Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

zdnet.com

Post reply on HN
Print view View original

41–50 of 82 posts

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#41

Post by pengod »

gregknicholson wrote: post #28

> this issue has gone unfixed, for unknown reasons The reason is just that no-one has thought it important enough to fix, and/or no-one has been able to get sufficient agreement on what the correct fix is. Let's not pretend there's a mystery.

In my experience with Firefox devs, if it's not important enough to fix immediately, bugs will simply be closed and ignored. I've come across other bugs that exist for 10 years (not security related) which were closed again each time they were brought up every few years.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#42

Post by yborg »

nikbackm wrote: post #24
zapzupnz wrote: post #11

Earlier quoted context omitted.

I'd like Firefox to stop focusing on revamping the user interface every five minutes, that's all. Might be a start.

When was the last time they revamped the UI? Honestly cannot remember.

65 merges the tab and titlebar into a unified CSS element because your tabs are on top now, too bad.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#43

Post by Santosh83 »

codedokode wrote: post #40

One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. Another problem is that br…

> Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad.

What possible justification is there for this? Looks like this can become an ideal way to 'force' unsuspecting users to interact with a malicious site...

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#44

Post by Frondo »

Uhrheber wrote: post #26

Why does nobody target the root cause? The possibility to show popups and popovers in browsers should be removed completely. There are little to no legit uses for them. Even reputable websites use them only to nag and annoy their users. And don't get me started about Javascript. This is a plague, that causes more problems than it solves.

What gets me, and makes me sad, is how javascript-enabled browsers (and really the magic happened with IE and its XMLHttpRequest) are clearly addressing a need the vast majority of the computing world has: running applications simply (without installing, because that's been made complicated) and with a reasonable expectation of security (sandboxed).

For all the time browsers have been providing this, no one's ever come even close to a good alternative.

That's why the JS-powered browsing experience will never go away, there's nothing like it for how people actually use computers now.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#45

Post by SilasX »

danillonunes wrote: post #30

The bigger problem is that a authentication dialog is a window modal, which makes the entire browser inoperative. If it wasn’t for this, you could simply close the tab with the malicious site. This broader issue is reported on the bug #123913, which is 17 years old. The bug is old enough to drive.

Not to defend Mozilla's inability to prioritize, but ...

Isn't that a common issue across browsers? I know on iOS, I get burned by shady sites on Safari that do redirects and pop up a browser-level modal that somehow stops me from closing the tab until I turn off Javascript and restart the browser.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#47

Post by e40 »

SilasX wrote: post #46

Ironically enough, when I go to that site, I immediately (feel like I) lose control of the browser because it pops up the "do you want to allow notifications on this site" which stops me from scrolling down on the keyboard.

With uBlock Origin and uMatrix it looks extremely clean to me.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#48

Post by SilasX »

e40 wrote: post #47
SilasX wrote: post #46

Ironically enough, when I go to that site, I immediately (feel like I) lose control of the browser because it pops up the "do you want to allow notifications on this site" which stops me from scrolling down on the keyboard.

With uBlock Origin and uMatrix it looks extremely clean to me.

I wasn't complaining about the bloat (already have uBlock), I think I just need to turn off requests for notifications. (Or even better, have intermediate option where I can be aware that it wants to send me notifications, but where it doesn't take the focus off and interfere with my plugins like Vimium.)

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#49

Post by zeveb »

ryanmccullagh wrote: post #6
pmoriarty wrote: post #2

Yet another reason to use an extension like uMatrix to disallow javascript by default, and only allow the absolute minimum that sites you trust need to function.

Not allowing JavaScript turns into a chore when you find out that websites break in non obvious ways. I do not want to manually enable/disable JavaScript when the browser is a means to an end for me.

That's why I'd like to suggest a three-phase solution: the first phase is advocating for using JavaScript for progressive enhancement only; the second phase is a JavaScript blocker; the third phase is using three-phase power to deliver mild electrical shocks to web developers who abuse JavaScript.

Seriously, though, you're right — and every time I'm forced to enable a new JavaScript source in uMatrix, I'm angered at the site which requires it. In some cases, I just don't even bother using such sites — why buy something from someone who respects neither me nor the Web enough to provide a usable site without tons of JavaScript?

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#50

Post by st3fan »

SilasX wrote: post #45
danillonunes wrote: post #30

The bigger problem is that a authentication dialog is a window modal, which makes the entire browser inoperative. If it wasn’t for this, you could simply close the tab with the malicious site. This broader issue is reported on the bug #123913, which is 17 years old. The bug is old enough to drive.

Not to defend Mozilla's inability to prioritize , but ... Isn't that a common issue across browsers? I know on iOS, I get burned by shady sites on Safari that do redirects and pop up a browser-level modal that somehow stops me from closing the tab until I turn off Javascript and restart the browser.

That must be on an older iOS version? Pretty sure that on recent versions the modal dialogs are actually not modal anymore and are rendered 'in content'. So you can always close the tab.
Post reply on HN