Re:React Armor: Protect your DOM from third-party tampering
by Jordrok on Tuesday March 01, 2016 @12:18PM
(#11204229)
Er...so if you didn't tell them it was malware, then what DID you tell them?
Re:React Armor: Protect your DOM from third-party tampering
by Zarel on Tuesday March 01, 2016 @05:03PM
(#11206478)
I didn't tell them anything. I just deployed a workaround where the <script> tag the malware inserted was between <!-- and -->.
https://github.com/Zarel/Pokemon-Showdown-Client/commit/95f2...
You presume users understand what the difference is. Not all users are technical enough for that sort of thing.
Someone also points out a related problem: if the user complains on social media instead of directly to me. I don't always have the opportunity to explain at all.
> Perhaps that was a good thing, because it made you aware of its presence quickly.
Unfortunately, being aware of its presence didn't help much. I considered alerting the user that they had malware, but generally the only time a website tells a user they have malware is to scam a user (see: MacKeeper), and I didn't want users to see my site as untrustworthy.