Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 204 posts

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#111

Post by lewisl9029 »

temp12192021 wrote: post #104
pupppet wrote: post #17

I had to use their silly drag-and-drop email builder because I'm handing the email off to be edited by a non-dev. I dropped in a "Code" module so I could add some custom CSS but because a style tag generates no space, that module is no longer accessible via the UI as there's nothing to click on. So I thought oh brother I'll just inject a couple br tags via the Inspector and then poof, I'm in the doghouse.

https://sindresorhus.com/devtools-detect/ https://github.com/sindresorhus/devtools-detect EDIT: doesn't seem to work if I have devtools as a separate window

Vertical tabs in Edge seems to trigger false positives on this. Really hope that's not the only heuristic they're using.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#112

Post by iudqnolq »

kevincox wrote: post #103
iudqnolq wrote: post #86

Earlier quoted context omitted.

Almost everyone resizes windows by manually dragging the corner. This will generate a series of resize events rather than a single jump. This is a real technique, but it tends to be used by shady piracy sites that want to stop piracy of their pirated contents. There's another cute approach based on the fact console.log(foo) calls foo.toString if and only if the devtools is open.

I could open the history or bookmarks panel in Firefox and get an instant resize. Or click + to snap the browser to the side of my screen. It seems that this would create far too many false positives.

That's why this is used by a particular subset of websites only. They pirate tv shows and movies, and then pack the screen with ads. They don't care at all about user inconvenience or loyalty. The answer to "your website breaks when I do x" would be "stop doing x", if they even had a customer support team. Some of them disable every browser other than chrome on the grounds that users of "weird" browsers are more likely to be "hackers".

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#113

Post by sosborn »

535188B17C93743 wrote: post #29
supriyo-biswas wrote: post #3

Are you seeing any network requests or data transmitted over open websockets to confirm this is actually the case? I get it that people like to complain about stuff on HN (I recently had a thread too) but there needs to be evidence for people to go off of.

Yeah, I'm not seeing any evidence to support this...

Do you have a Mailchimp account? It's really easy to test. It happened to me a couple of weeks ago and I can easily reproduce it in different network locations.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#114

Post by pxeger1 »

dylan604 wrote: post #107
1970-01-01 wrote: post #100

https://mailchimp.com/about/security/#Protecting_Ourselves_A... >Yes, you heard that correctly. We can secure ourselves like Fort Knox, but if your computer gets compromised and someone gets into your Mailchimp account, that's not good for either of us. So mailchimp is SOC2, ISO, PCI, etc. and still gets worried about themselves if a user account is hacked.

reading further down that page... "We retain a law firm in the UK to consult on EU privacy issues." wouldn't it be better to retain a law firm that's actually in the EU? hiring a UK law firm for EU matters is no different that hiring a US law firm, or AUS, or whatever non-EU country

The UK is subject to the UK GDPR, which has no material differences to the EU GDPR. There are probably some other differences, but the UK is much better than USA or Australia etc. (Although I'm surprised there aren't USA-based law firms which specialise in European privacy laws, because of their impact on tech companies)

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#115

Post by 0x0000000 »

sam0x17 wrote: post #102
amyjess wrote: post #59

This is worrying since I have accidently opened dev tools hundreds of times by clicking both mouse buttons when my cursor is near the bottom of the screen. I have a tic disorder (not Tourette's, because my tics are all nonverbal). One of my tics is that I mash both mouse buttons over empty space pretty frequently. I even go out of my way to keep my cursor positioned over empty space so I can mash the mouse buttons wh…

I regularly instruct users to open dev tools to clear their site-specific cookies because there doesn't seem to be a way of doing this without clearing _all_ cookies anymore other than in Dev Tools > Application

Not sure what browser you're referring to, but Firefox still allows you to clear site-specific cookies by clicking on the button to the left of the URL (usually a lock icon since most things are https these days)

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#116

Post by zzo38computer »

sphars wrote: post #62
omgomgomgomg wrote: post #52

How is this detected in js, if possible? Is there a dev tools open event or does it detect f keys and right click events?

