41–50 of 191 posts
Earlier quoted context omitted.
By visiting a YouTube video, I am giving YouTube my consent to play me a video, including any sound it might contain. I completely expect YouTube videos to play sound and am prepared for it, unlike websites such as this.
All it takes is a redirect.
FYI, if you're on IE10, hitting the Stop button seems to throw a local storage exception and doesn't clear the space.
Earlier quoted context omitted.
I bet it would still work in Firefox but it would be more expensive, because you'd need to purchase a lot of top-level domains to pull it off.
But at $185,000 a piece, who will be doing that?
Or, you could buy one regular domain and then ask to be put on the public suffix list. I'm guessing that would have the same effect for less money.
Though I can't quite imagine why anyone would want to do this to some random stranger. Unless you knew the visitor or had some means of personally identifying him/her, there are more devastating ways of filling up a remote HD with just an IP and hostname (nmap and friends come to mind).
Earlier quoted context omitted.
But at $185,000 a piece, who will be doing that?
Actually, you'd only need to buy one TLD! Or, you could buy one regular domain and then ask to be put on the public suffix list. I'm guessing that would have the same effect for less money.
Well this is frightening. You don't even need to create subdomains since basically anyone with wildcard subdomains enabled can do this without a sweat. All you need is a random number generator and rewrite x.domain.com to domain.com and the browser is none the wiser. Though I can't quite imagine why anyone would want to do this to some random stranger. Unless you knew the visitor or had some means of personally ident…
Earlier quoted context omitted.
You can use Firefox. Firefox actually implements a reasonable storage limit policy for this. 10MB for an entire domain (all subdomains included)
I bet it would still work in Firefox but it would be more expensive, because you'd need to purchase a lot of top-level domains to pull it off.
If you are, say, the North Korean government, or have a close relationship with some small island registrar, you can register any number of domains you like for peanuts.
A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.com has full access if that's what the user is currently viewing directly in their browser.
.example.com embedded via iframes could either get read-only access, or read-write access for existing keys. Also maybe limited to, lets say, 4K.
This sounds like a really complicated solution though. Any better ideas?