Hacker News Reader

Comment by EastSmith | Hacker News Reader

Cool hack.

May be it is time for browsers to disable iframes by default and ask the end user if they want to run them via the standard browser confirmation mechanisms site by site.

View on HN

And then you have a confirmation on almost every page, and then you run into dialog box fatigue where users will blindly click through them, and you've gained nothing.

Sites can already send an 'X-Frame-Options: deny' header to prevent being framed.

Or use CSPv2's frame-ancestors.

There are so many individual pieces of HTML and JS that I wish I could do this with. Mostly web APIs. On a URL-by-URL basis.

you all should install uMatrix webextension and stop just "wishing". the future is now :)

Does uMatrix let me block specific JS web APIs and HTML elements like iframes? It never could in the past.

uMatrix can block frames and js requests on a domain/sub-domain level. afaik, it can't block at url level, if that's what you meant.

That said, uMatrix, from what I remember, uses the webRequest api which does work from urls. So if you know JS, you can always create an extension and add your own filter.

To be clear, on the JS side I'm talking about providing whitelist-only access to things like the ambient light level, which is provided through a standardized browser API.

yes. I block iframes globally and the web never been better.

it will show a checkered pattern with a link to open the frame in another window. so you don't even have to whitelist sites or anything. if you care about the frame, like for a embedded video, just open it on its own tab with a single click

Did they fix the problem where disabling javascript didn't enable the `<noscript>` tag?

Reply on news.ycombinator.com