zlacker

Please disable JavaScript to view this site

submitted by abused+(OP) on 2020-11-28 20:33:26 | 252 points 268 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
◧◩
5. teknop+e3[view] [source] [discussion] 2020-11-28 21:00:55
>>aftbit+K2
I see what you did there....

In other news, possibly the best designed website of 2020: http://www.muskfoundation.org/

◧◩◪
14. mtmail+74[view] [source] [discussion] 2020-11-28 21:07:32
>>teknop+e3
Similar a company with 250 billion USD revenue (2019) https://www.berkshirehathaway.com/
◧◩◪◨
19. s1k3s+z4[view] [source] [discussion] 2020-11-28 21:10:58
>>mtmail+74
"Reproduction or distribution of any materials obtained on this website or linking to this website without written permission is prohibited." https://www.berkshirehathaway.com/disclaimer.html

What? :)

◧◩
21. capabl+T4[view] [source] [discussion] 2020-11-28 21:13:30
>>usr110+34
> Can anybody recommend a tool to look what Javascript code loaded by a certain page is doing?

Open your browser's developer tools, go to the Script/Debugger tab and have at it. It's just about as obtuse to use as a tool as gdb, but you'll see exactly what it does. Chrome dev tools has automatic formatting of the code, maybe firefox too. But you'll be stuck with shitty variable names if they been mangled. Although you could try http://www.jsnice.org/, I had variable luck with using it.

It would be interesting to have a browser tool that is like strace and you could filter by calls, so you can see exactly where window.navigator is being used for example, or localStorage.setItem. For now best you can do is searching for "navigator" which works, but can be minified/hidden away by coder as well.

◧◩
32. patrec+N5[view] [source] [discussion] 2020-11-28 21:21:38
>>thex10+F3
You can assign a keyboard shorcut to that easily (I bound it to Cmd+Shift+J and find it super-handy):

https://support.apple.com/en-gb/guide/mac-help/mchlp2271/mac

If someone knows how to achieve the same on Linux for Chrome and Firefox, I'd love to hear it (browser plugins are a bit of a security and stability shitshow, so non-plugin solution would be preferred, all else being equal).

◧◩◪
44. usr110+57[view] [source] [discussion] 2020-11-28 21:32:32
>>teknop+e3
https://www.theguardian.com/technology/2019/jan/23/how-elon-...
65. userbi+2b[view] [source] 2020-11-28 22:11:00
>>abused+(OP)
As someone who has JS off by default for a long time (ever since I discovered how much it could remove annoyances, and this was back when SPAs were basically nonexistent) and is thus often subjected to "Please enable JS" messages which more likely than not will simply make me click the back button[1], I am delighted to see this exists --- I've thought of the idea before, but never did anything with it:

https://news.ycombinator.com/item?id=11411982

[1] I once enabled JS on a site that claimed it would provide "a better experience", and was bombarded with a bunch of ads and other irritations that just made me turn it off again. It was not a "better experience".

◧◩
67. userbi+lb[view] [source] [discussion] 2020-11-28 22:14:29
>>s1k3s+Z5
It logs requests to the site, which is far less invasive than the fine detail of browser fingerprinting and tracking that JS allows: JS can see your mouse pointer's position, how long you spent on each area of the page, which parts of the text you selected, and many many other things.

Things like this are seriously creepy: https://www.crazyegg.com/blog/mouse-recorder/

◧◩◪◨⬒
69. vulcan+vb[view] [source] [discussion] 2020-11-28 22:16:14
>>s1k3s+z4
From one of my previous comments in another thread (this past week, probably):

> IANAL

> What I think they mean by this is that you shouldn't link to resources on their website to make it seem like they endorse your (product, website, whatever).

https://news.ycombinator.com/item?id=25153873

◧◩◪◨⬒⬓⬔⧯
75. dane-p+0c[view] [source] [discussion] 2020-11-28 22:21:38
>>Spivak+f8
That's so crazy it might just work. I checked an article about copyright protection for short phrases[0] and learnt that a court ruled that the text “I may not be totally perfect, but parts of me are excellent” is protected by copyright. It would thus be possible for the author of that phrase to register:

i-may-not-be-totally-perfect-but-parts-of-me-are-excellent.com

and sue anyone who links to them. Hopefully the author will be so grateful for this insight that they won't sue me for reproducing their copyrighted work in this comment.

[0] https://fairuse.stanford.edu/2003/09/09/copyright_protection...