One of the ways this is detected is by window resizing. You can see an example npm package that can detect devtools here: https://github.com/sindresorhus/devtools-detect

Like they say there, there are other reasons that the window might be resized, including other sidebars, or split screen (if you use a browser that has this feature), or possibly even printing the document (since the page will have different dimensions than the screen), or resizing the window if you have other programs open at the same time, etc.

I had wanted to prevent web pages from detecting the window height, which has many benefits, including this but also prevents using the window height to override font sizes, preventing auto-loading on scrolling, and auto-scrolling ads into view, in addition to the debugger.

Additionally, detecting the outer window size should not be possible at all; it is not useful. Only the document view area is useful to detect anyways.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#117

Post by Nullabillity »

temp12192021 wrote: post #104
pupppet wrote: post #17

I had to use their silly drag-and-drop email builder because I'm handing the email off to be edited by a non-dev. I dropped in a "Code" module so I could add some custom CSS but because a style tag generates no space, that module is no longer accessible via the UI as there's nothing to click on. So I thought oh brother I'll just inject a couple br tags via the Inspector and then poof, I'm in the doghouse.

https://sindresorhus.com/devtools-detect/ https://github.com/sindresorhus/devtools-detect EDIT: doesn't seem to work if I have devtools as a separate window

Tree Style Tab is apparently detected as vertical dev tools, and opening the horizontal dev tools changes it to no. This is kind of hilarious.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#118

Post by javajosh »

JohnBooty wrote: post #108
javajosh wrote: post #83

Earlier quoted context omitted.

> Isn't this spying on the user without user's consent? Yes. > Is it okay to collect this kind of info and use it to block access? No. It's not okay. > Are there no regulations against this? Probably not. In this case the remedy is to just use another service, or DIY. And I also think that's a pretty reasonable remedy, which will send a message to others considering such actions. FWIW I would like to see regulations…

I'm not defending MailChimp (this devtools thing is pretty awful) but "just DIY it" is a bit glib. DIY'ing what MailChimp provides is... a lot. I wrote a sort of "DIY MailChimp" for a marketer back in the ancient days of the early 2000s. I did the tracking and email content bits. I did not handle the email servers themselves. Lot of work staying off of blacklists. It was something close to a fulltime job back then, a…

The users of mailchimp don't need to make another mailchimp. They just need to handle their own email needs. That's a big difference. It's still not easy, and I would never be glib about it, especially since I've never run my own mail server on my own domain name before.

But...several full-time jobs? How much mail do you need to send before postfix on a $5 VPS falls over? In terms of composing html mail that looks good, that would take some time to learn. A day to get something passable, especially with LLM help? As for tracking, I am against image/pixel tracking in emails, I think it undermines trust, so I wouldn't implement it (or use it).

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#119

Post by deathanatos »

temp12192021 wrote: post #104
pupppet wrote: post #17

I had to use their silly drag-and-drop email builder because I'm handing the email off to be edited by a non-dev. I dropped in a "Code" module so I could add some custom CSS but because a style tag generates no space, that module is no longer accessible via the UI as there's nothing to click on. So I thought oh brother I'll just inject a couple br tags via the Inspector and then poof, I'm in the doghouse.

https://sindresorhus.com/devtools-detect/ https://github.com/sindresorhus/devtools-detect EDIT: doesn't seem to work if I have devtools as a separate window

… that incorrectly detects devtools as open, when it isn't (false positive), and fails to detect devtools when it is open in a separate window (false negative)…

Yeah, as other posters hint at, vertical tabs. But it isn't just vertical tabs that'll trigger it, any sidebar will, including native/vanilla ones; AFAICT it's just looking at the client area being less than the window by some threshold.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#120

Post by ajot »

lewisl9029 wrote: post #111
temp12192021 wrote: post #104

Earlier quoted context omitted.

https://sindresorhus.com/devtools-detect/ https://github.com/sindresorhus/devtools-detect EDIT: doesn't seem to work if I have devtools as a separate window

Vertical tabs in Edge seems to trigger false positives on this. Really hope that's not the only heuristic they're using.

Same goes for Sidebery in Firefox, but then it changes to "no" if I do open the Dev Tools. As a non web-dev, this behaviour is truly weird.
Post reply on HN