Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

React Armor: Protect your DOM from third-party tampering

github.com

Post reply on HN
Print view View original

41–50 of 55 posts

Re: React Armor: Protect your DOM from third-party tampering

#41

Post by jon-wood »

na85 wrote: post #31
viraptor wrote: post #20

Earlier quoted context omitted.

What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down. All of the things you mentioned are websites trying to break your expected beha…

>What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down. Perhaps you should move away from the "just throw some js at it" mentality and…

How exactly do you propose people should write JavaScript to control their UI which doesn't make at least some assumptions about that UI?

Re: React Armor: Protect your DOM from third-party tampering

#42

Post by Piskvorrr »

blairanderson wrote: post #23

so many haters here... Make things that solve your problems. Have fun while doing it. Continue.

Well, this is now a new problem. My new problem. Are you saying I should now devote time to solving this problem of mine? Oh. It doesn't sound very fun, though. Now what?

Re: React Armor: Protect your DOM from third-party tampering

#43

Post by _0w8t »

The tool is cool but in practice just detecting that DOM is violated and notifying the user in one way or another (like reducing functionality of the site) should work better. Also it is much harder to defeat especially if detection takes into account the layout.

Update: the detection-only also helps with accessibility as obfuscated DOM makes it impossible to use with screen readers etc.

Re: React Armor: Protect your DOM from third-party tampering

#44

Post by Klathmon »

Zarel wrote: post #28
somesomesom wrote: post #21

Earlier quoted context omitted.

Why should I care about what the website owner wants? It's my computer running his shitty Javascript. I get to choose how this client-side Javascript runs because I get to choose how every kind of software runs on my own computer.

Yes, but most users don't take responsibility for the extensions they install quite that way. The problem comes if you install a browser extension (or acquire malware that installs a browser extension for you), forget about it, and then blame the website when the website stops working, often filing bug reports (increasing the support load of the website).

And don't forget the bad-mouthing on social media.

Just look at hacker news. Many posts have someone complaining how the site is broken only to find out they have disabled scripts or have a night mode extension, or disabled webgl but forgot about it, or they programed their router to drop all packets that were going to a url that included "google" anywhere in it (including mysite.com/google-blog-post, true story)

Re: React Armor: Protect your DOM from third-party tampering

#45

Post by gobbert »

Sanddancer wrote: post #38
Zarel wrote: post #33

Earlier quoted context omitted.

If only users were consistent and fair about what they wanted. I wouldn't personally run something like this, but I've definitely experienced the frustration of having a user install an extension that changed my website, and then reported a bug in the extension to me. Even when the extension is bug-free, it still adds a support burden. For instance, there's an extension that adds icons to usernames on my site. Users…

If you want or need pixel perfect and all kinds of fancy javascript to run your site, maybe you should just make a program instead, even if it's a wrapper around some browser engine.

Unfortunately, asking people to install something and keep it updated is a huge deterrent for casual users.

Re: React Armor: Protect your DOM from third-party tampering

#46

Post by Roritharr »

Zarel wrote: post #30
dmak wrote: post #26

Earlier quoted context omitted.

We handle over 1600 Japanese institutions at the company I am working for in Tokyo (Moneytree.jp), and we haven't arrived at a situation where we were defeated by what React Armor is trying to prevent.

I'm sorry, I've reread your sentence several times, and I still don't understand what it's trying to say. Does your company have the same goals React Armor has (this seems to be what your double-negative is saying), or is it the party React Armor is trying to protect against, or is it relevant to React Armor in some other way? What kind of Japanese institutions are these and what does handling them entail? Are you sc…

In the context of moneytree.jp the institutes in question are most likely banks that are reluctant to offer APIs, so the only option for Software Integrators is Web-Scraping.

In Germany we have figo.io that allows the local startup scene to access german banks. From what i can gather from their API its also done in part by scraping.

Some Banks want to obstruct the scraping and the author claims that none of the tricks React Armor offers have thwarted his company so far.

Re: React Armor: Protect your DOM from third-party tampering

#47

Post by userbinator »

Zarel wrote: post #33
userbinator wrote: post #19

Earlier quoted context omitted.

user extensions affecting how the website works That's really the point of having them, isn't it? To make the site work the way the user wants. In fact I'd say what it will actually achieve is less visitors to your site... they're just going to leave and go somewhere else. I classify this along with the anti-right-click, disabling select/copy/paste, changing the status bar, resizing windows, and other general "DO NOT…

If only users were consistent and fair about what they wanted. I wouldn't personally run something like this, but I've definitely experienced the frustration of having a user install an extension that changed my website, and then reported a bug in the extension to me. Even when the extension is bug-free, it still adds a support burden. For instance, there's an extension that adds icons to usernames on my site. Users…

Users have asked me how to change their icon, and then gotten mad at me when I say I don't know.

How about explaining it better? Get them to show you a screenshot, and then you can point out the fact that it's not coming from code you served.

For a while, there was some very common malware that rendered my website unusable.

Perhaps that was a good thing, because it made you aware of its presence quickly.

Re: React Armor: Protect your DOM from third-party tampering

#49

Post by Zarel »

userbinator wrote: post #47
Zarel wrote: post #33

Earlier quoted context omitted.

If only users were consistent and fair about what they wanted. I wouldn't personally run something like this, but I've definitely experienced the frustration of having a user install an extension that changed my website, and then reported a bug in the extension to me. Even when the extension is bug-free, it still adds a support burden. For instance, there's an extension that adds icons to usernames on my site. Users…

Users have asked me how to change their icon, and then gotten mad at me when I say I don't know. How about explaining it better? Get them to show you a screenshot, and then you can point out the fact that it's not coming from code you served. For a while, there was some very common malware that rendered my website unusable. Perhaps that was a good thing, because it made you aware of its presence quickly.

> How about explaining it better? Get them to show you a screenshot, and then you can point out the fact that it's not coming from code you served.

You presume users understand what the difference is. Not all users are technical enough for that sort of thing.

Someone also points out a related problem: if the user complains on social media instead of directly to me. I don't always have the opportunity to explain at all.

> Perhaps that was a good thing, because it made you aware of its presence quickly.

Unfortunately, being aware of its presence didn't help much. I considered alerting the user that they had malware, but generally the only time a website tells a user they have malware is to scam a user (see: MacKeeper), and I didn't want users to see my site as untrustworthy.

Post reply on HN