Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium: Permit blocking of view-source: with URLBlocklist

chromium-review.googlesource.com

Post reply on HN
Print view View original

71–80 of 136 posts

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#71

Post by tyingq »

grayfaced wrote: post #30
magicalist wrote: post #11

Earlier quoted context omitted.

Chrome uses a `view-source` scheme to trigger showing the source of a web page. This change allows Chrome Enterprise administrators to add `view-source:*` to their blocklist so Chrome instances governed by an enterprise policy with that enabled (like at a school or company) wouldn't be able to visit those pages and so wouldn't be able to view source in the browser.

Would also need to block ctrl+s/save. Which seems pretty drastic for anything other then a dedicated testing machine.

Also pasting "javascript:whatever" in the omnibar. I'm sure there's some nice version of:

  javascript:alert(document.body.innerHTML);

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#72

Post by userbinator »

kuschku wrote: post #68
ericlaw wrote: post #46

To answer a few questions here: 1. I landed this fix because there was a policy that did not work properly. We could instead document that the URLBlocklist policy works for every scheme but one, or we could fix it. Fixing it makes more sense. 2. This policy only can be set on managed machines. 3. This policy, in isolation, is trivially circumvented. Managed environments block many things, including many of the propos…

Many of the best people in IT are there today, because they got curious about how stuff worked, experimented with it, broke the rules, and learned from that. This curiosity needs to be encouraged, not stopped. The young generation in IT already has issues because many of them don’t understand files, and many of them can’t even use a computer anymore. They grow up with tech all around them, but because all of it is cl…

Amen to that! Sadly, it's easier to persuade the population (and hence squeeze the $$$ out of them) when they are kept docile, unknowing, and unquestioning. Knowledge is power, and they don't want you to have too much.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#73

Post by anoonmoose »

scrollaway wrote: post #55
YPPH wrote: post #49

Earlier quoted context omitted.

Time and place. Taking a math quiz is the wrong time to experiment with bypassing quizzes.

Why is that?

Because the goal of the quiz is to test math knowledge, not software bypassing knowledge.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#74

Post by userbinator »

l0b0 wrote: post #13

> With Schools using Google Forms as a testing platform, students are able to use this shortcut to search through the source of the page, and determine the correct answers. So they're serving the answers with the questions, and get annoyed when the students figure this out. What a lark. How about using a system which doesn't do that?

It's funny that 15-20 years ago when real HTML forms were the norm for stuff like this, this wouldn't be a problem. It's only one created by the reliance (or default?) to client-side JS for everything.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#75

Post by birdman3131 »

tyingq wrote: post #71
grayfaced wrote: post #30

Earlier quoted context omitted.

Would also need to block ctrl+s/save. Which seems pretty drastic for anything other then a dedicated testing machine.

Also pasting "javascript:whatever" in the omnibar. I'm sure there's some nice version of: javascript:alert(document.body.innerHTML);

You can't actually paste that into the omnibar in chrome. It will eat the first part.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#76

Post by croon »

jtc331 wrote: post #69
croon wrote: post #52

Earlier quoted context omitted.

If solving a problem in an unconventional or novel way (assuming legal) has a business value, that will absolutely get someone by in life. I don't understand what the term "cheating" means in a post-school context.

I think it’s easy to imagine cheating in a post-school context: copying code from a project your employer doesn’t own into one it does. And that has huge legal ramifications. So students do need to learn about those kinds of restrictions via analogues.

Which is why I accounted for that scenario. Breaking the law is applicable post-school, "cheating" outside of illegality is just thinking outside the box.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#77

Post by Nextgrid »

tremon wrote: post #64
joelthelion wrote: post #62

Earlier quoted context omitted.

You guys are giving administrators way too much power without any good reasons. I realize that if they really wanted, they could give up on Chrome and use something else, but for many of them, they will simply lock everything down out of laziness and probably wouldn't without a convenient way of doing so. An example out of many: why give admins a simple way to disable the built-in password manager? This just enables…

As to your last question, many organizations have a central password management system that lets them audit who uses which password and when. Having the passwords stored in a secondary system makes the audits useless.

Anyone wanting to evade such audits can just write down the password somewhere else such as a piece of paper.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#78

Post by charcircuit »

arcbyte wrote: post #58
azalemeth wrote: post #51

Earlier quoted context omitted.

Is it remotely possible to vote against this policy? Who controls Chromium features – I know it's open source and thus one could always fork it, but how is the project governed? "Benign" dictatorship?

Here's the link to vote, no registration required: https://www.mozilla.org/en-US/firefox/new/

I don't see where to vote on issues on that page.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#79

Post by tyingq »

birdman3131 wrote: post #75
tyingq wrote: post #71

Earlier quoted context omitted.

Also pasting "javascript:whatever" in the omnibar. I'm sure there's some nice version of: javascript:alert(document.body.innerHTML);

You can't actually paste that into the omnibar in chrome. It will eat the first part.

Yes, you have to manually type "javascript:" then paste the code. Or copy everything but the leading 'j' and hand type that after pasting. Or put it in a bookmark. Also, alert() truncates the text, but makes for a nice short demo. You could append a 
 element to the page, or similar.

Re: Chromium: Permit blocking of view-source: with URLBlocklist

#80

Post by charcircuit »

kuschku wrote: post #68
ericlaw wrote: post #46

To answer a few questions here: 1. I landed this fix because there was a policy that did not work properly. We could instead document that the URLBlocklist policy works for every scheme but one, or we could fix it. Fixing it makes more sense. 2. This policy only can be set on managed machines. 3. This policy, in isolation, is trivially circumvented. Managed environments block many things, including many of the propos…

Many of the best people in IT are there today, because they got curious about how stuff worked, experimented with it, broke the rules, and learned from that. This curiosity needs to be encouraged, not stopped. The young generation in IT already has issues because many of them don’t understand files, and many of them can’t even use a computer anymore. They grow up with tech all around them, but because all of it is cl…

These people can do that at home.

Also not understanding files can be a benefit. Files are a legacy computing abstraction. Not knowing legally cruft can give you an open mind.

Post reply on HN