? Object identity? How does that have to do with XSS? Links, references, sources?
- comex 13y ago
  The developer console has access to everything the origin does. If the user can do it, the console can do it.
  - Drakim 13y ago
    Not necessarily, because you can limit how certain values can be accessed due to your scope. For JavaScript, if a key is saved in a variable inside an anonymous function, it's inaccessible for somebody who has a console that sits at the root of the document.
    - tantalor 13y ago
      document.getElementsByTagName('script')[0].innerText
      - brokenparser 13y ago
        .innerText is an MSIE extension, .textContent is a DOM standard property.
    - chrisfarms 13y ago
      > fn = function(){ var key = "shhhhh" } > fn.toString() 'function (){ var key = "shhhhh" }' Nothing is sacred in JS.
mfukar 13y ago
So, is the best next step disabling the developer console "for security reasons"?

bsamuels 13y ago

I don't think they added the blocking script to actually keep people out. Rather, it makes more sense for them to add it so that if someone does debug their site, it gives Netflix a legal precedent to press charges against them for hacking their site by bypassing a security system.

cpayne 13y ago
So many times people forget the legal principal. It's like those tacky trailers at the start of a movie "pirating movies is illegal". First question the judge asks - what steps did you do to prevent pirating and when did you notify your customers.
- peterwoo 13y ago
  Well, if true it's a surprising principal... Theaters have to inform their occupants that pirating is illegal? What case set that precedent?
  - manuletroll 13y ago
    He may have been referring to the trailers included in DVDs and such. But here in France I think we also have piracy warnings in theatres now. As usual, the customer is the victim.
  - Derpdiherp 13y ago
    Yes, here in the UK we have adverts before the movie, and messages that say "You may not record with any device", or something to that effect.
peterwoo 13y ago
By using developer consoles you're accessing to your own computer, and as long as you aren't circumventing DRM, or committing some other criminal act, it's not illegal. Not by my reading of the situation, but IANAL... What is the legal precedent to which you're referring? These companies lose more money to fraud in a quarter than they have ever lost due to people exporting their movie ratings, or whatever other non-criminal acts people have been committing at the console. I don't understand why we need to posit a 2nd (more sinister) motivation.

randartie 13y ago

> I don't believe for a second this is about helping the user - more likely is that FB and Netflix want to prevent users running scripts that add features How does that even make sense given that Facebook clearly gives the opt-out link which is easy to use, and works? I don't believe for a second that you aren't being completely cynical.

gergles 13y ago
If it was actually about helping the user, there wouldn't be an opt-out link, because the first instruction in the new "self-XSS" instructions is going to be "go to this page and opt-out - yeah, it says a bunch of scary bullshit but that's just because they don't want you to know about $feature!" The opt-out is there to boil the frog until they can remove it in the guise of "security". I also agree with bsamuels that it provides a convenient CFAA lever to hit in the event you do run a script they don't like. ("They had to deliberately bypass our 'protection' to paste the javascript into the console!")
- peterwoo 13y ago
  None of that makes sense, at all. Asking targets to first go to the account->security settings to disable the option named "Allow my account to be hijacked if I paste malicious JavaScript", and then to paste this JavaScript, seems to me to be quite clearly less effective than the simpler "paste this JavaScript". Furthermore I strongly suspect that compromised accounts cause more harm to Facebook's bottom line than users who are exporting their address books. Millions lost every quarter due to fraud vs... what, exactly?

Houshalter 13y ago

Same thing happens in video games with anti-cheat systems.

Zak 13y ago

Facebook provides a link to disable this behavior in the message that appears when you try to use the console: https://www.facebook.com/selfxss https://www.facebook.com/selfxss Furthermore, a Facebook employee involved with the feature explained it on StackOverflow: http://stackoverflow.com/a/21693931/62628 http://stackoverflow.com/a/21693931/62628 It seems that users were being duped in to running malicious scripts that gave attackers control of their accounts. Sure, Facebook could be evil and not offer the option to re-enable the console and I'm sure other sites will do exactly that until browser makers prevent it, but at this time, Facebook is not being evil. I'm not sure about Netflix. If people are being successfully duped in to running malicious scripts this way, perhaps browser developers should put a first-run warning on the dev tools saying that running code there supplied by a third-party is dangerous.

joesmo 13y ago

It seems to me, it's just the laziness of the programmers working on the front end that leads to them needing this. The code should be designed with the idea that the end user will run arbitrary JS of all kinds. If it can't handle that without negative side effects, it has huge problems. I hope Chrome fixes this bug once and for all and takes steps to prevent overwriting window.console by user code.