This is interesting as for a hackathon i was thinking of ways to identify this behavior too.

The source map requests was a more successful option. Also played around with "snap" resize but it was too agressive.

As for whatever the reason MailChimp would block your up is pretty ridiculous.

I can only imagine the amount of security pressure they feel since they are basically a backdoor into easily stealing one or more company identities once you pass the 2FA, with full address books of customers that will trust emails deployed through MC campaigns and blindly click on links in the emails sent out, so I am guessing they err on the side of caution and have tons of false positives instead of letting anything pass through or disrupt.

Interesting to note. In Firefox "show original sources" seems to be enabled by default but in Chrome at least the settings checkbox is labeled "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons" and unchecked for me. Haven't checked Safari to see what its behavior is.

Hmm, I'm on Chrome 111 on Linux and there are two boxes for loading maps - one for JS and one for CSS.

Could yours be a Windows Group Policy from $WORK?

I have 3 boxes: "Enable JavaScript source maps", "Enable CSS source maps", and "Allow DevTools to load resources, such as source maps, from remote file paths. Disabled by default for security reasons". The first 2 are checked but without the 3rd trying to load source maps doesn't seem to do anything unless I have them locally. It's very possible I'm just testing it wrong, I don't use source maps often. It's also very possible Firefox does something similar and I'm just overlooking the option/behavior there.

Our Chrome are the same - and load the maps by default.

Unfortunately console.log(foo) calls foo.toString() if and only if the console is open, and there is no way to disable this in Chrome or Firefox.

Theoretically you could also write a bookmarklet that could inspect or modify globals. Or a greasemonkey script.

You could also fork Chrome.

You could also fuck Mailchimp

I stopped using them years ago for other reasons. We're talking about how to do research into their fuckery here, I'm not suggesting it's sane to fork a browser to make a company's crapware work.

I can't repro, how are you getting it to call toString?

const foo = () => {}

foo.toString = () => console.warn("called")

console.log(foo)

Doesn't work on Firefox.

This is not true, at least in Chrome. I've tried with an object with the `toString` property set, and tried with a function with an updated prototype. In both cases, Chrome just...displays the object.

I just ran the poc I posted in this sibling comment[1] on Chrome Version 111.0.5563.65.

[1]: https://news.ycombinator.com/item?id=35240559

Similarly, here are some techniques for debugger detection [0]. I've seen some crypto mining malware in the wild that did this to make deobfuscation more difficult.

[0] https://x-c3ll.github.io/posts/javascript-antidebugging/

TIL about source code maps.

...and how to disable them from auto-loading.

I mean, okay, I can see how they definitely have a use. But to try and auto-fetch js and css maps just because I want to have a look at the DOM?

Why not wait until I actually try looking at js/css? Or even until I ask to see the source map?

Prefetching never feels right to me. Even though I know GET requests are supposed to be side-effect free and idempotent (and if they're not, that's a choice by the server devs and they'd better have covered all the edge cases where clients correctly act as if they are...), it has the architectural equivalent of a "code smell" to my nose.