Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A new spam policy for “back button hijacking”

developers.google.com

Post reply on HN
Print view View original

271–280 of 532 posts

Re: A new spam policy for “back button hijacking”

#271

Post by ori_b »

andreareina wrote: post #57

> Notably, some instances of back button hijacking may originate from the site's ... advertising platform I feel like anything loaded from a third party domain shouldn't be allowed to fiddle with the history stack.

The history stack shouldn't be controlled by any loaded sites. The browser needs to treat websites as hostile.

Re: A new spam policy for “back button hijacking”

#272

Post by lxgr »

skrebbel wrote: post #257

How does this work? How can a site inject a totally different site into the history? I thought eg the History API only lets you add to the stack and pop, not modify history?

There's also a replace() method, and trying to limit that to only same origin or already visited URLs seems futile, as the pages hosted there can themselves detect that the user is navigating back and can just forward you in a number of ways.

Re: A new spam policy for “back button hijacking”

#273

Post by chongli »

wmf wrote: post #41
pottertheotter wrote: post #20

Earlier quoted context omitted.

Did you use the web back in 1995? It was fun, but it also sucked compared to what we have now. Nothing is ever perfect, but I wouldn’t want to go back.

You're not wrong but we've never really tried the combination of modern CSS with no JS. It could produce elegant designs that load really fast... or ad-filled slop but declarative.

Ads don’t work nearly as well without JavaScript for adtech. They’re basically limited to static banners and text ads as well as sponsorships.

Re: A new spam policy for “back button hijacking”

#274

Post by edg5000 »

shevy-java wrote: post #233

I don't trust Google. We need to go back to an independent and competent research group designing standards. Right now Google pwns and controls the whole stack (well, not really ALL of it 1:1, but it has a huge influence on everything via the de-facto chrome monopoly). Remember how Google took out ublock origin. They also lied about this aka "not safe standards" - in reality they don't WANT people to block ads.

Power is taken but also given. It's a dynamic and I agree it's gotten way, way out of hand. It may eventually supress progress and become a real parasitic presence, but we've not reached that point yet (in net terms). Google has been relatively responsible with the power, but cracks have been starting to show. It will get a whole lot worse before it gets better. That is why I embrace vertical integration despite the tremendous cost. Call it the cockroach approach; it allows being partially decoupled from outside fluctuations.

Addition: People underestimate Google's influence. It's easy to forget they de-facto control Firefox, leaving only Apple and Google in control of the Web. Scary, but looking away won't help either. The Americans have been consistently competent with technology since the advent of the transistor right after WW2. They're reaping the benefits of that still to this day. I say that as a European.

Re: A new spam policy for “back button hijacking”

#276

Post by csomar »

mimsee wrote: post #265
csomar wrote: post #198

Earlier quoted context omitted.

Good point. Chrome has a “feature” where if your website is google-flagged, it’ll display a danger alert when visiting it. For some reason I confused that with this.

If you're referring to Google Safe Browsing lists, all major browsers check agains the same list. I've managed to get mine listed there and immediately banned on all major browsers.

Not only that but I think Google listens to "cyber security" companies lists and feed from them. My website got in some of these lists (https://www.virustotal.com/gui/url/a4c9f166d2468f5bbb503ec79...) and I had to go through like 6-7 of them to whitelist my domain again. Something about code and input triggered something in some of these list's filters that my website is hacking related.

Re: A new spam policy for “back button hijacking”

#277

Post by bityard »

As usual, it's a good first step but doesn't go far enough. I don't want my back-button hijacked by _anything_.

My issue with back-button hijacking isn't even spam/ads (I use an ad-blocker so I don't see those), but sites that do a "are you sure you want to leave? You haven't even subscribed to our newsletter yet?!"

Re: A new spam policy for “back button hijacking”

#278

Post by skydhash »

ryandrake wrote: post #25
pottertheotter wrote: post #20

Earlier quoted context omitted.

Did you use the web back in 1995? It was fun, but it also sucked compared to what we have now. Nothing is ever perfect, but I wouldn’t want to go back.

I’d go back in a heartbeat. Making the web a software SDK was the worst thing to happen to it.

I read epubs, and html pages derived from texinfo and mandoc. When I see websites that just break down when you disable JS (I do it with ublock), I always feel a pang of sadness. Unless you’re Figma, Google doc, or OpenStreetMap…, which rely heavily on local state, JS should only be required for small island of interaction.

Re: A new spam policy for “back button hijacking”

#279

Post by Sayrus »

bityard wrote: post #277

As usual, it's a good first step but doesn't go far enough. I don't want my back-button hijacked by _anything_. My issue with back-button hijacking isn't even spam/ads (I use an ad-blocker so I don't see those), but sites that do a "are you sure you want to leave? You haven't even subscribed to our newsletter yet?!"

On the other hand, "are you sure you want to exit without saving" is a good use-case. But I'd prefer that to be a setting I can allow for specific site.
Post reply on HN