Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please disable JavaScript to view this site

heydonworks.com

Post reply on HN
Print view View original

101–110 of 281 posts

Re: Please disable JavaScript to view this site

#101

Post by CapriciousCptl »

userbinator wrote: post #69
s1k3s wrote: post #35

This website does not track you . Correction -> This website does not track you via JS. You have no idea what's logged on the backend.

It logs requests to the site, which is far less invasive than the fine detail of browser fingerprinting and tracking that JS allows: JS can see your mouse pointer's position, how long you spent on each area of the page, which parts of the text you selected, and many many other things. Things like this are seriously creepy: https://www.crazyegg.com/blog/mouse-recorder/

You can implement similar mouse recording via requests for :hover psuedoelements in CSS. Also, I’m not sure you need JS to get fine fingerprinting and tracking in 2020— https://wiki.mozilla.org/Fingerprinting

Re: Please disable JavaScript to view this site

#104

Post by gruez »

wrboyce wrote: post #91
deckard1 wrote: post #90

Earlier quoted context omitted.

back in the '90s I was into connecting to IRC servers using spoofed IP addresses. The way it worked is you told the software what OS you were connecting to (or it would figure it out itself, I can't recall). Each OS had a unique way of generating TCP sequence numbers, which allowed the software to guess which number would come next. Nowadays OSes have protection for this sort of thing. But I'd imagine you could still…

How are you going from guessing TCP sequences to spoofing IP addresses on TCP connections? Did you breeze over a step or am I missing something obvious?

TCP packets contain sequence numbers that must correspond to the ones sent by the other side. This is an issue if you're spoofing packets because you don't receive packets (containing the sequence numbers) from the other side (they will go to the spoofed address, rather than yours). Without the other side's sequence numbers, your replies will be considered invalid, which means you can't complete the handshake[1] to establish a connection. However, if you can successfully guess the sequence numbers, you can complete the handshake and also write arbitrary data to the stream. You still won't be able to receive data, but for simple protocols like irc, it can still be useful eg. connecting to a server and then sending spam to an user/channel.

[1] https://en.wikipedia.org/wiki/Transmission_Control_Protocol#...

Re: Please disable JavaScript to view this site

#108

Post by mhh__ »

syx wrote: post #51
Zebfross wrote: post #5

I prefer making all my sites work just as well without JavaScript as with it. This is cool though if you need a quick check to see if JavaScript is enabled.

In which occasion a software ootb like a browser won’t have JavaScript enabled? I’m genuinely curious, the only time I saw something like this was using the distro Kali having no script in Firefox.

I sometimes read HN in a text web-browser, but ultimately most people will have JavaScript enabled.

It's worth saying that most people don't even know what Javascript is, full stop. Weirdly enough my now mother does, but my younger sister doesn't - we now have a generation that has effectively grown-up post-smartphone, which is fascinating to me.

Re: Please disable JavaScript to view this site

#109

Post by setgree »

I am not a developer, and I learned how to disable JavaScript in Chrome to read this site, out of curiosity. I then checked a few other sites and learned

* Washington Post no longer has a paywall

* anandtech.com is seemingly unaffected, but tomshardware.com is very different (and less pushy)

* SoundCloud says "Oh no! | JavaScript is disabled | You need to enable JavaScript to use SoundCloud"

* nationalreview.com is broken -- I can only read a few paragraphs in a NR PLUS story, and there's no way to keep scrolling (I can read the article fine in another tab)

* An article I co-wrote, published in a Cambridge University Press journal, is now sans tables and figures, but the console reports no errors or exceptions.

An interesting experiment! Overall, it seems my internet experience is better without JS (but reading an academic article online is way worse).

Re: Please disable JavaScript to view this site

#110

Post by forgotmypw17 »

syx wrote: post #51
Zebfross wrote: post #5

I prefer making all my sites work just as well without JavaScript as with it. This is cool though if you need a quick check to see if JavaScript is enabled.

In which occasion a software ootb like a browser won’t have JavaScript enabled? I’m genuinely curious, the only time I saw something like this was using the distro Kali having no script in Firefox.

lynx

links

w3m

that's just off the top of my head.

Post reply on HN