Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

React Armor: Protect your DOM from third-party tampering

github.com

Post reply on HN
Print view View original

31–40 of 55 posts

Re: React Armor: Protect your DOM from third-party tampering

#31

Post by na85 »

viraptor wrote: post #20
userbinator wrote: post #19

Earlier quoted context omitted.

user extensions affecting how the website works That's really the point of having them, isn't it? To make the site work the way the user wants. In fact I'd say what it will actually achieve is less visitors to your site... they're just going to leave and go somewhere else. I classify this along with the anti-right-click, disabling select/copy/paste, changing the status bar, resizing windows, and other general "DO NOT…

What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down. All of the things you mentioned are websites trying to break your expected beha…

>What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down.

Perhaps you should move away from the "just throw some js at it" mentality and learn to design things in a more robust fashion, so that they don't depend on having to make assumptions about the dom.

Re: React Armor: Protect your DOM from third-party tampering

#32

Post by btown »

But why stop there? Compile Chrome in Emscripten and render to canvas, with flickering to prevent screenshots! No DOM, no problems, right?

Until someone just types the data into Excel and manipulates it themselves. If you don't trust your user with data, don't show it to them in the first place!

Re: React Armor: Protect your DOM from third-party tampering

#33

Post by Zarel »

userbinator wrote: post #19
viraptor wrote: post #18

What they thought this will achieve is: people will stop using scripts that changes "ul li .Bar". What it will actually achieve is: people will spend more scripts to heuristically check which element under "ul li" could be ".Bar" based on the layout, attributes, and contents. Then they'll change "ul li .whatever", sometimes mistaking the class and getting a broken website. Or worse, they'll select on "ul li @backgrou…

user extensions affecting how the website works That's really the point of having them, isn't it? To make the site work the way the user wants. In fact I'd say what it will actually achieve is less visitors to your site... they're just going to leave and go somewhere else. I classify this along with the anti-right-click, disabling select/copy/paste, changing the status bar, resizing windows, and other general "DO NOT…

If only users were consistent and fair about what they wanted.

I wouldn't personally run something like this, but I've definitely experienced the frustration of having a user install an extension that changed my website, and then reported a bug in the extension to me.

Even when the extension is bug-free, it still adds a support burden. For instance, there's an extension that adds icons to usernames on my site. Users have asked me how to change their icon, and then gotten mad at me when I say I don't know.

It also adds a maintenance burden: Whenever I deploy various updates, I get complaints that the updates break one extension or another.

Not to mention, there are extensions not intentionally installed by users. For a while, there was some very common malware that rendered my website unusable. It added the text
But it did it badly, so it changed:
to

    cript.js">
Which, of course, rendered my site unusable.

Re: React Armor: Protect your DOM from third-party tampering

#34

Post by viraptor »

na85 wrote: post #31
viraptor wrote: post #20

Earlier quoted context omitted.

What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down. All of the things you mentioned are websites trying to break your expected beha…

>What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down. Perhaps you should move away from the "just throw some js at it" mentality and…

Reality test - can you show me a single website which has rich client-side script, gets html or json from the server, and adds a failure path for every single element/property access which does not succeed? (with failure path that doesn't depend on the rest of that content) Because that's what you seem to be suggesting.

Re: React Armor: Protect your DOM from third-party tampering

#35

Post by Zarel »

chao- wrote: post #24
viraptor wrote: post #22

Earlier quoted context omitted.

So basically you're ok with randomly getting broken pages if you use content-modifying browser extensions? If yes, no problem. If it's an issue - something's got to give.

Simple answer: Yes. Longer answer: I install any such extension with full knowledge of their potential to cause breakage, and consequently my first reaction to a broken page is to issue a reload with the extension disabled. The web being programmatically accessible and end-user-malleable is a strength, not a weakness.

But many (I'd put my money on "most") users' first reaction isn't to issue a reload with the extension disabled. A lot of users aren't even aware of what extensions they have installed, and their first reaction is to file a bug report to the website.

It would be nice if there was some way to prevent users from reporting bugs if they have extensions modifying the website in certain ways, or at least warn them to try disabling their extensions first. I wouldn't even mind a whitelist for certain well-behaved ad blockers, but certain extensions are well known for being bad (many extensions _inject_ ads, which is a recipe for website breakage).

Re: React Armor: Protect your DOM from third-party tampering

#36

Post by Dr_tldr »

Yeah, I genuinely don't understand what they're going for here. Anything that happens client-side can be modified by the client. Because, you know... it's on their side. Front-end validation and stuff is nice for UI/UX, but nothing that comes from the client should ever be trusted just because you put an obfuscated property on an input or something.

At the end of the day, it all has to be valid HTML tags and javascript that runs without crashing. In terms of security, nothing on the front end even registers on the scale. Absolute worst case scenario, it's like solving a Wheel Of Fortune where I have most but not all of the the letters.

I'm pretty uncomfortable with the description of a user on their own machine, running their own browser running plugins they chose and installed as a "third party" that's engaging in "tampering."

Re: React Armor: Protect your DOM from third-party tampering

#37

Post by pandeiro »

Zarel wrote: post #30
dmak wrote: post #26

Earlier quoted context omitted.

We handle over 1600 Japanese institutions at the company I am working for in Tokyo (Moneytree.jp), and we haven't arrived at a situation where we were defeated by what React Armor is trying to prevent.

I'm sorry, I've reread your sentence several times, and I still don't understand what it's trying to say. Does your company have the same goals React Armor has (this seems to be what your double-negative is saying), or is it the party React Armor is trying to protect against, or is it relevant to React Armor in some other way? What kind of Japanese institutions are these and what does handling them entail? Are you sc…

Oh come on, don't act like it isn't obvious. Do you think he isn't trying to be unclear?

Would you rather these Japanese institutions not be handled in some other way?

Re: React Armor: Protect your DOM from third-party tampering

#38

Post by Sanddancer »

Zarel wrote: post #33
userbinator wrote: post #19

Earlier quoted context omitted.

user extensions affecting how the website works That's really the point of having them, isn't it? To make the site work the way the user wants. In fact I'd say what it will actually achieve is less visitors to your site... they're just going to leave and go somewhere else. I classify this along with the anti-right-click, disabling select/copy/paste, changing the status bar, resizing windows, and other general "DO NOT…

If only users were consistent and fair about what they wanted. I wouldn't personally run something like this, but I've definitely experienced the frustration of having a user install an extension that changed my website, and then reported a bug in the extension to me. Even when the extension is bug-free, it still adds a support burden. For instance, there's an extension that adds icons to usernames on my site. Users…

If you want or need pixel perfect and all kinds of fancy javascript to run your site, maybe you should just make a program instead, even if it's a wrapper around some browser engine.

Re: React Armor: Protect your DOM from third-party tampering

#39

Post by Zarel »

Sanddancer wrote: post #38
Zarel wrote: post #33

Earlier quoted context omitted.

If only users were consistent and fair about what they wanted. I wouldn't personally run something like this, but I've definitely experienced the frustration of having a user install an extension that changed my website, and then reported a bug in the extension to me. Even when the extension is bug-free, it still adds a support burden. For instance, there's an extension that adds icons to usernames on my site. Users…

If you want or need pixel perfect and all kinds of fancy javascript to run your site, maybe you should just make a program instead, even if it's a wrapper around some browser engine.

I actually do offer that too, for precisely that reason, but of course many people prefer the online version. And browser extensions and things like Stylish let people do some pretty neat things. It's just a support nightmare. :(
Post reply on HN