Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

React Armor: Protect your DOM from third-party tampering

github.com

Post reply on HN
Print view View original

21–30 of 55 posts

Re: React Armor: Protect your DOM from third-party tampering

#21

Post by somesomesom »

viraptor wrote: post #20
userbinator wrote: post #19

Earlier quoted context omitted.

user extensions affecting how the website works That's really the point of having them, isn't it? To make the site work the way the user wants. In fact I'd say what it will actually achieve is less visitors to your site... they're just going to leave and go somewhere else. I classify this along with the anti-right-click, disabling select/copy/paste, changing the status bar, resizing windows, and other general "DO NOT…

What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down. All of the things you mentioned are websites trying to break your expected beha…

Why should I care about what the website owner wants? It's my computer running his shitty Javascript.

I get to choose how this client-side Javascript runs because I get to choose how every kind of software runs on my own computer.

Re: React Armor: Protect your DOM from third-party tampering

#22

Post by viraptor »

somesomesom wrote: post #21
viraptor wrote: post #20

Earlier quoted context omitted.

What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down. All of the things you mentioned are websites trying to break your expected beha…

Why should I care about what the website owner wants? It's my computer running his shitty Javascript. I get to choose how this client-side Javascript runs because I get to choose how every kind of software runs on my own computer.

So basically you're ok with randomly getting broken pages if you use content-modifying browser extensions? If yes, no problem. If it's an issue - something's got to give.

Re: React Armor: Protect your DOM from third-party tampering

#24

Post by chao- »

viraptor wrote: post #22
somesomesom wrote: post #21

Earlier quoted context omitted.

Why should I care about what the website owner wants? It's my computer running his shitty Javascript. I get to choose how this client-side Javascript runs because I get to choose how every kind of software runs on my own computer.

So basically you're ok with randomly getting broken pages if you use content-modifying browser extensions? If yes, no problem. If it's an issue - something's got to give.

Simple answer: Yes.

Longer answer: I install any such extension with full knowledge of their potential to cause breakage, and consequently my first reaction to a broken page is to issue a reload with the extension disabled.

The web being programmatically accessible and end-user-malleable is a strength, not a weakness.

Re: React Armor: Protect your DOM from third-party tampering

#25

Post by chao- »

blairanderson wrote: post #23

so many haters here... Make things that solve your problems. Have fun while doing it. Continue.

Widespread deployment of this will make a number of people's lives less fun. In response, pro-fun countermeasures will be created to solve their new problem.

Or, to quote a comment on a technology discussion site about this project:

"And so begins an arms race."

Re: React Armor: Protect your DOM from third-party tampering

#26

Post by dmak »

trengrj wrote: post #10

This should be called React Obfuscate rather that React Armor. I've done a fair amount of web scraping before and each of their tricks can be broken with enough care. Obfuscating html not only breaks many of the good things about the web but also makes things harder to debug.

We handle over 1600 Japanese institutions at the company I am working for in Tokyo (Moneytree.jp), and we haven't arrived at a situation where we were defeated by what React Armor is trying to prevent.

Re: React Armor: Protect your DOM from third-party tampering

#27

Post by angersock »

gcb0 wrote: post #13
na85 wrote: post #4

Hooray, get ready for broken websites with modal overlays, CSS popups, ads, and tracking built-in, and no way to disable them!

broken user scripts and styles. f-up accessibility and screen readers. seriously. wtf.

But think of the ads!

Can't get in the way of that!

Re: React Armor: Protect your DOM from third-party tampering

#28

Post by Zarel »

somesomesom wrote: post #21
viraptor wrote: post #20

Earlier quoted context omitted.

What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down. All of the things you mentioned are websites trying to break your expected beha…

Why should I care about what the website owner wants? It's my computer running his shitty Javascript. I get to choose how this client-side Javascript runs because I get to choose how every kind of software runs on my own computer.

Yes, but most users don't take responsibility for the extensions they install quite that way.

The problem comes if you install a browser extension (or acquire malware that installs a browser extension for you), forget about it, and then blame the website when the website stops working, often filing bug reports (increasing the support load of the website).

Re: React Armor: Protect your DOM from third-party tampering

#29

Post by Untit1ed »

userbinator wrote: post #19
viraptor wrote: post #18

What they thought this will achieve is: people will stop using scripts that changes "ul li .Bar". What it will actually achieve is: people will spend more scripts to heuristically check which element under "ul li" could be ".Bar" based on the layout, attributes, and contents. Then they'll change "ul li .whatever", sometimes mistaking the class and getting a broken website. Or worse, they'll select on "ul li @backgrou…

user extensions affecting how the website works That's really the point of having them, isn't it? To make the site work the way the user wants. In fact I'd say what it will actually achieve is less visitors to your site... they're just going to leave and go somewhere else. I classify this along with the anti-right-click, disabling select/copy/paste, changing the status bar, resizing windows, and other general "DO NOT…

In general that's true, but it's a bit of a different story with React because it tends to throw errors if the DOM is modified outside of it.

Re: React Armor: Protect your DOM from third-party tampering

#30

Post by Zarel »

dmak wrote: post #26
trengrj wrote: post #10

This should be called React Obfuscate rather that React Armor. I've done a fair amount of web scraping before and each of their tricks can be broken with enough care. Obfuscating html not only breaks many of the good things about the web but also makes things harder to debug.

We handle over 1600 Japanese institutions at the company I am working for in Tokyo (Moneytree.jp), and we haven't arrived at a situation where we were defeated by what React Armor is trying to prevent.

I'm sorry, I've reread your sentence several times, and I still don't understand what it's trying to say.

Does your company have the same goals React Armor has (this seems to be what your double-negative is saying), or is it the party React Armor is trying to protect against, or is it relevant to React Armor in some other way?

What kind of Japanese institutions are these and what does handling them entail? Are you scraping or modifying DOM, or are the institutions? Are you obfuscating DOM, or are the institutions?

Post reply on HN