Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How does Facebook disable Developer Tools?

stackoverflow.com

Post reply on HN
Print view View original

31–40 of 90 posts

Re: How does Facebook disable Developer Tools?

#31

Post by gleenn »

reconbot wrote: post #5
ihsw wrote: post #3

Earlier quoted context omitted.

Why not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.

Because the "hackability" of the web is important. The ability to view source, play in the console, modify the dom, etc is amazing. Locking it down or providing a larger barrier to entry (eg, download this extra thing) provides dubious benefit and hides what makes the web great. I speak from someone who teaches ruby and javascript. Javascript is in every browser and the console is a wonderful place to start. When I t…

You can download the command line tools package from apple instead to get the compiler which is only a couple hundred megs instead of the 5 gig bloat that is xcode. Definitely saves a lot of hassle.

Re: How does Facebook disable Developer Tools?

#33

Post by brey »

magicalist wrote: post #13

I don't think Developer Tools are going to be able to allow overriding like this for long, or we're going to be seeing a lot of this on sites soon, just like the widespread right-click "disabling" of yesteryear.

I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset.

I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings.

or hide it behind a turing-test-for-engineers ... 'solve the following code test to enable the dev console' ;)

Re: How does Facebook disable Developer Tools?

#34

Post by lelf »

plorkyeran wrote: post #2

I'm sort of surprised that the developer tools have only recently become an attack vector (via social engineering). I'm not sure what can even really be done about it without seriously inconveniencing developers. Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?

> Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?

Safari does this

Re: How does Facebook disable Developer Tools?

#35

Post by agumonkey »

ibarrajo wrote: post #24

This is an analysis of the code that facebook is trying to prevent from being pasted into the console http://pastebin.com/0JXCVxXg

I thought it was obfuscated variable names, but it's a turkish word https://en.wiktionary.org/wiki/arkada%C5%9Flar (follower)

Re: How does Facebook disable Developer Tools?

#36

Post by username42 »

magicalist wrote: post #13

I don't think Developer Tools are going to be able to allow overriding like this for long, or we're going to be seeing a lot of this on sites soon, just like the widespread right-click "disabling" of yesteryear.

I seems too easy to disable developer tools. What about a fork of chrome that prevent disabling this tools

Re: How does Facebook disable Developer Tools?

#37

Post by Already__Taken »

brey wrote: post #33
magicalist wrote: post #13

I don't think Developer Tools are going to be able to allow overriding like this for long, or we're going to be seeing a lot of this on sites soon, just like the widespread right-click "disabling" of yesteryear.

I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset. I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings. or hide it behind a turing-test-for-engineers ... 'solve t…

Something something security by obscurity something something.

Re: How does Facebook disable Developer Tools?

#38

Post by magicalist »

brey wrote: post #33
magicalist wrote: post #13

I don't think Developer Tools are going to be able to allow overriding like this for long, or we're going to be seeing a lot of this on sites soon, just like the widespread right-click "disabling" of yesteryear.

I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset. I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings. or hide it behind a turing-test-for-engineers ... 'solve t…

Oh, I don't mean for the purposes of security, but sites thinking that they're protecting their content in some way by dropping in a future jquery plugin or whatever that disables the console, and suddenly the hackability and usability of the web becomes much less.

Another place where you see this sort of thing: banks that try to prevent password managers from filling in your credentials (also I've seen a few recently that try to prevent you from pasting in your password).

There is a tradeoff there too: like this Facebook trick helping save some users, bank tricks probably help some users from accidentally saving their bank credentials on some public or shared computer, but it makes it really annoying (or not possible short of opening devtools and setting the input box's value manually) for those of us that want a unique and more-or-less random password for each site we visit.

Re: How does Facebook disable Developer Tools?

#39

Post by Sharlin »

nyrina wrote: post #32
Fasebook wrote: post #26

This is a pretty good reason to never trust Chrome again.

I wouldn't trust any computer, then. It's the same as taking a bunch of code you have no idea how works, and paste it into CMD, then wondering why you just deleted C:/

I would indeed not trust any OS that allows you to erase the root filesystem without at least asking for the superuser password :)

Re: How does Facebook disable Developer Tools?

#40

Post by tshadwell »

gibybo wrote: post #17

The accepted answer teases that this is not enough: Object.defineProperty(console, '_commandLineAPI', { get : function() { throw 'Nooo!' } }) But why isn't it enough?

Because it is possible to get around with just code: http://escape.alf.nu/20

(which I have done, under another username)

Post reply on HN