Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium: Permit blocking of view-source: with URLBlocklist

chromium-review.googlesource.com

Post reply on HN
Print view View original

41–50 of 136 posts

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#41

Post by judge2020 »

josephcsible wrote: post #34
jsnell wrote: post #19

Earlier quoted context omitted.

I don't think your theory fits the facts... The bug is from 2018, and was fixed three years later. So it doesn't seem like there was any kind of special prioritization going on here. It was also fixed by a person working at Microsoft, not by somebody at Google.

I think the point that was if anyone but Google wanted this, it'd get laughed all the way to WONTFIX.

As shown in the changelog, the bug was filed by a user @amplifiedit.com, and was seen as a worthwhile bug to fix by Brian Malcolm "Taking ownership as the client team in BVE will work on this item"[0]; however, it was stalled for nearly 3 years until Eric submitted a patch for it[1]. While Google thinks it's worthwhile to fix, Microsoft is trying to have a faster-than-usual rise in adoption for their new Edge which is based on Chromium, so that means fixing as many things as possible that their business/EDU customers complain about.

BTW Google already allowed MDM (device) admins to disable devtools, but everyone involved in the issue also wanted it to disable view-source since it allowed students to look at the HTML.

0: https://bugs.chromium.org/p/chromium/issues/detail?id=895462...

1: https://bugs.chromium.org/p/chromium/issues/detail?id=895462...

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#43

Post by NationOfJoe »

ericpauley wrote: post #14

Seems like there are more ways to get past this, such as a javascript bookmarklet that extracts and displays page source.

This was my first thought as well. StackOverflow to the rescue https://stackoverflow.com/questions/9968680/view-source-book...

my next step was to look at the chromium bug tracker and apparently that was "fixed" in 2019. weather it still is or not, i don't know. https://chromium.googlesource.com/chromium/src.git/+/ccda1d8...

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#44

Post by jsnell »

josephcsible wrote: post #34
jsnell wrote: post #19

Earlier quoted context omitted.

I don't think your theory fits the facts... The bug is from 2018, and was fixed three years later. So it doesn't seem like there was any kind of special prioritization going on here. It was also fixed by a person working at Microsoft, not by somebody at Google.

I think the point that was if anyone but Google wanted this, it'd get laughed all the way to WONTFIX.

Yes, I understand that's that was the point. But again, Google clearly didn't actually particularly want this since nobody from that company actually worked on this bug during the three years it was open.

Your suggestion seems equally invalid. The Chromium bug tracker currently has about 9k open feature requests. A lot of them are more niche than this, have no indication on the bug that they're relevant to Google, and have still not been closed as WONTFIX.

So it really was not a valid point to start with, and I don't understand why you're doubling down on it like that.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#45

Post by em-bee »

BarryMilo wrote: post #35
ashwoods wrote: post #32

Wouldn’t this easily be circumvented by creating a website that shows you the source of any other website?

This is hilarious, though it would likely only show you the public version of a page, so a basic login feature would "protect" against that. Unless people are willing to give their credentials to such a website, then I suppose it might become an arms race of sorts.

i was thinking of all sorts of ways how a testing platform could prevent this workaround. but then i realized that with the same effort they could just prevent answers showing up in the source...

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#46

Post by ericlaw »

To answer a few questions here:

1. I landed this fix because there was a policy that did not work properly. We could instead document that the URLBlocklist policy works for every scheme but one, or we could fix it. Fixing it makes more sense.

2. This policy only can be set on managed machines.

3. This policy, in isolation, is trivially circumvented. Managed environments block many things, including many of the proposed circumventions here.

4. I've built one of the world's most popular tools for viewing and modifying web traffic. The narrative that this feature has broad implications for anything is absurd.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#47

Post by selcuka »

crakenzak wrote: post #2

What are the implications of this? Can’t you just curl/wget the html?

You have to be logged in to Google to use Google Forms. You can emulate a login using curl/wget but it's harder.

You could also install another browser if that was allowed.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#48

Post by oh_sigh »

SamBam wrote: post #20
yjftsjthsd-h wrote: post #17

Earlier quoted context omitted.

That feels like some hardcore X Y problem.

Dear StackOverflow, students keep cheating by looking at the page source and finding the multiple choice option with the id "correct-answer". How do I add a new feature to Chromium, submit a pull request to Google, get it past their various layers of checks and policies, and mandate that all schools use this new option?

Enterprise admins can set a wide variety of settings on user systems...are you against view-sources specifically or other admin abilities as well?

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#49

Post by YPPH »

goda90 wrote: post #37
YPPH wrote: post #26

Earlier quoted context omitted.

Students will not get by in life by viewing the source code when confronted with any problem.

Students will not learn to experiment with technology if they are blocked on every attempt.

Time and place. Taking a math quiz is the wrong time to experiment with bypassing quizzes.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#50

Post by YPPH »

atomicnumber3 wrote: post #38
YPPH wrote: post #26

Earlier quoted context omitted.

Students will not get by in life by viewing the source code when confronted with any problem.

But perhaps they will get by in life by finding clever solutions that circumvent common expectations through curiosity and familiarity with technology.

Is this a euphemistic way of saying cheating?
Post reply on HN