News for hackers. Stuff that matters.
Re:React Armor: Protect your DOM from third-party tampering by userbinator on Monday February 29, 2016 @11:02PM (#11200699)
user extensions affecting how the website works

That's really the point of having them, isn't it? To make the site work the way the user wants. In fact I'd say what it will actually achieve is less visitors to your site... they're just going to leave and go somewhere else.

I classify this along with the anti-right-click, disabling select/copy/paste, changing the status bar, resizing windows, and other general "DO NOT WANT" aspects of sites.

Re:React Armor: Protect your DOM from third-party tampering by Zarel on Tuesday March 01, 2016 @12:23AM (#11200937)
If only users were consistent and fair about what they wanted.

I wouldn't personally run something like this, but I've definitely experienced the frustration of having a user install an extension that changed my website, and then reported a bug in the extension to me.

Even when the extension is bug-free, it still adds a support burden. For instance, there's an extension that adds icons to usernames on my site. Users have asked me how to change their icon, and then gotten mad at me when I say I don't know.

It also adds a maintenance burden: Whenever I deploy various updates, I get complaints that the updates break one extension or another.

Not to mention, there are extensions not intentionally installed by users. For a while, there was some very common malware that rendered my website unusable. It added the text

    <script src="http://example.com/malware.js"></script>
But it did it badly, so it changed:

    <script src="/legitimatescript.js"></script>
to

    <script src="/legitimates<script src="http://example.com/malware.js"></script>cript.js"></script>
Which, of course, rendered my site unusable.
Re:React Armor: Protect your DOM from third-party tampering by Sanddancer on Tuesday March 01, 2016 @01:11AM (#11201045)
If you want or need pixel perfect and all kinds of fancy javascript to run your site, maybe you should just make a program instead, even if it's a wrapper around some browser engine.
Re:React Armor: Protect your DOM from third-party tampering by Zarel on Tuesday March 01, 2016 @02:39AM (#11201276)
I actually do offer that too, for precisely that reason, but of course many people prefer the online version. And browser extensions and things like Stylish let people do some pretty neat things. It's just a support nightmare. :(
Re:React Armor: Protect your DOM from third-party tampering by gobbert on Tuesday March 01, 2016 @05:53AM (#11201941)
Unfortunately, asking people to install something and keep it updated is a huge deterrent for casual users.
Re:React Armor: Protect your DOM from third-party tampering by userbinator on Tuesday March 01, 2016 @06:39AM (#11202046)
Users have asked me how to change their icon, and then gotten mad at me when I say I don't know.

How about explaining it better? Get them to show you a screenshot, and then you can point out the fact that it's not coming from code you served.

For a while, there was some very common malware that rendered my website unusable.

Perhaps that was a good thing, because it made you aware of its presence quickly.

Re:React Armor: Protect your DOM from third-party tampering by Zarel on Tuesday March 01, 2016 @07:11AM (#11202126)
> How about explaining it better? Get them to show you a screenshot, and then you can point out the fact that it's not coming from code you served.

You presume users understand what the difference is. Not all users are technical enough for that sort of thing.

Someone also points out a related problem: if the user complains on social media instead of directly to me. I don't always have the opportunity to explain at all.

> Perhaps that was a good thing, because it made you aware of its presence quickly.

Unfortunately, being aware of its presence didn't help much. I considered alerting the user that they had malware, but generally the only time a website tells a user they have malware is to scam a user (see: MacKeeper), and I didn't want users to see my site as untrustworthy.

Re:React Armor: Protect your DOM from third-party tampering by Jordrok on Tuesday March 01, 2016 @12:18PM (#11204229)
Er...so if you didn't tell them it was malware, then what DID you tell them?
Re:React Armor: Protect your DOM from third-party tampering by Zarel on Tuesday March 01, 2016 @05:03PM (#11206478)
I didn't tell them anything. I just deployed a workaround where the <script> tag the malware inserted was between <!-- and -->.

https://github.com/Zarel/Pokemon-Showdown-Client/commit/95f2...