◧◩◪◨
96. KMnO4+hk[view] [source] [discussion] 2020-11-28 23:40:21
>>userbi+Fb
Please take a seat before clicking this. And yes, it is still actively used by Walgreens.

https://webapp.walgreens.com/SupplierNet/login.htm

◧◩◪
98. Capric+Lk[view] [source] [discussion] 2020-11-28 23:45:09
>>userbi+lb
You can implement similar mouse recording via requests for :hover psuedoelements in CSS. Also, I’m not sure you need JS to get fine fingerprinting and tracking in 2020— https://wiki.mozilla.org/Fingerprinting
◧◩◪◨⬒⬓
101. gruez+ol[view] [source] [discussion] 2020-11-28 23:50:50
>>wrboyc+Fh
TCP packets contain sequence numbers that must correspond to the ones sent by the other side. This is an issue if you're spoofing packets because you don't receive packets (containing the sequence numbers) from the other side (they will go to the spoofed address, rather than yours). Without the other side's sequence numbers, your replies will be considered invalid, which means you can't complete the handshake[1] to establish a connection. However, if you can successfully guess the sequence numbers, you can complete the handshake and also write arbitrary data to the stream. You still won't be able to receive data, but for simple protocols like irc, it can still be useful eg. connecting to a server and then sending spam to an user/channel.

[1] https://en.wikipedia.org/wiki/Transmission_Control_Protocol#...

◧◩
103. tyingq+nm[view] [source] [discussion] 2020-11-28 23:59:46
>>drusep+Fl
Sure: https://imgur.com/a/xm2YX36
◧◩◪◨
146. shadow+nw[view] [source] [discussion] 2020-11-29 01:55:08
>>intras+Dt
Not sure if this solves your entire problem, but you can disable all content blockers for any sit in Safari for iOS[1].

[1]: https://www.macrumors.com/how-to/disable-content-blockers-sa...

◧◩◪◨⬒
157. astura+nx[view] [source] [discussion] 2020-11-29 02:06:14
>>ciaran+So
Geico is a BH company.

https://www.berkshirehathaway.com/subs/sublinks.html

◧◩◪
160. jolux+Ix[view] [source] [discussion] 2020-11-29 02:11:18
>>matheu+4x
The cost-benefit analysis of JavaScript usage comes down on the side of enabling it for most people, because of how much of the web is completely broken without it. Sandbox escapes are rare but extremely valuable, and they absolutely exist: https://www.computerworld.com/article/3186686/google-patches...
165. coucha+Cz[view] [source] 2020-11-29 02:34:31
>>abused+(OP)
It's worth noting that this is the personal website of Heydon Pickering, a prolific (and opinionated!) writer and speaker on web design. He's the force behind Inclusive Components [0] and half of Every Layout [1].

Watch his videos. Check out his articles on A List Apart and in Smashing Magazine, among others. Pay attention, he's very thoughtful and you'll probably learn a lot.

0: http://book.inclusive-components.design/

1: https://every-layout.dev/

◧◩
168. Arnavi+Qz[view] [source] [discussion] 2020-11-29 02:36:59
>>enw+Yv
Depends on what you mean by "dynamic". Some "do something when the user clicks"-style things can be done with CSS. The best example I know of that is https://git-send-email.io/
169. JBiser+fA[view] [source] 2020-11-29 02:43:07
>>abused+(OP)
I wanted to read the source, but it was all on 1 line, so I fed it to https://validator.w3.org/nu/?doc=https%3A%2F%2Fheydonworks.c...
◧◩◪◨⬒
170. movedx+wA[view] [source] [discussion] 2020-11-29 02:46:48
>>sicrom+px
https://brave.com/
◧◩◪◨⬒⬓
172. judge2+IB[view] [source] [discussion] 2020-11-29 03:07:53
>>movedx+wA
In case the OP wanted to know exactly how Brave's adblock is different from uBlock Origin instead of a link to the marketing page with links to other things like cryptocurrencies:

Brave's browser claims a speedup over AdBlock plus, but was inspired by UBO, so the performance is fairly similar, but is baked into the browser instead of being an extension.

> We therefore rebuilt our ad-blocker taking inspiration from uBlock Origin and Ghostery’s ad-blocker approach.

https://brave.com/improved-ad-blocker-performance/

◧◩◪◨
190. Arnavi+eG[view] [source] [discussion] 2020-11-29 04:29:31
>>wuuza+UF
For a uM rule like:

    foo.com bar.com css allow
which means "allow foo.com to fetch css from bar.com", the corresponding uBO static rule is:

    @@||bar.com^$domain=foo.com,css,allow
The full list of things that can be allow/block'd by uBO is at https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#...

