That's unfortunate. My muscle memory sometimes makes me open DevTools even unintentionally when I try to copy text and press Ctrl+Shift+C.
Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
81–90 of 204 posts
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#82When you open devtools, by default it will try to load source code maps for your JS and CSS. Very simple for a system to detect the request for the map file. If that's their vector turn off the autoloader and try from a clean IP.
Unfortunately console.log(foo) calls foo.toString() if and only if the console is open, and there is no way to disable this in Chrome or Firefox.
Edit: You can redefine console.log to be a noop, but that's also detectable.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#83Isn't this spying on the user without user's consent? Me opening dev tools to view the source is a private activity. Is it okay to collect this kind of info and use it to block access? Are there no regulations against this?
> Isn't this spying on the user without user's consent?
Yes.
> Is it okay to collect this kind of info and use it to block access?
No. It's not okay.
> Are there no regulations against this?
Probably not. In this case the remedy is to just use another service, or DIY. And I also think that's a pretty reasonable remedy, which will send a message to others considering such actions.
FWIW I would like to see regulations around intrusive spying on client machines via the browser or any other path. Ideally we'd get new, specific legislation around it. Something might also be done at the executive level at the FCC. Legislation is unlikely because of America's current flirtation with 3rd world style politics.
In terms of advocacy, I would assume that the EFF is of a similar view. Other human rights groups would be supportive of such measures, since in addition to protecting consumers, they protect journalists and their sources as well. The people against will be state security services and all businesses powered by a targeted ad engine.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#84Isn't this spying on the user without user's consent? Me opening dev tools to view the source is a private activity. Is it okay to collect this kind of info and use it to block access? Are there no regulations against this?
If it were a "private activity", they wouldn't know you did it. If your computer sends requests to their server about it, then it's not really fair of you to expect them not to be aware of it.
Does the computer really send requests to their server when I open dev tools? I checked and I couldn't find any request that was sent from Firefox or Chrome when I opened dev tools.
Aren't they using a JavaScript based detection mechanism like listening for browser events on the client side or latching on to debugger to pull this information? Sounds to me like they are going out of their way to pull private information from my system that I or my system or my browser had no intention of sharing with them.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#85Earlier quoted context omitted.
Hmm, I'm on Chrome 111 on Linux and there are two boxes for loading maps - one for JS and one for CSS. Could yours be a Windows Group Policy from $WORK?
I have 3 boxes: "Enable JavaScript source maps", "Enable CSS source maps", and "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons". The first 2 are checked but without the 3rd trying to load source maps doesn't seem to do anything unless I have them locally. It's very possible I'm just testing it wrong, I don't use source maps often. It's also very…
Our Chrome are the same - and load the maps by default.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#86This SO post is a bit old now, so I'd verify before proceeding, but it looks like having devtools open in a separate window will enable you to circumvent the check. https://stackoverflow.com/questions/40153206/detect-if-conso...
Or have it open before you visit the page. Assuming they are detecting a resize. But if they really detect a resize, anyone who actually does resize their page will be blocked as well. Doing that seems a bit insane to me.
Almost everyone resizes windows by manually dragging the corner. This will generate a series of resize events rather than a single jump. This is a real technique, but it tends to be used by shady piracy sites that want to stop piracy of their pirated contents.
There's another cute approach based on the fact console.log(foo) calls foo.toString if and only if the devtools is open.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#87Earlier quoted context omitted.
Rather than it being dev tools itself, I think it's more likely that your injected tags got POSTed to an API endpoint (or similar) in unescaped format, and were categorised by a WAF as attempted XSS. It's common for WAFs to block you for this kind of thing, unfortunately. Still ridiculous, but not quite the same thing as being banned for opening dev tools (of course, I am also speculating here, I guess we'd need to h…
Actually just opening the dev tools triggers it. The blacklist seems to expire on its own so I went ahead and opened the dev tools and did nothing more, reloaded, blocked.
Hopefully it doesn't have a "lets permanently ban this repeat offender" thing. (!)
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#88This is worrying since I have accidently opened dev tools hundreds of times by clicking both mouse buttons when my cursor is near the bottom of the screen. I have a tic disorder (not Tourette's, because my tics are all nonverbal). One of my tics is that I mash both mouse buttons over empty space pretty frequently. I even go out of my way to keep my cursor positioned over empty space so I can mash the mouse buttons wh…
I wonder if there's a plugin that could remove the context menu entry.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#89This is worrying since I have accidently opened dev tools hundreds of times by clicking both mouse buttons when my cursor is near the bottom of the screen. I have a tic disorder (not Tourette's, because my tics are all nonverbal). One of my tics is that I mash both mouse buttons over empty space pretty frequently. I even go out of my way to keep my cursor positioned over empty space so I can mash the mouse buttons wh…
It's incredibly easy to do on a MB pro with a touch bar if you keep the function keys visible and tap the minus key with an open and relaxed hand. I preface my notes with -- and == so I do it fairly often.
Re: Tell HN: MailChimp blacklists your IP if you open the browser's dev tools
#90When you open devtools, by default it will try to load source code maps for your JS and CSS. Very simple for a system to detect the request for the map file. If that's their vector turn off the autoloader and try from a clean IP.
Similarly, here are some techniques for debugger detection [0]. I've seen some crypto mining malware in the wild that did this to make deobfuscation more difficult.
[0] https://x-c3ll.github.io/posts/javascript-antidebugging/