Not to minimise this issue but there are other ways for websites to silently waste user bandwidth. I think the real issue here is that it crashes Chrome and can render the computer unresponsive.

So can a screwed up iOS app

http://www.troyhunt.com/2014/10/find-crazy-stuff-in-mobile-a...

"Here’s a pop quiz for you: how much data do you reckon this iPad app downloads when it first runs? I don’t mean how big it is to download from the App Store (it’s 25MB), I mean after you download it then simply tap the icon to fire it up, how much data does it pull down if you don’t touch it again? ... Try 1.8 gigabytes. You heard me, that’s not a typo. You open up this 25MB app and it’ll pull down dozens of files of dozens of meg each when you run it. Won’t someone please think of the bandwidth!!!"

It'd be nice if downloading over X MB in a day was an extended permission just like access to contacts/photos/etc. is.

Only if you mobile browser actually download them, ios for example from what it looks like doesn't.

Some folks use cell (direct or tethered) on our laptops.

Check out the PRs on the repo - there is a PR demonstrating this exploit in iOS.

So can an ajax loop.

Or a big HTML file.

An ajax loop requires you to have JavaScript enabled and will show you a loader indicator.

> loader indicator

There is nothing with Ajax that does that automatically or even by default.

How about just an huge image? The programmer implementing the ajax call doesn't necessary have to implement a loader indicator either...

The browser will give you a visual indicator (a loading sign) at the browser level for images or AJAX and JavaScript can be disabled.

With the favicon issue these things don't happen.

I'm pretty sure I've never seen a loading indicator for AJAX either in Safari or Chrome.

True but the amount of webpages I visit where the spinning icon never stops spinning, I don't really pay it a 2nd thought. An enormous image set to hidden would have a similar effect.

Mind you I'm sat at home with a 300Mbps fibre connection, so I don't give as much thought to bandwidth as a roaming 4G/3G user might.

True, regarding JS.

Web workers will not show a loader indicator however. You could probably do a nice DDoS attack like this even. But it requires users to be on your site anyway. Might as well just stick 0day du jour on it.