Live data from Hacker News

Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

zdnet.com

71–80 of 82 posts

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#71
post #68
post #57

Earlier quoted context omitted.

11.2.1. But I guess in tech, that's the wild-west stone age where you couldn't expect a browser not to be taken over by a site ...

Why the negativity? Software is fluid and never perfect. And specially the fight between browsers and malicious sites won't stop at any time ... At least they recognized the problem and acted on it.

The fact that a modal could ever block my ability to close the tab was a hard mistake to make.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#72

> this issue has gone unfixed, for unknown reasons The reason is just that no-one has thought it important enough to fix, and/or no-one has been able to get sufficient agreement on what the correct fix is. Let's not pretend there's a mystery.

Clearly, in the eyes of browser developers basic UI is far less important than 3d rendering, web assembly, progressive API and other features used by .000001% of all websites.

AFAIK, there are still no usable built-in date pickers or upload controls.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#73

Earlier quoted context omitted.

Also such sites sometimes play audio instructions trying to scare or deceive a user.

I've had relatives tricked by this and called the number for "Microsoft Support." They were using Chrome. Clicking on the browser outside of the page area resulted in the tab going full screen again somehow, and they used multiple other tricks to make the page impossible to close (e.g. looping message boxes). I don't think browser vendors take these issues very easy. But when I tell relatives to hit the escape key an…

Also, Escape key won't work if you had pressed F11 to switch to a fullscreen mode. Furthermore, browsers like Opera remember this setting and restore fullscreen mode (along with the page content) even after restart. I saw a case when a user somehow has opened a page with ads in fullscreen mode (probably it was done for watching a movie) and it was restored even after exiting and restarting the browser. So I killed the browser with Task Manager, restarted it and the fullscreen ads appeared again.

I (an experienced user) couldn't quickly figure out that it was actually a fullscreen mode, couldn't understand why the browser doesn't launch and thought it was some kind of virus in the system. I figured it out only when I tried to move mouse upwards and a browser UI appeared.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#74
post #72

> this issue has gone unfixed, for unknown reasons The reason is just that no-one has thought it important enough to fix, and/or no-one has been able to get sufficient agreement on what the correct fix is. Let's not pretend there's a mystery.

Clearly, in the eyes of browser developers basic UI is far less important than 3d rendering, web assembly, progressive API and other features used by .000001% of all websites. AFAIK, there are still no usable built-in date pickers or upload controls.

Firefox has built in date pickers now, built in upload controls I have never seen, got an example?

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#75

Earlier quoted context omitted.

And yet issues that affect advertising revenue on Youtube get fixed same day.

Something like 80-90% of their revenue comes from Google. Their higher-ups can spin it all day, but they know damn well their jobs depend on a good relationship with Google.

Or even indirectly, the YouTube team might choose to instead send them an IE6-era experience of YouTube instead of the current one to avoid the bug, which might push users away from Firefox.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#76
post #17

Earlier quoted context omitted.

Yet another reason to do it -- so that bug reports about websites not working without Javascript are taken seriously, and fixed.

Or they'll continue to be ignored, because they're not bugs with the website.

It's a bug with the website as long as users start looking for alternatives. That's why there needs to be a lot of advocacy.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#77
post #72

Earlier quoted context omitted.

Clearly, in the eyes of browser developers basic UI is far less important than 3d rendering, web assembly, progressive API and other features used by .000001% of all websites. AFAIK, there are still no usable built-in date pickers or upload controls.

Firefox has built in date pickers now, built in upload controls I have never seen, got an example?

The built-in datepicker has so many issues (from immutable styling to the format it uses to basic usability), no serious website will ever use it.

As far as uploads, no large website ever uses the default ones. All of them roll their own using JavaScript APIs. The most popular example is probably Gmail attachments.

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#79
Or how about sites like the one where this article actually appeared (zdnet) making it very difficult (some are impossible) to use the back button? I clicked the article on HN, read it on zdn, and had to hit "back" about 10 times to get back to HN, which was the "previous page visited."

Re: Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

#80

One of the sites opened fullscreen mode to hide browser UI. Note that currently web browser developers are implementing a fullscreen mode with keyboard lock that is much harder to leave because it blocks most of system key combinations: [1]. The only keys that will still work are Ctrl + Alt + Del or holding an Esc for two seconds. And as I assume you cannot leave it using mouse or touchpad. Another problem is that br…

Note that this proposal is still in Editors Draft (meaning it hasn't even been proposed as a Working Draft yet, they're still in the process of writing the initial proposal). It could very well be rejected, and I hope it is.

It's being championed by the Chromium team, and just because Chromium has turned something on doesn't mean it's a standard. It just means that Chromium doesn't know how to properly launch experimental browser settings behind user flags, because apparently we've all learned literally nothing from the early days of browser-specific CSS tags and the botched release of flexbox.

Remember HTML imports, Observable, etc... there's still plenty of time to file issues[0] and participate in conversation about the feature[1]. And I encourage you to do so, because speaking as a game developer on the web, this is a bad feature that shouldn't be built.

[0]: https://github.com/w3c/keyboard-lock/issues

[1]: https://discourse.wicg.io/t/proposal-system-keyboard-lock-ap...

Post reply on HN