Live data from Hacker News

Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

zdnet.com

31–40 of 82 posts

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#31
post #25

Earlier quoted context omitted.

When was the last time they revamped the UI? Honestly cannot remember.

they changed it this year didn't they? Weren't people making jokes that now firefox is square and chrome is round?

Right, had forgotten about that. Was thinking about more substantive changes like Australis though, the look of tab corners seem pretty trivial.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#32

Earlier quoted context omitted.

I'd like Firefox to stop focusing on revamping the user interface every five minutes, that's all. Might be a start.

When was the last time they revamped the UI? Honestly cannot remember.

It's still horrible. #1 reason I don't like FF.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#33

The bigger problem is that a authentication dialog is a window modal, which makes the entire browser inoperative. If it wasn’t for this, you could simply close the tab with the malicious site. This broader issue is reported on the bug #123913, which is 17 years old. The bug is old enough to drive.

> The bug is old enough to drive.

Where I'm from it can't drive, but it's been old enough to drink for a while now !

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#34

> this issue has gone unfixed, for unknown reasons The reason is just that no-one has thought it important enough to fix, and/or no-one has been able to get sufficient agreement on what the correct fix is. Let's not pretend there's a mystery.

And yet issues that affect advertising revenue on Youtube get fixed same day.

Something like 80-90% of their revenue comes from Google. Their higher-ups can spin it all day, but they know damn well their jobs depend on a good relationship with Google.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#35

Why does nobody target the root cause? The possibility to show popups and popovers in browsers should be removed completely. There are little to no legit uses for them. Even reputable websites use them only to nag and annoy their users. And don't get me started about Javascript. This is a plague, that causes more problems than it solves.

This is an absurd overreaction. Popovers are CSS. Just a positioned element. And both up-and-overs are "legitimately" used as modals in apps.

I think these are using alert rather than modals. Alert is pretty awful.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#36

Earlier quoted context omitted.

Having spent a couple of years working for tech support for a large retail chain, I can confirm that this happens much more often than you might think. Non-technical users are floored the browser locking up, especially if the site starts to do something alarming like play an audio file telling them their computer is infected. If they were lucky and brought it to me in that state, I'd teach them about their task manag…

Some pretty good examples of different scammer scripts, of a wide variety, from a guy who has made a hobby out of trolling them: https://www.youtube.com/channel/UCm22FAXZMw1BaWeFszZxUKw/vid...

You should see The Hoax Hotel. Much more amusing!

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#37

I thought this was a solved problem in most web browsers. Just show a nonmodal dialog for popups like in safari and chrome.

>Just show a nonmodal dialog for popups like [...] chrome.

But in some cases, Chrome has modal dialog popups that Firefox does not. I made a previous comment about this and you can test that behavior on a safe site like regex101.com:

https://news.ycombinator.com/item?id=17046268

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#38
post #17

Earlier quoted context omitted.

Not allowing JavaScript turns into a chore when you find out that websites break in non obvious ways. I do not want to manually enable/disable JavaScript when the browser is a means to an end for me.

Yet another reason to do it -- so that bug reports about websites not working without Javascript are taken seriously, and fixed.

Or they'll continue to be ignored, because they're not bugs with the website.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#39
This has been something that irritates me. If I want to copy a password for a site in another tab. Oh look I can't. This isn't just a stupid bug, it's terrible UX. I have to open either another Firefox window, or another browser entirely (better safe than sorry!) in order to find that password for a site that didn't intend to hijack focus for the login screen.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#40
One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad.

Another problem is that browsers are tol complicated. Building Firefox from source requires you to have a powerful machine with multicore CPU and lot of memory and comilation would take a lot of time. This could stop people from contributing fixes.

[1] https://www.chromestatus.com/feature/5642959835889664

Post reply on HN