I have a "block everything by default" rule at the top that's:

    *$css,font,frame,media,object,ping,script,websocket,xhr
    *$image,redirect=1x1.gif
    *$csp=worker-src 'none'
    @@*$1p,css,frame,image
which means:

1. Block a bunch of things by default.

2. Block images by replacing them with the built-in 1x1 GIF instead of canceling the request.

3. Disable web workers by setting the CSP worker-src.

4. Override the previous rules by allowing first-party CSS, frames and images. (The @@ means it's an override rule.)

(The fact that my default is to block everything is why the first example I gave above starts with @@ too.)

Web workers can be allowed on a per-site basis by overriding the csp directive with a reset:

    @@||foo.com^$csp
Lastly, I have a dynamic rule to allow `<noscript>` tags to be rendered:

    no-scripting: * true
Then, for every static rule where I enable JS for a domain, I add a corresponding `no-scripting: $domain false` in the dynamic rules.

It's annoying to have to move between static and dynamic rules when deciding to enable JS on a site, but I'm not sure there's a better way. Neither static nor dynamic rules individually support everything that uM could do - static rules can't block inline JS nor render `<noscript>` content, and dynamic rules can't block every kind of request.

Static rules are also nice in that you can have empty lines and comments and arbitrary ordering of your rules, so it's easier to group rules in sections based on the domain names, add comments, etc. Dynamic rules however are like uM's rules and are forced to be sorted by domain name with no empty lines or comments.

195. marksm+QH[view] [source] 2020-11-29 04:58:25
>>abused+(OP)
A small snippet to add to your nojs sites. https://ghostbin.com/paste/kupyj

Shows a banner "You Don't Need JavaScript to Run This Site (turn it off here)"

It's a response to all the "You Need JavaScript to Run This Site" banners we see everywhere even on plain text/image sites.

◧◩◪◨⬒⬓⬔⧯▣
199. vortic+hK[view] [source] [discussion] 2020-11-29 05:37:18
>>steelb+xI
Is that's the new algorithm that made the rust rewrite x69 faster

>The new algorithm with optimised set of rules is 69x faster on average than the current engine.

https://brave.com/improved-ad-blocker-performance/

◧◩
209. g5095+pM[view] [source] [discussion] 2020-11-29 06:16:31
>>g5095+hM
currently exploring view-source:https://heydonworks.com/ by deconstructing the rendered source and injecting the output back into the body..
◧◩◪◨⬒⬓⬔
225. livre+Ra1[view] [source] [discussion] 2020-11-29 12:38:11
>>FlashB+mL
If the default annoyances lists aren't enough for you you can also add this one[1]

[1] https://github.com/yourduskquibbles/webannoyances

◧◩
234. IfOnly+cl1[view] [source] [discussion] 2020-11-29 15:02:59
>>CodeWr+c4
The microdictator is amused: https://twitter.com/heydonworks/status/1333058648365535235
252. outlou+pY2[view] [source] 2020-11-30 08:16:26
>>abused+(OP)
Worth mentioning: Twitter legacy, which does not require Javascript, will be shutting down in 15 days.

https://news.ycombinator.com/item?id=25088561

◧◩
254. daniel+eY3[view] [source] [discussion] 2020-11-30 16:34:00
>>g5095+hM
This must be the most unnecessarily awkward way of doing it (have to do it from the console after navigating to the site, so the request is allowed).

    fetch("https://heydonworks.com").then(x => x.text()).then(x => { 
      var f = document.createElement("iframe"); 
      document.body.append(f); 
      f.style.left = "0px";
      f.style.top = "0px";
      f.style.width = "100%";
      f.style.height = "100%";
      f.style.position = "absolute"; 
      f.style.border = 0;
      x = x.replace(/\<\/?noscript\>/gi, ""); 
      x = x.replace(/\<script\>.*\<\/script\>/gi, ""); 
      f.contentDocument.write(x); 
    });
◧◩
259. labawi+kL4[view] [source] [discussion] 2020-11-30 20:34:24
>>daniel+yZ3
There seem to be a HTTP header[1] you could use. No icon though. And I'm not sure how much the restriction could be evaded by interactive Turing-complete CSS or similar features.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

◧◩◪◨⬒⬓
262. shadow+Pg5[view] [source] [discussion] 2020-11-30 23:48:21
>>intras+od5
No clue on that one, sorry. I’ve been using Purify[1] for ages, but have no clue if it blocks JS - I suspect it blocks only some JS, because my experience of the web isn’t trash while using it, but I do have to disable it sometimes to use the heavily animated navigation systems that some sites implement.

[1]: https://apps.apple.com/us/app/purify-block-ads-and-tracking/...

[go to top]