Good luck faking my inverted extra large windows cursor.
And I browse without JavaScript, so the CSS style that hid the cursor actually meant I didn't see any cursor whatsoever.
Out of curiosity, aren't 90% of websites broken for you?
Cursor:none abuse (trick users into clicking Facebook 'like')
61–69 of 69 posts
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#62A much more straightforward abuse would be pointer-events: none. Just position an element over the 'like' button and let clicks pass through it: http://jsfiddle.net/rVxTn/
I think we can stop worrying. Facebook has a detection mechanism for these false / forced likes :-) http://i.imgur.com/qf7VQ.png
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#63I use Ghostery to wipe out Facebook showing up elsewhere on the Internet.
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#64I use Ghostery to wipe out Facebook showing up elsewhere on the Internet. http://www.ghostery.com
Alternative using Adblock: http://adversity.uk.to/
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#65Earlier quoted context omitted.
And I browse without JavaScript, so the CSS style that hid the cursor actually meant I didn't see any cursor whatsoever.
Out of curiosity, aren't 90% of websites broken for you?
Yes and no. While I browse with JavaScript disabled, I have whitelist. Chrome v8 has a feature which allows you to prevent execution of scripts from a particular domain.
I've blacklisted all ad networks from executing and JavaScript but I maintain a strict whitelist which means that sites such as Facebook, Google, and any site which I browse and immediately see is broken is added to my whitelist.
When I browse a page, I can have conditional execution of the JS code, meaning that JS from 3 domains will run, but the 9 tracking JS code from all the ad networks won't run.
It's like the best of all worlds. Adnetworks can't fingerprint me, and they have to rely on cookies, plus my browsing is a hell of a lot faster because I don't have all the unneccessary JS downloading and running.
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#66Earlier quoted context omitted.
By default I have JavaScript blocked on all sites, allowing it only as needed, case by case, because JavaScript is a remote-code-execution vulnerability of modern browsers. More and more of the applications we use and our private data live in the cloud. We now access our personal files, manage our bank and investment accounts, and make retail purchases on our web browser. Browsing the web with JavaScript enabled by d…
This shows a general lack of knowledge about how JS and websites work. I can't just run JS on my site that will steal your bank info. Browsers have cross domain security policies to prevent this. There have been various vulnerabilities (especially in IE) but just like any other software they get fixed.
driverdan -- by your logic, it would be OK to give perfect strangers remote-shell access to one's computer, so long as one takes all the precautions necessary to protect sensitive files and prevent them from gaining root access.
Leave aside the various vulnerabilities (including cross-site-scripting ones!) that get discovered with disturbing frequency, and please consider the subject of this thread: it's possible to make someone click a "Like" button without their realizing it! How many other similar tricks can JavaScript be used for by people with nefarious intentions?
No matter how "safe" any runtime environment is, allowing strangers to execute arbitrary code on your computer is never a great idea.
This is why I allow JavaScript code to run on my browser only when it comes from sources I trust.
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#67Earlier quoted context omitted.
Out of curiosity, aren't 90% of websites broken for you?
Yes and no. While I browse with JavaScript disabled, I have whitelist. Chrome v8 has a feature which allows you to prevent execution of scripts from a particular domain. I've blacklisted all ad networks from executing and JavaScript but I maintain a strict whitelist which means that sites such as Facebook, Google, and any site which I browse and immediately see is broken is added to my whitelist. When I browse a page…
I see, thanks for the great explanation.
I admit the thought that some users aren't using JS concerns me because, while I try and always build sites with a fallback, it generally results in a lesser experience. Often fallbacks just aren't possible so I need to remove the feature altogether.
I bet there's a lot of sites that still work for you, but not quite as well as if JS were enabled.
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#68Speaking about prevention (for the specific case of the like button), I have privoxy (1) setup to disable fb plugins with rules like these:
{+block{Facebook "like" and similar tracking URLs.}} www.facebook.com/(extern|plugins)/(login_status|like(box)?|activity|fan)\.php
{+block{Stupid facebook xd_proxy.php.}} http://static.ak.fbcdn.net/connect/xd_proxy.php.*
The second one also removes an annoyance I see from time to time when I bypass the proxy which makes the page request again and again that xd_proxy.php file.
If I really want to like something, I disable the proxy and reload the page. I use Proxy SwitchySharp (2) for chrome to do the setup for me in pages I visit often.
1: http://www.privoxy.org/ 2: https://chrome.google.com/webstore/detail/dpplabbmogkhghncfb...
Re: Cursor:none abuse (trick users into clicking Facebook 'like')
#69Earlier quoted context omitted.
Yes and no. While I browse with JavaScript disabled, I have whitelist. Chrome v8 has a feature which allows you to prevent execution of scripts from a particular domain. I've blacklisted all ad networks from executing and JavaScript but I maintain a strict whitelist which means that sites such as Facebook, Google, and any site which I browse and immediately see is broken is added to my whitelist. When I browse a page…
I see, thanks for the great explanation. I admit the thought that some users aren't using JS concerns me because, while I try and always build sites with a fallback, it generally results in a lesser experience. Often fallbacks just aren't possible so I need to remove the feature altogether. I bet there's a lot of sites that still work for you, but not quite as well as if JS were enabled.
Don't worry about users like me.
Make your content load, but anything above that, users are on their own if they decide not to enable JavaScript.
In this age, with all of the rich user applications, JS is practically a requirement.
For my startup, the frontend gracefully fallbacks to a working version for users.
For the backend, they get a blackscreen saying JS is required. If users are going to use my application, they should expect to have JS enabled for the best possible user experience.
Don't worry about it is the upshot!