Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Deathray: A simple way for an untrusted site to freeze a Mac

auberon.xyz

Post reply on HN
Print view View original

81–90 of 198 posts

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#81

Post by code_duck »

mitxela wrote: post #70
sgentle wrote: post #10

Could be a useful way to force user-interaction-gated flows. A "your computer is infected, click this button in 10 seconds or it will crash" type button which, at this point, most modestly-knowledgeable users would know not to click. However, after seeing their computer actually crash when the countdown hits 0, perhaps they would be more inclined to click "allow" on whatever prompt follows when they see it again. Of…

> Is denial of service not a security thing any more? It is, but only when a big corp isn't doing it. X is allowed to deny you service without an account and Reddit is allowed to deny you service without uploading your personal documents to Persona.

That’s not what denial of service is.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#82

Post by Melonai »

stackghost wrote: post #47
xoa wrote: post #33

While I'm sure it has its uses, particularly if someone really does want to game or do complex computational stuff purely within a web browser, I'll admit I've grown pretty cautious/tired around the ever increasing amount of hardware attack surface area the browser vendors seem to be rushing to expose as Google in particular appears determined to try to be the "operating system on the operating system" as much as it…

Quite so. When it first took off, I took no end of flames and downvotes for suggesting that WebGPU is a terrible idea. HTML and the browser were originally conceived to render documents, not serve as a bastardized application distribution platform. The only arguments I've ever heard in favor of wasm/webgpu were that using native graphics/GUI toolkit APIs are a pain. That's definitely true, because I've written stuff…

Yeah in the end I probably agree on WebGPU, I haven't really seen a single use of it, except for running shader code examples in browser, which might as well be replaced by a looping video.

For WASM though, I do not agree at all! It's genuinely a great system for high performance browser code. So much stuff I use now had WASM as the backbone, and I even started applying it outside of the browser in some of my architecture. I wish we had way more enthusiasm behind things like WASM, and way less for something like WebUSB.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#83

Post by wzdd »

This issue is older than the M chips: a formative OpenCL moment on my Intel MacBook involved locking it up in this way. By contrast, a similar CUDA kernel running on Linux was forcibly stopped after some short-ish time.

Worse and less defensible on the web of course.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#84

Post by thin_carapace »

code_duck wrote: post #81
mitxela wrote: post #70

Earlier quoted context omitted.

> Is denial of service not a security thing any more? It is, but only when a big corp isn't doing it. X is allowed to deny you service without an account and Reddit is allowed to deny you service without uploading your personal documents to Persona.

That’s not what denial of service is.

what about when big companies drown the web with crawling activity, forcing webmasters to implement fingerprinting and thus massively delaying actual users from accessing webpages that would otherwise load instantly?

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#86

Post by socalgal2 »

This has been around since 2011 when WebGL shipped. It's documented in the spec. It's a self correcting problem. You go to a site, it freezes your machine, you never visit the site again.

No data is stolen, no privacy is lost. All that happens is the perp loses any audience.

Turning off WebGL = no more Figma, no more Canva, no more Google Maps. A few self correcting sites seem acceptable. Evidence, it's been 15 years since this was possible and the world didn't end and the whole internet isn't freezing your machine.

Also, this is arguably a MacOS bug. Window and Linux have had GPU monitors that power cycle the GPU if a command takes too long. Windows since before WebGL shipped. Linux a few years after. Macs still don't recover from excessive GPU use.

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#88

Post by socalgal2 »

autoexec wrote: post #41
xoa wrote: post #33

While I'm sure it has its uses, particularly if someone really does want to game or do complex computational stuff purely within a web browser, I'll admit I've grown pretty cautious/tired around the ever increasing amount of hardware attack surface area the browser vendors seem to be rushing to expose as Google in particular appears determined to try to be the "operating system on the operating system" as much as it…

I'm with you. WebGPU has been used to compromise and fingerprint systems. Firefox (and related forks) are usually able to disable this kind of insecure fluff but it'd be nice if other browsers did as well.

WebGPU provides ZERO extra data that wasn't already available from WebGL in 2011. The world didn't end and it's been 15 years

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#89

Post by LoganDark »

yesitdoes22 wrote: post #67
LoganDark wrote: post #54

Earlier quoted context omitted.

I think running it in the DevTools console is different from having a script on the page.

No actually. The only reason it crashes in dev tools is that it is rendering the printed console log. If you printed to some div in the page, you will get the same effect. Do you understand the topic? Doesn't seem like it

> Do you understand the topic? Doesn't seem like it

Since you are so polite I tested all of it just now and it turns out you are correct that running it directly from the devtools console does not cause any worse behavior than running it from a normal script tag.

However indeed logging only a single message simply causes it to be combined and show a counter instead of crashing. Logging two different messages causes the log to explode pretty instantly and hang DevTools fairly quickly.

For context on how not-crashy a single message log was, I was able to navigate to the Sources tab and pause the webpage in the middle of its infinite loop, which is not something you should be able to do if the DevTools are truly overwhelmed. (When that happens, sometimes the Sources tab simply does not load, other times trying to pause execution simply does nothing.)

Re: The Deathray: A simple way for an untrusted site to freeze a Mac

#90

Post by mitxela »

code_duck wrote: post #81
mitxela wrote: post #70

Earlier quoted context omitted.

> Is denial of service not a security thing any more? It is, but only when a big corp isn't doing it. X is allowed to deny you service without an account and Reddit is allowed to deny you service without uploading your personal documents to Persona.

That’s not what denial of service is.

denial of service is when service is denied
Post reply on HN