Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTML5 localStorage allows sites to fill up users' hard disks

feross.org

Post reply on HN
Print view View original

141–150 of 191 posts

Re: HTML5 localStorage allows sites to fill up users' hard disks

#141

Post by aw3c2 »

nkuttler wrote: post #135
aw3c2 wrote: post #127

Earlier quoted context omitted.

You might like OpenStreetMap! You can get the whole planet in a http://planet.openstreetmap.org/planet/ Granted that is the raw data, but you can extract the regions you need easily and then render them on demand.

I don't think it's such a good idea to link directly to such huge files from here. The directory would do just fine http://planet.openstreetmap.org/planet/ and avoid bots or inattentive clicks. But good to know anyway!

Good suggestion, I changed the link.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#142

Post by shurcooL »

yaix wrote: post #79
callahad wrote: post #73

Earlier quoted context omitted.

> You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. Thankfully, in this case, domain registrations are expensive. Filling a 16 GB iPad with this technique would cost around $10,000 in registrar fees. A 128 GB SSD could be filled for under $100,000. ...So I wanted to come in here and say "cost prohibitive!" but... maybe not, given that most devices will be at least partiall…

Just get .tk[1] domains. [1] http://www.nic.tk

Is there a catch?

Re: HTML5 localStorage allows sites to fill up users' hard disks

#143

Post by im3w1l »

JoachimSchipper wrote: post #81
afhof wrote: post #80

Earlier quoted context omitted.

That is a good way to never ever ever use a feature again. "Frightening Message: This website wants to do something scary. Do you want to allow some bad thing to happen to your computer?" That is how lay people, i.e. the people needed to mass adoption, read browser requests for Geo, storage, and other permissions. It would be better to have sane and safe defaults in the browser, rather than pester the user. Would coo…

Would cookies be used for tracking you everywhere if the browser asked for permission on every use? Would this be a good or bad thing? (It's not like keeping state in the URL is hard - using cookies just looks marginally better.)

Then, if you were logged in to a site, you would only be logged in, in that particular tab.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#144

Post by jackalope »

benatkin wrote: post #16
viseztrance wrote: post #12

The message is OK, but personally I have an issue with websites playing sound without my consent.

OK, why does YouTube get a free pass on this? Nobody has ever given me a good reason.

It doesn't. Flashblock is one of the most popular Firefox extensions[1], and variants are available in other browsers. Even though it offers some protection against hidden Flash elements and supercookies, it would still be popular just to prevent autoplaying flash presentations.

The author of Flashblock even specifically mentions YouTube on the extension page[2]:

Youtube videos not blocked: This is because they are now increasingly HTML5 Videos. I plan to add HTML5 blocking in the next version. Meanwhile you can try out a experimental version at: http://flashblock.mozdev.org/installation1.html#unstable

This indicates there is a demand for the autoplay blocking feature alone, regardless of the medium.

[1] https://addons.mozilla.org/en-US/firefox/extensions/?sort=us...

[2] https://addons.mozilla.org/en-US/firefox/addon/flashblock/

Re: HTML5 localStorage allows sites to fill up users' hard disks

#145

Post by brittohalloran »

rplnt wrote: post #130
zepolen wrote: post #118

Earlier quoted context omitted.

5MB per subdomain, 100MB per domain, configurable limits, prompt when a site/subdomain requires more.

The 100MB per domain includes the subdomain storage? Then it doesn't solve what parent comment described - few subdomains could use up all the storage. If it doesn't include it and it's separate then it is exactly like it is now.

Yes, it would be 20 subdomains though, and the user would get a prompt for more storage allowance.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#146

Post by robryan »

ma2rten wrote: post #104
reitzensteinm wrote: post #84

Earlier quoted context omitted.

What about this: writes to a.mydomain.com from a page with www.mydomain.com in the address bar count towards the quota for both a.mydomain.com and www.mydomain.com. You'd have to store the other domains your page has written to in its own local storage area, but it doesn't seem to me like the book keeping would be that complicated. You could use a coarse rule of all data in a.mydomain.com counts, and use a larger quo…

You could simply fill up your subdomain's local storage and then do a javascript redirect to another subdomain.

Not if the browser only counted user navigations when deciding how space should be allocated.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#147

Post by harshreality »

farseer wrote: post #138

The solution is simple but ugly: A root domain www.example.com can utilize upto 10MB of storage while sub-domains count towards that storage limit. Any domain trying to access more will automatically result in a user prompt. An exemption can be made for domains/subdomains that present a valid SSL certificate, the whole idea is to prevent abuse.

How would that work if the malicious page used IP addresses instead of hostnames? Then it's only a matter of how many IP addresses the author can use.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#148

Post by m_st »

UnoriginalGuy wrote: post #94
m_st wrote: post #37

Reminds me how filing bugs with Microsoft is such a pain! There's no category for Windows 8 on MS Connect, so when we found a bug in Windows 8 RTM I found the name of an MS employee working on the feature in question on the MSDN forums, then through Google found his LinkedIn profile where he luckily published his eMail address. Microsoft should be ashamed. It seems like the best way to file a bug these days is to cre…

I'm actually aware of a very significant user impacting bug in Windows 8 (hint: It can cause every process in your startup/autorun list to not start consistently). But have no way to report it to them... Has impacted my system multiple times since upgrading to Windows 8. Fortunately I know a work-around (eject the optical disc in the optical drive) but still -- annoying that I cannot even report it.

Good luck getting anything done for it.

The bug we found is affecting a lot of Swiss customers (I admit Switzerland isn't so big) and it took a month until I got a useful reply.

Now we have a bug number and were told that the issue should be fixed "early this year" and changes would be checked in in March. Whatever that means...

At least their employees were kind enough to reply to my eMail. But this company should really improve their error reporting.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#149

Post by Flenser »

martin_ wrote: post #3

So apparently this is where you file IE bugs http://connect.microsoft.com/IE - i'm not sure if it's expected or ironic that it's broken. Great find btw!

This is the url for the feedback form. It redirects to a login page if you're not logged in.

https://connect.microsoft.com/IE/feedback/CreateFeedbackForm...

Post reply on HN