> Just hope that your browser doesn't automatically reopen the same tab when it starts up again Busted. My browser is configured to do just that.
Unplug your ethernet cable?
This particular page succeeded at being cached.
The Deathray: A simple way for an untrusted site to freeze a Mac
181–190 of 198 posts
Re: The Deathray: A simple way for an untrusted site to freeze a Mac
#182Re: The Deathray: A simple way for an untrusted site to freeze a Mac
#183Earlier quoted context omitted.
A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes. Guess I won't go there again" > I think this point of view is making it a bit too easy. It's been 15 years since this was possible. How many times have you heard of this being an issue? Again, it's self correcting. Site freezes machine, user stops going to site. There's zero incentive to do this and tons of incentive to no…
This is hilarious, and what if an bad actor abuses this and makes a script or browser plugin which goes to this url every time a browser is launched? What about url shorteners and redirects? You seem to dismiss the issue based on a very narrow avoidable case.
They are addressing the fact that no bad actor will care to make it, not that they can't.
Sure, there are countless ways it could be abused, and you point out some, but what had actor will want to pursue even one? They gain nothing. And good actors only lose out, in the form of lost credibility and future audience. Therefore it doesn't get abused and a fix isn't needed.
The last 15 years is evidence of the argument.
Re: The Deathray: A simple way for an untrusted site to freeze a Mac
#184Earlier quoted context omitted.
It really ought to be something you can enable or disable per site. I was surprised to find its not.
Maybe a browser extension could inject JS in a tab to redefine all the WebGPU API into a noop.
I just remembered and checked. Noscript does allow blocking webgl on a per site basis.
Re: The Deathray: A simple way for an untrusted site to freeze a Mac
#185Earlier quoted context omitted.
A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes. Guess I won't go there again" > I think this point of view is making it a bit too easy. It's been 15 years since this was possible. How many times have you heard of this being an issue? Again, it's self correcting. Site freezes machine, user stops going to site. There's zero incentive to do this and tons of incentive to no…
This is hilarious, and what if an bad actor abuses this and makes a script or browser plugin which goes to this url every time a browser is launched? What about url shorteners and redirects? You seem to dismiss the issue based on a very narrow avoidable case.
[dead]
Re: The Deathray: A simple way for an untrusted site to freeze a Mac
#186Earlier quoted context omitted.
> It's a self correcting problem. You go to a site, it freezes your machine, you never visit the site again. What do regular users do about a malicious ad that runs on thousands of different sites? > Turning off WebGL = no more Figma, no more Canva, no more Google Maps Which is why you should probably rather turn off the actual vulnerable API, i.e. WebGPU, not WebGL.
I just don’t think people are doing malicious ads like that. Like I’m sure it exists but like what’s the point? If you are the malicious person you pay money for ads to freeze someone’s computer and that’s it? It’s not even like you would gain anything from it
Failure to imagine an incentive doesn't mean there isn't one. You can't rely on this type of thinking to reason about security. The thing you would have never thought of is what gets you.
For example, an ad provider itself can be hacked by a malicious party, so the "pay money for" part no longer applies.
Or an attack by a state actor or other large entity, where paying for a coordinated disruption of some region or company makes financial or military sense.
Those are just two things that came to my mind, and are likely a fraction of plausible incentives someone might have now or in the future. People are creative and unpredictable. Weird shit happens. Fact is stranger than fiction...
Instead, just ask: should visiting a website ever have the power to freeze your computer without your consent? If you think the answer is no, this is a security bug and it should be fixed.
Re: The Deathray: A simple way for an untrusted site to freeze a Mac
#187Earlier quoted context omitted.
This is hilarious, and what if an bad actor abuses this and makes a script or browser plugin which goes to this url every time a browser is launched? What about url shorteners and redirects? You seem to dismiss the issue based on a very narrow avoidable case.
They are addressing the fact that no bad actor will care to make it, not that they can't. Sure, there are countless ways it could be abused, and you point out some, but what had actor will want to pursue even one? They gain nothing. And good actors only lose out, in the form of lost credibility and future audience. Therefore it doesn't get abused and a fix isn't needed. The last 15 years is evidence of the argument.
Im arguing against the parent point that "Site freezes machine, user stops going to site." Its a gross oversimplification, and it doesnt hold water becasue there are lots of other vectors to a user coming across this than just "oh I recognise that web address as bad so I wont go there".
> but what had actor will want to pursue even one? They gain nothing
Ask that to anyone who has ever rickrolled somebody.
Re: The Deathray: A simple way for an untrusted site to freeze a Mac
#188Earlier quoted context omitted.
I'm with you. WebGPU has been used to compromise and fingerprint systems. Firefox (and related forks) are usually able to disable this kind of insecure fluff but it'd be nice if other browsers did as well.
WebGPU provides ZERO extra data that wasn't already available from WebGL in 2011. The world didn't end and it's been 15 years
WebGL is also a major security risk that has been used to compromise many machines. The world didn't end, but many people have been hurt because of it. I disabled WebGL the moment support was added in firefox too.
WebGL is still putting people at risk:
CVE-2026-87464
CVE-2026-87488
CVE-2026-87438
CVE-2026-87527Re: The Deathray: A simple way for an untrusted site to freeze a Mac
#189Earlier quoted context omitted.
An average user will not know that the site caused the issue. The first time after force turning off the computer, it will restart and reopen all windows causing the computer to crash again. The next time, they might click on the button to prevent reopening all windows and everything will be fine until they opens safari which will cause the same issue. At that point, they'll call whoever is their computer expert user…
It's worse than that: a default macOS install with Safari will re-open Safari, complete with re-opening the tab that was open upon a hard power off and power back on. So to get it to stop doing this on restart, I had to be very quick to force-quit Safari as the machine rebooted. You don't get a chance to tell it "Don't reopen all windows" when you hold the power button down.
Not sure if it’s a setting but my mac definitely asks me if I want to reopen windows after a forced reboot.
Re: The Deathray: A simple way for an untrusted site to freeze a Mac
#190Earlier quoted context omitted.
I think a lot of HN commenters are way too disconnected from the average person. You're making a big assumption that a user will even connect the dots until the same thing happens multiple times, if even then. The average computer user is extremely bad at connecting cause and effect on their computer. Think of how many times you hear "my computer is broken!" when actually it's something like the printer was unplugged…
> I think a lot of HN commenters are way too disconnected from the average person This is basically an old-man-and-the-starfish situation for me. > You're making a big assumption that a user will even connect the dots If they do, it’s because their wildly inaccurate mental model happened to guess the right answer. What most will think is “I was just browsing the internet and my computer froze.” Maybe they’ll connect…
You sir, are very aware of how the average computer user thinks!