Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 204 posts

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#71

Post by pupppet »

Retr0id wrote: post #64
pupppet wrote: post #17

I had to use their silly drag-and-drop email builder because I'm handing the email off to be edited by a non-dev. I dropped in a "Code" module so I could add some custom CSS but because a style tag generates no space, that module is no longer accessible via the UI as there's nothing to click on. So I thought oh brother I'll just inject a couple br tags via the Inspector and then poof, I'm in the doghouse.

Rather than it being dev tools itself, I think it's more likely that your injected tags got POSTed to an API endpoint (or similar) in unescaped format, and were categorised by a WAF as attempted XSS. It's common for WAFs to block you for this kind of thing, unfortunately. Still ridiculous, but not quite the same thing as being banned for opening dev tools (of course, I am also speculating here, I guess we'd need to h…

Actually just opening the dev tools triggers it. The blacklist seems to expire on its own so I went ahead and opened the dev tools and did nothing more, reloaded, blocked.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#72

Post by neilv »

Would be funny if it were a corporate reaction to a security researcher contacting them about some silly web API design (e.g., endpoint taking an arbitrary account ID without authorization check).

In the writeup, the researcher illustrates by copying the service URL from the browser's dev tools. And so the obvious corporate corrective action is...

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#73

Post by ravenstine »

xkcd1963 wrote: post #56

Hackers are always three steps ahead, whats the point?

I was thinking the same thing. If I was intent on using the dev tools for who knows what with MailChimp, it would merely be a roadblock. I might even be more compelled to achieve my goal just to defeat their bullshit.

Not that I would ever use MailChimp.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#75

Post by zamadatix »

djbusby wrote: post #58
zamadatix wrote: post #41

Earlier quoted context omitted.

Interesting to note. In Firefox "show original sources" seems to be enabled by default but in Chrome at least the settings checkbox is labeled "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons" and unchecked for me. Haven't checked Safari to see what its behavior is.

Hmm, I'm on Chrome 111 on Linux and there are two boxes for loading maps - one for JS and one for CSS. Could yours be a Windows Group Policy from $WORK?

I have 3 boxes: "Enable JavaScript source maps", "Enable CSS source maps", and "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons". The first 2 are checked but without the 3rd trying to load source maps doesn't seem to do anything unless I have them locally. It's very possible I'm just testing it wrong, I don't use source maps often. It's also very possible Firefox does something similar and I'm just overlooking the option/behavior there.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#78

Post by status200 »

bilekas wrote: post #67
djbusby wrote: post #32

When you open devtools, by default it will try to load source code maps for your JS and CSS. Very simple for a system to detect the request for the map file. If that's their vector turn off the autoloader and try from a clean IP.

This is interesting as for a hackathon i was thinking of ways to identify this behavior too. The source map requests was a more successful option. Also played around with "snap" resize but it was too agressive. As for whatever the reason MailChimp would block your up is pretty ridiculous.

I can only imagine the amount of security pressure they feel since they are basically a backdoor into easily stealing one or more company identities once you pass the 2FA, with full address books of customers that will trust emails deployed through MC campaigns and blindly click on links in the emails sent out, so I am guessing they err on the side of caution and have tons of false positives instead of letting anything pass through or disrupt.

Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools

#80

Post by eclipticplane »

scosman wrote: post #79

Mailchimp previously cranked up pricing on their Mandrill product dramatically, with minimal warning, no opt in, and unsympathetic tone from C-suite. Mailchimp is pretty hostile to developers. I don't recommend using them after that experience.

I'm convinced at this point they are trying to slowly tank Mandrill to get people to stop using it.

Tons of downtime, worsening delivery problems, no active development -- or support even -- for years, worse pricing, ...

Post reply on HN