Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

zdnet.com

Post reply on HN
Print view View original

21–30 of 82 posts

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#21

Post by hrktb »

ori_b wrote: post #17
ryanmccullagh wrote: post #6

Earlier quoted context omitted.

Not allowing JavaScript turns into a chore when you find out that websites break in non obvious ways. I do not want to manually enable/disable JavaScript when the browser is a means to an end for me.

Yet another reason to do it -- so that bug reports about websites not working without Javascript are taken seriously, and fixed.

On a previous job, we had a “be a one day support desk” mandatory training, but I took only months after I entered.

One of the funny discoveries was supported platforms and setup bugs are filtered very fast and just flagged as such.

The only monitoring was the up or down trends for that kind of complaints. It includes people on IE6, those using their fridge browser to open the site, or apps that showed the site under some broken in app browser. So people blocking javascript are just a drop in that global number, and if the number is mostly constant it just won’t matter what happens in it and reports won’t even get to the devs.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#22

Post by pragmatick »

rubatuga wrote: post #13

I thought this was a solved problem in most web browsers. Just show a nonmodal dialog for popups like in safari and chrome.

The solution is simple and there are other problems with having a modal dialog (I can't think of many dialogs that should be modal when they only affect one tab). For example if you want to lookup a password for the dialog you have to open a new window.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#23

Post by tgsovlerkhgsel »

pmoriarty wrote: post #2

Yet another reason to use an extension like uMatrix to disallow javascript by default, and only allow the absolute minimum that sites you trust need to function.

If you're a power user, this kind of "can't leave me" sites are a rare and minor annoyance - you know that they're sandboxed and can't do anything bad unless you allow it, and you'll have it cleaned up WAY faster than the time you'd have spent managing JS exceptions and debugging sites that broke in non-obvious ways.

And if you're setting a computer up for a non-poweruser, you can't deploy uMatrix because you really can't expect the user to do said debugging.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#24

Post by nikbackm »

zapzupnz wrote: post #11
microcolonel wrote: post #8

I say it every time that people say "Firefox is great now!". Just look at the Bugzilla, and tell me that among the thousands of reports (many of which have gone untriaged for around a decade!) there aren't at least a handful of serious issues like this. One, among many, of the reasons I use Chromium is that I see reports taken absolutely seriously, especially any report with any potential security outcome. Even seemi…

I'd like Firefox to stop focusing on revamping the user interface every five minutes, that's all. Might be a start.

When was the last time they revamped the UI? Honestly cannot remember.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#25

Post by jgh »

nikbackm wrote: post #24
zapzupnz wrote: post #11

Earlier quoted context omitted.

I'd like Firefox to stop focusing on revamping the user interface every five minutes, that's all. Might be a start.

When was the last time they revamped the UI? Honestly cannot remember.

they changed it this year didn't they? Weren't people making jokes that now firefox is square and chrome is round?

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#26

Post by Uhrheber »

Why does nobody target the root cause?

The possibility to show popups and popovers in browsers should be removed completely. There are little to no legit uses for them. Even reputable websites use them only to nag and annoy their users.

And don't get me started about Javascript. This is a plague, that causes more problems than it solves.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#27

Post by oliwarner »

Uhrheber wrote: post #26

Why does nobody target the root cause? The possibility to show popups and popovers in browsers should be removed completely. There are little to no legit uses for them. Even reputable websites use them only to nag and annoy their users. And don't get me started about Javascript. This is a plague, that causes more problems than it solves.

This is an absurd overreaction.

Popovers are CSS. Just a positioned element. And both up-and-overs are "legitimately" used as modals in apps.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#28

Post by gregknicholson »

> this issue has gone unfixed, for unknown reasons

The reason is just that no-one has thought it important enough to fix, and/or no-one has been able to get sufficient agreement on what the correct fix is. Let's not pretend there's a mystery.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#29

Post by throwaway12iii »

gregknicholson wrote: post #28

> this issue has gone unfixed, for unknown reasons The reason is just that no-one has thought it important enough to fix, and/or no-one has been able to get sufficient agreement on what the correct fix is. Let's not pretend there's a mystery.

And yet issues that affect advertising revenue on Youtube get fixed same day.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#30

Post by danillonunes »

The bigger problem is that a authentication dialog is a window modal, which makes the entire browser inoperative. If it wasn’t for this, you could simply close the tab with the malicious site.

This broader issue is reported on the bug #123913, which is 17 years old. The bug is old enough to drive.

Post reply on HN