Re:React Armor: Protect your DOM from third-party tampering by Untit1ed on Tuesday March 01, 2016 @12:01AM (#11200885)
In general that's true, but it's a bit of a different story with React because it tends to throw errors if the DOM is modified outside of it.
Re:React Armor: Protect your DOM from third-party tampering by viraptor on Monday February 29, 2016 @11:12PM (#11200734)
What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down.

All of the things you mentioned are websites trying to break your expected behaviour. This is the exact opposite - your extension is breaking the expected behaviour and the website wants you to leave it alone.

Re:React Armor: Protect your DOM from third-party tampering by somesomesom on Monday February 29, 2016 @11:16PM (#11200745)
Why should I care about what the website owner wants? It's my computer running his shitty Javascript.

I get to choose how this client-side Javascript runs because I get to choose how every kind of software runs on my own computer.

Re:React Armor: Protect your DOM from third-party tampering by Zarel on Monday February 29, 2016 @11:51PM (#11200852)
Yes, but most users don't take responsibility for the extensions they install quite that way.

The problem comes if you install a browser extension (or acquire malware that installs a browser extension for you), forget about it, and then blame the website when the website stops working, often filing bug reports (increasing the support load of the website).

Re:React Armor: Protect your DOM from third-party tampering by Klathmon on Tuesday March 01, 2016 @05:44AM (#11201924)
And don't forget the bad-mouthing on social media.

Just look at hacker news. Many posts have someone complaining how the site is broken only to find out they have disabled scripts or have a night mode extension, or disabled webgl but forgot about it, or they programed their router to drop all packets that were going to a url that included "google" anywhere in it (including mysite.com/google-blog-post, true story)

Re:React Armor: Protect your DOM from third-party tampering by viraptor on Monday February 29, 2016 @11:23PM (#11200765)
So basically you're ok with randomly getting broken pages if you use content-modifying browser extensions? If yes, no problem. If it's an issue - something's got to give.
Re:React Armor: Protect your DOM from third-party tampering by chao- on Monday February 29, 2016 @11:33PM (#11200798)
Simple answer: Yes.

Longer answer: I install any such extension with full knowledge of their potential to cause breakage, and consequently my first reaction to a broken page is to issue a reload with the extension disabled.

The web being programmatically accessible and end-user-malleable is a strength, not a weakness.

Re:React Armor: Protect your DOM from third-party tampering by Zarel on Tuesday March 01, 2016 @12:29AM (#11200948)
But many (I'd put my money on "most") users' first reaction isn't to issue a reload with the extension disabled. A lot of users aren't even aware of what extensions they have installed, and their first reaction is to file a bug report to the website.

It would be nice if there was some way to prevent users from reporting bugs if they have extensions modifying the website in certain ways, or at least warn them to try disabling their extensions first. I wouldn't even mind a whitelist for certain well-behaved ad blockers, but certain extensions are well known for being bad (many extensions _inject_ ads, which is a recipe for website breakage).

Re:React Armor: Protect your DOM from third-party tampering by na85 on Tuesday March 01, 2016 @12:05AM (#11200895)
>What do you do if you create a website which modifies the dom, but find out what your users have extension XYZ which completely breaks are our assumptions about what the dom is? For example you just received a server-rendered page which should have "ul/li/span.Foo", but find out that the span is a link now instead, so your JS breaks down.

Perhaps you should move away from the "just throw some js at it" mentality and learn to design things in a more robust fashion, so that they don't depend on having to make assumptions about the dom.

Re:React Armor: Protect your DOM from third-party tampering by viraptor on Tuesday March 01, 2016 @12:25AM (#11200941)
Reality test - can you show me a single website which has rich client-side script, gets html or json from the server, and adds a failure path for every single element/property access which does not succeed? (with failure path that doesn't depend on the rest of that content) Because that's what you seem to be suggesting.
Re:React Armor: Protect your DOM from third-party tampering by jon-wood on Tuesday March 01, 2016 @03:47AM (#11201499)
How exactly do you propose people should write JavaScript to control their UI which doesn't make at least some assumptions about that UI?