Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How does Facebook disable Developer Tools?

stackoverflow.com

Post reply on HN
Print view View original

21–30 of 90 posts

Re: How does Facebook disable Developer Tools?

#21

Post by ploxiln »

ihsw wrote: post #3
plorkyeran wrote: post #2

I'm sort of surprised that the developer tools have only recently become an attack vector (via social engineering). I'm not sure what can even really be done about it without seriously inconveniencing developers. Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?

Why not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.

If scammers can get people to open the developer console and paste code, they can get them to install the "developer tools extension" and then open the console and paste code. Add all the warnings you want, the scammer will say "see what facebook doesn't want you to see!!!".

This has been called the "dancing monkeys problem". People can really be manipulated into doing anything in order to see the dancing monkeys (even if they couldn't be convinced to do those things for constructive purposes).

IMHO you just can't save people from themselves, might as well stop trying and making my life harder.

Re: How does Facebook disable Developer Tools?

#23

Post by United857 »

djur wrote: post #20
samplonius wrote: post #15

Earlier quoted context omitted.

So downloading a 100KB extension for a browser which you use for downloading stuff all the time is a "huge barrier"? Wow, talk about a 1st world problem. And "when I teach ruby", "well ok, now download xcode"... ok, Xcode is a 2.5GB download, but it is a one click download and install via App Store. And really? Xcode for Ruby? Are you really doing that?

Xcode is necessary because Apple distributes an operating system without a C compiler, and standard Ruby development requires a C compiler. Why Apple distributes an incomplete operating system by default, and why they distribute their development environment as one monolithic chunk as opposed to a set of packages, is anyone's guess.

Last I checked, Windows also doesn't ship with a C compiler by default. Even some Linux distros don't have it in the default install.

Re: How does Facebook disable Developer Tools?

#25

Post by yen223 »

gkhnarik wrote: post #12
Strom wrote: post #8

Earlier quoted context omitted.

Because pasting doesn't work. Most browsers (like Chrome, IE) just remove the javascript: prefix from your pasted text, and some browsers (like Firefox) don't allow you to execute standard javascript from the address bar.

I agree. Chrome doesn't allow you do paste it, you have to type it. I believe they disable it soon too.

See the link in the accepted answer. If you try to paste in "javascript: blahblahblah", Chrome is smart enough to remove the "javascript: " part. What the attackers do instead is to tell the victim to type "j", then ctrl+v the rest "avascript: blahblahblah". Just tried it in Chrome, it goes through.

Re: How does Facebook disable Developer Tools?

#27

Post by SomeoneWeird »

yen223 wrote: post #25
gkhnarik wrote: post #12

Earlier quoted context omitted.

I agree. Chrome doesn't allow you do paste it, you have to type it. I believe they disable it soon too.

See the link in the accepted answer. If you try to paste in "javascript: blahblahblah", Chrome is smart enough to remove the "javascript: " part. What the attackers do instead is to tell the victim to type "j", then ctrl+v the rest "avascript: blahblahblah". Just tried it in Chrome, it goes through.

Clever.

Re: How does Facebook disable Developer Tools?

#29

Post by mweibel »

djur wrote: post #20
samplonius wrote: post #15

Earlier quoted context omitted.

So downloading a 100KB extension for a browser which you use for downloading stuff all the time is a "huge barrier"? Wow, talk about a 1st world problem. And "when I teach ruby", "well ok, now download xcode"... ok, Xcode is a 2.5GB download, but it is a one click download and install via App Store. And really? Xcode for Ruby? Are you really doing that?

Xcode is necessary because Apple distributes an operating system without a C compiler, and standard Ruby development requires a C compiler. Why Apple distributes an incomplete operating system by default, and why they distribute their development environment as one monolithic chunk as opposed to a set of packages, is anyone's guess.

Well i guess because 80% of mac users will never need a compiler.

Also instead of downloading the whole xcode you can download the xcode cli tools.

Re: How does Facebook disable Developer Tools?

#30

Post by grey-area »

djur wrote: post #20
samplonius wrote: post #15

Earlier quoted context omitted.

So downloading a 100KB extension for a browser which you use for downloading stuff all the time is a "huge barrier"? Wow, talk about a 1st world problem. And "when I teach ruby", "well ok, now download xcode"... ok, Xcode is a 2.5GB download, but it is a one click download and install via App Store. And really? Xcode for Ruby? Are you really doing that?

Xcode is necessary because Apple distributes an operating system without a C compiler, and standard Ruby development requires a C compiler. Why Apple distributes an incomplete operating system by default, and why they distribute their development environment as one monolithic chunk as opposed to a set of packages, is anyone's guess.

standard Ruby development requires a C compiler

Mac OS X comes with Ruby already installed, and afaik you don't need a C compiler to learn standard ruby, you'd only need it for certain gems (which want to build native extensions).

Post reply on HN