Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Annoying Site: Source

theannoyingsite.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: The Annoying Site: Source

#11

Post by MagicPropmaker »

amingilani wrote: post #9

DO NOT CLICK OPEN THE REAL WEBSITE. Jeez, I just made that mistake. Omg, that was bad. I can't perfectly describe what happens but I'll try — the page jumps around with a cat image, every time I try to kill it with cmd+w, it repawns into another small window. I think it remaps cmd+w to cmd+p, and just plays dubstep in the background. Oh, and at some point, a random cat headbanging cat appears, and the voices goes fro…

Microsoft Edge had no trouble dealing with it. I let it rip, with the adblocker off to see if it would crash. Handled it all fine. Then I just told it to close all the additional windows it brought up.

Of course, it did log me out of everything.

Re: The Annoying Site: Source

#12

Post by dgellow »

amingilani wrote: post #9

DO NOT CLICK OPEN THE REAL WEBSITE. Jeez, I just made that mistake. Omg, that was bad. I can't perfectly describe what happens but I'll try — the page jumps around with a cat image, every time I try to kill it with cmd+w, it repawns into another small window. I think it remaps cmd+w to cmd+p, and just plays dubstep in the background. Oh, and at some point, a random cat headbanging cat appears, and the voices goes fro…

I laughed so hard reading your comment then sources. A bit unfortunate (or not), on mobile it doesn’t seem to do anything interesting other than pollute my history with a bunch of entries.

Re: The Annoying Site: Source

#13

Post by gbuk2013 »

That was awesome, although it sounds like it would have been more annoying if I wasn't using Firefox (which didn't make it too difficult to close the site).

Hats off to the guy, though - that was well trolled. :) And well worth it for these 2 gems alone:

https://www.youtube.com/watch?v=MNyG-xu-7SQ

https://www.youtube.com/watch?v=nb1B3KI1u-I

Re: The Annoying Site: Source

#14

Post by marcosdumay »

LeoPanthera wrote: post #3

Interesting that this entire domain is blocked as malicious by my ad blocker.

It escapes from being malicious only because it is very explicit on what it does. But it's very likely that are malicious links to it that hide its destiny.

And it's entirely what ad-blockers should be out to block. So, yes, good thing that it's blocked.

Re: The Annoying Site: Source

#15

Post by cosmojg »

amingilani wrote: post #9

DO NOT CLICK OPEN THE REAL WEBSITE. Jeez, I just made that mistake. Omg, that was bad. I can't perfectly describe what happens but I'll try — the page jumps around with a cat image, every time I try to kill it with cmd+w, it repawns into another small window. I think it remaps cmd+w to cmd+p, and just plays dubstep in the background. Oh, and at some point, a random cat headbanging cat appears, and the voices goes fro…

As someone who browses the internet with JavaScript disabled by default, I've never felt more vindicated.

Re: The Annoying Site: Source

#16

Post by maddyboo »

This is interesting

  /**
   * Sites that link to theannoyingsite.com may specify `target='_blank'` to open the
   * link in a new window. For example, Messenger.com from Facebook does this.
   * However, that means that `window.opener` will be set, which allows us to redirect
   * that window. YES, WE CAN REDIRECT THE SITE THAT LINKED TO US.
   * Learn more here: https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/
   */
  function attemptToTakeoverReferrerWindow () {
    if (isParentWindow && window.opener && !isParentSameOrigin()) {
      window.opener.location = `${window.location.origin}/?child=true`
    }
  }
I checked in Chromium 70 and this only seems to work on the same origin - attempting to access `window.opener` cross-origin results in

  Uncaught DOMException: Blocked a frame with origin "https://example.com" from accessing a cross-origin frame
The article linked in the code [0] and the MDN page for window.opener [1] mention the use of `rel="noopener"` to prevent `window.opener` from being set, but that it's not supported in all browsers - particularly Firefox, which needs `noreferrer`. I am sure CORS headers also play a role in protecting from this. OWASP calls this technique 'reverse tabnabbing' [2].

There's a demo [3] of the effect - you can manually inspect the first link and change the href to [4] and then click the link to test how cross origin requests work.

[0] https://www.jitbit.com/alexblog/256-targetblank---the-most-u...

[1] https://developer.mozilla.org/en-US/docs/Web/API/Window/open...

[2] https://www.owasp.org/index.php/Reverse_Tabnabbing

[3] https://rawgit.com/waltertamboer/experiment-html-js-window-o...

[4] https://gitcdn.link/cdn/waltertamboer/experiment-html-js-win...

Re: The Annoying Site: Source

#17

Post by leowoo91 »

amingilani wrote: post #9

DO NOT CLICK OPEN THE REAL WEBSITE. Jeez, I just made that mistake. Omg, that was bad. I can't perfectly describe what happens but I'll try — the page jumps around with a cat image, every time I try to kill it with cmd+w, it repawns into another small window. I think it remaps cmd+w to cmd+p, and just plays dubstep in the background. Oh, and at some point, a random cat headbanging cat appears, and the voices goes fro…

Fun aside, that means no browser has a popup rate limit in 2018?

Re: The Annoying Site: Source

#18

Post by [deleted] »

amingilani wrote: post #9

DO NOT CLICK OPEN THE REAL WEBSITE. Jeez, I just made that mistake. Omg, that was bad. I can't perfectly describe what happens but I'll try — the page jumps around with a cat image, every time I try to kill it with cmd+w, it repawns into another small window. I think it remaps cmd+w to cmd+p, and just plays dubstep in the background. Oh, and at some point, a random cat headbanging cat appears, and the voices goes fro…

[deleted]

Re: The Annoying Site: Source

#19

Post by bigbugbag »

amingilani wrote: post #9

DO NOT CLICK OPEN THE REAL WEBSITE. Jeez, I just made that mistake. Omg, that was bad. I can't perfectly describe what happens but I'll try — the page jumps around with a cat image, every time I try to kill it with cmd+w, it repawns into another small window. I think it remaps cmd+w to cmd+p, and just plays dubstep in the background. Oh, and at some point, a random cat headbanging cat appears, and the voices goes fro…

I did the same as you of curiosity and was wondering what this site is even supposed to do.

I guess my disabling of javascript by default to avoid annoyances, improve performance and save battery rendered the annoying part useless.

Sometimes I wish mozilla had chosen to make firefox more like opera (the real opera, not the chrome based one) and not like chrome with the quick disable/enable script setting instead of removing the possibility to disable javascript altogether. Actually I wish opera was still around to not have to deal with mozilla nonsense by resorting to using a different build (waterfox) to mitigate most of it.

Re: The Annoying Site: Source

#20

Post by giancarlostoro »

bigbugbag wrote: post #19
amingilani wrote: post #9

DO NOT CLICK OPEN THE REAL WEBSITE. Jeez, I just made that mistake. Omg, that was bad. I can't perfectly describe what happens but I'll try — the page jumps around with a cat image, every time I try to kill it with cmd+w, it repawns into another small window. I think it remaps cmd+w to cmd+p, and just plays dubstep in the background. Oh, and at some point, a random cat headbanging cat appears, and the voices goes fro…

I did the same as you of curiosity and was wondering what this site is even supposed to do. I guess my disabling of javascript by default to avoid annoyances, improve performance and save battery rendered the annoying part useless. Sometimes I wish mozilla had chosen to make firefox more like opera (the real opera, not the chrome based one) and not like chrome with the quick disable/enable script setting instead of r…

Yeah I hate that they burried the option to disable JS and even worse to disable JS moving and resizing a window around the screen. At least make those things the end-user is asked for permission to allow.
Post reply on HN