Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Deathray: A simple way for an untrusted site to freeze a Mac

auberon.xyz

Post reply on HN
Print view View original

41–50 of 198 posts

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#41

Post by autoexec »

xoa wrote: post #33

While I'm sure it has its uses, particularly if someone really does want to game or do complex computational stuff purely within a web browser, I'll admit I've grown pretty cautious/tired around the ever increasing amount of hardware attack surface area the browser vendors seem to be rushing to expose as Google in particular appears determined to try to be the "operating system on the operating system" as much as it…

I'm with you. WebGPU has been used to compromise and fingerprint systems. Firefox (and related forks) are usually able to disable this kind of insecure fluff but it'd be nice if other browsers did as well.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#42

Post by achierius »

Not 100% surprised that this wasn't picked up as a security issue; denial-of-service is bad, but ultimately doesn't give you a direct path to stealing secrets / hijacking identity / etc.

It is pretty egregious though, I hope they fix this. I expect there'll be a Radar tracking this now that it's made it to the HN front page.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#44

Post by mh- »

autoexec wrote: post #41
xoa wrote: post #33

While I'm sure it has its uses, particularly if someone really does want to game or do complex computational stuff purely within a web browser, I'll admit I've grown pretty cautious/tired around the ever increasing amount of hardware attack surface area the browser vendors seem to be rushing to expose as Google in particular appears determined to try to be the "operating system on the operating system" as much as it…

I'm with you. WebGPU has been used to compromise and fingerprint systems. Firefox (and related forks) are usually able to disable this kind of insecure fluff but it'd be nice if other browsers did as well.

On the other hand, disabling WebGPU is offering entropy for fingerprinting, too. A vanishingly small % of users will have done so.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#46

Post by LoganDark »

embedding-shape wrote: post #25
LoganDark wrote: post #17

Earlier quoted context omitted.

For me it just caused Safari to stop working until I quit and restarted it.

A Denial of Browsing attack.

I have two other web browsers open at any given time, so probably not really. I guess it would be if it truly did bring down the entire system.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#47

Post by stackghost »

xoa wrote: post #33

While I'm sure it has its uses, particularly if someone really does want to game or do complex computational stuff purely within a web browser, I'll admit I've grown pretty cautious/tired around the ever increasing amount of hardware attack surface area the browser vendors seem to be rushing to expose as Google in particular appears determined to try to be the "operating system on the operating system" as much as it…

Quite so. When it first took off, I took no end of flames and downvotes for suggesting that WebGPU is a terrible idea. HTML and the browser were originally conceived to render documents, not serve as a bastardized application distribution platform.

The only arguments I've ever heard in favor of wasm/webgpu were that using native graphics/GUI toolkit APIs are a pain. That's definitely true, because I've written stuff with gtk and it sucks, but that doesn't mean we should just shovel an entire tech stack into the browser.

Just because we can, doesn't mean we should. I'm tired of these BigCos shitting everything up.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#49

Post by autoexec »

mh- wrote: post #44
autoexec wrote: post #41

Earlier quoted context omitted.

I'm with you. WebGPU has been used to compromise and fingerprint systems. Firefox (and related forks) are usually able to disable this kind of insecure fluff but it'd be nice if other browsers did as well.

On the other hand, disabling WebGPU is offering entropy for fingerprinting, too. A vanishingly small % of users will have done so.

True, but randomizing other data points will keep your fingerprint unique which should help prevent associating your activity across sites/sessions.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#50

Post by seany »

mh- wrote: post #44
autoexec wrote: post #41

Earlier quoted context omitted.

I'm with you. WebGPU has been used to compromise and fingerprint systems. Firefox (and related forks) are usually able to disable this kind of insecure fluff but it'd be nice if other browsers did as well.

On the other hand, disabling WebGPU is offering entropy for fingerprinting, too. A vanishingly small % of users will have done so.

don't some of the adblock extensions randomly modify the fingerprinting you can get from this?
Post reply on HN