News for hackers. Stuff that matters.
Re:React Armor: Protect your DOM from third-party tampering by Zarel on Tuesday March 01, 2016 @07:11AM (#11202126)
> How about explaining it better? Get them to show you a screenshot, and then you can point out the fact that it's not coming from code you served.

You presume users understand what the difference is. Not all users are technical enough for that sort of thing.

Someone also points out a related problem: if the user complains on social media instead of directly to me. I don't always have the opportunity to explain at all.

> Perhaps that was a good thing, because it made you aware of its presence quickly.

Unfortunately, being aware of its presence didn't help much. I considered alerting the user that they had malware, but generally the only time a website tells a user they have malware is to scam a user (see: MacKeeper), and I didn't want users to see my site as untrustworthy.

Re:React Armor: Protect your DOM from third-party tampering by Jordrok on Tuesday March 01, 2016 @12:18PM (#11204229)
Er...so if you didn't tell them it was malware, then what DID you tell them?
Re:React Armor: Protect your DOM from third-party tampering by Zarel on Tuesday March 01, 2016 @05:03PM (#11206478)
I didn't tell them anything. I just deployed a workaround where the <script> tag the malware inserted was between <!-- and -->.

https://github.com/Zarel/Pokemon-Showdown-Client/commit/95f2...