Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 204 posts

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#151

Post by suresk »

1970-01-01 wrote: post #100

https://mailchimp.com/about/security/#Protecting_Ourselves_A... >Yes, you heard that correctly. We can secure ourselves like Fort Knox, but if your computer gets compromised and someone gets into your Mailchimp account, that's not good for either of us. So mailchimp is SOC2, ISO, PCI, etc. and still gets worried about themselves if a user account is hacked.

Not defending their actions in this particular case, but yes, I think it is completely reasonable for a service like MailChimp to be concerned about unauthorized use of user accounts. If someone takes over a MailChimp account, it is almost certainly to send spam/fraud type stuff, which causes harm to MailChimp in various ways.

Compliance with those standards doesn't mean they aren't potentially impacted by that sort of thing, and doing what they can to detect and mitigate unauthorized user account usages is part of at least a few of them.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#152

Post by JeremyBanks »

Karellen wrote: post #150
djbusby wrote: post #32

When you open devtools, by default it will try to load source code maps for your JS and CSS. Very simple for a system to detect the request for the map file. If that's their vector turn off the autoloader and try from a clean IP.

TIL about source code maps. ...and how to disable them from auto-loading. I mean, okay, I can see how they definitely have a use. But to try and auto-fetch js and css maps just because I want to have a look at the DOM? Why not wait until I actually try looking at js/css? Or even until I ask to see the source map? Prefetching never feels right to me. Even though I know GET requests are supposed to be side-effect free…

[dead]

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#154

Post by iudqnolq »

easrng wrote: post #149
iudqnolq wrote: post #82

Earlier quoted context omitted.

Unfortunately console.log(foo) calls foo.toString() if and only if the console is open, and there is no way to disable this in Chrome or Firefox. Edit: You can redefine console.log to be a noop, but that's also detectable.

I can't repro, how are you getting it to call toString?

const foo = () => {}

foo.toString = () => console.warn("called")

console.log(foo)

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#155

Post by sli »

ajot wrote: post #120
lewisl9029 wrote: post #111

Earlier quoted context omitted.

Vertical tabs in Edge seems to trigger false positives on this. Really hope that's not the only heuristic they're using.

Same goes for Sidebery in Firefox, but then it changes to "no" if I do open the Dev Tools. As a non web-dev, this behaviour is truly weird.

Looking at the code[0], it just defines an aspect ratio threshold (170px in either direction, on line 13) for your browser's viewport and triggers if it's outside of that on width or height. So when you open a second panel, your viewport goes back to being closer to 16:9/16:10 and the tool considers that within both thresholds.

The detection is hilariously primitive, entirely unreliable, and only knows about your devtools directly if you're using Firebug.

[0]: https://github.com/sindresorhus/devtools-detect/blob/main/in...

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#156

Post by iudqnolq »

quickthrower2 wrote: post #140
iudqnolq wrote: post #130

Earlier quoted context omitted.

You could also fork Chrome.

You could also fuck Mailchimp

I stopped using them years ago for other reasons. We're talking about how to do research into their fuckery here, I'm not suggesting it's sane to fork a browser to make a company's crapware work.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#157

Post by Crosseye_Jack »

andrewstuart wrote: post #153

There as another site - I can't recall which - when you open developer tools it had a recruiting ad there and asked you to apply.

Many sites do it, but the one I always recall is reddit.

EDIT:

BBC news puts a rather fancy one in the console

Facebook puts a warning about self xss in the console.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#158

Post by sli »

temp12192021 wrote: post #104
pupppet wrote: post #17

I had to use their silly drag-and-drop email builder because I'm handing the email off to be edited by a non-dev. I dropped in a "Code" module so I could add some custom CSS but because a style tag generates no space, that module is no longer accessible via the UI as there's nothing to click on. So I thought oh brother I'll just inject a couple br tags via the Inspector and then poof, I'm in the doghouse.

https://sindresorhus.com/devtools-detect/ https://github.com/sindresorhus/devtools-detect EDIT: doesn't seem to work if I have devtools as a separate window

Wow, that code is entirely unreliable. It just detects your browser's viewport being outside of some threshold of a "normal" aspect ratio and then just blindly assumes that means the devtools are open. The only devtool it can actually detect is Firebug. Everything else is nothing but a blind guess based on the size of your viewport. I'd be astonished if anyone used this code for anything serious.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#160

Post by dbl000 »

andrewstuart wrote: post #153

There as another site - I can't recall which - when you open developer tools it had a recruiting ad there and asked you to apply.

I think both Facebook and Discord do that. I know that the Discord webapp has a big warning along the lines of "copy pasting code here can lead to a compromised account" and then a message about "if you know what you are doing, come work for us".
Post reply on HN