Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

401–410 of 448 posts

Re: Why Is This Website Port Scanning Me?

#401

Post by klodolph »

neurostimulant wrote: post #345
klodolph wrote: post #329

Earlier quoted context omitted.

These kind of complaints are based on a misunderstanding of how JS works or how the browser works. You can do the same exact thing in JS right now. In fact, if anything, JavaScript makes this way easier than WASM. With JS, you can just use something like Rollup or Webpack to put your analytics code in the same code.

Yeah but using webpack is not how majority of websites deployed, so it's probably not worth the effort for ads companies to support it. They will consider this when webpack/wasm become mainstream enough (approaching 50% web), which may or may not happen. Probably won't happened but the thought always linger in my mind.

WASM is way less popular than Webpack.

Almost every site with some kind of front-end framework like React will use a bundler of some kind.

Re: Why Is This Website Port Scanning Me?

#402

Post by [deleted] »

pdonis wrote: post #177
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> Firefox also seemingly blocks access to 192.168/24 and 10/8 Chrome, OTOH, will happily open a websocket to these IP ranges. Another good reason not to use Chrome.

[deleted]

Re: Why Is This Website Port Scanning Me?

#403

Post by usr1106 »

jackewiehose wrote: post #102
habyte wrote: post #88

Earlier quoted context omitted.

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

The alternative is to ask the user on a site basis.

Right. Firefox is open source. Why is nobody adding prompts for Web Sockets, WebGL, Web Assembly and all the new stuff that a security / privacy concerned user has at least mixed feelings about. Prompts are not a good solution for a wider audience, but at least they satisfy the curiosity of power users and offer the possibility to leave the site if you get the feeling it's too dodgy.

Re: Why Is This Website Port Scanning Me?

#404

Post by dragonwriter »

pdonis wrote: post #177
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> Firefox also seemingly blocks access to 192.168/24 and 10/8 Chrome, OTOH, will happily open a websocket to these IP ranges. Another good reason not to use Chrome.

> Chrome, OTOH, will happily open a websocket to these IP ranges. Another good reason not to use Chrome.

Why is “I can use websockets on a private network” a bad thing?

Re: Why Is This Website Port Scanning Me?

#405

Post by dreamcompiler »

pantalaimon wrote: post #353
marcojrfurtado wrote: post #80

Earlier quoted context omitted.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

Yea this is very surprising. I run a file server in my local network. There is no access control on it because it’s behind my router’s firewall, but everyone in the LAN can access it. I find it very surprising that now any random website can access it with no oversight. Why worry about spectre and meltdown when such blatant backdoors are implemented in browsers?!

Does your file server speak HTTP? If so you might have a problem. If not, it sounds like it's inaccessible to this attack, except to discover that it exists.

Re: Why Is This Website Port Scanning Me?

#408

Post by sadfklsjlkjwt »

Thriptic wrote: post #362
anderspitman wrote: post #351

Earlier quoted context omitted.

Note that the further I went down the sandboxing rabbit-hole, the more questions it raised about whether it's more or actually less secure. The main problem is that in order to work, these tools often use a setuid binary, which actually has more permissions than most users. So in theory if a sandboxed app finds an exploit in the sandboxing program (like firejail) that you're running inside, you could actually be wors…

It's also possible to run a web browser in a docker container which can be interacted with on the host OS. This avoids the permissions issues with solutions like firejail: https://blog.jessfraz.com/post/docker-containers-on-the-desk...

Please don't suggest using Docker to sandbox a GUI app.

Re: Why Is This Website Port Scanning Me?

#409

Post by sadfklsjlkjwt »

lxdquestion wrote: post #369
willglynn wrote: post #364

Earlier quoted context omitted.

`docker` implies access to the Docker daemon, which is not an improvement over the setuid binaries anderspitman found distasteful. https://docs.docker.com/engine/security/security/#docker-dae...

Genuine question, would LXD be any better? I'm not an expert in containerization but I find it really interesting. There are some blogs that talk about how to do this: https://blog.simos.info/how-to-easily-run-graphics-accelerat...

If it runs in the same Xwindows session no.

Re: Why Is This Website Port Scanning Me?

#410

Post by asveikau »

Wowfunhappy wrote: post #288
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

I realize Hacker News isn't a hivemind, but I see these two assertions frequently, and I find the contradiction striking: 1. Why are web browsers becoming application platforms? Web browsers are document readers, and we should treat them as such. 2. Why does Zoom (or Slack, or insert-thing-here) want me to download a native app? I should be able to do it in my web browser! I sympathize with both philosophies, but the…

Actually I think there's middle ground or a way to somewhat satisfy both.

Does Zoom, Slack, or insert-thing-here need the technical ability to portscan localhost in the manner of this blog post? Well, Zoom had their vulnerability making web requests to their app bound to localhost, but did they need to be able to do it? They could get the job done without that functionality.

They already have both an app and a web-only experience. (They try to hide the latter by only presenting the option when the former has evidently failed, but it's still there.) So, it has it both ways by your 1 & 2. Almost as if users should be able to choose.

Post reply on HN