Hacker News Reader

Comment by Spivak | Hacker News Reader

What is allowing site JS to physically move the browser window on my screen and how do I burn this feature with fire?

This only works in popup windows. According to the guy who made this website [1] this is to stop cross-origin communication, which is quite interesting. But it also has the effect that if you force popup windows to appear in tabs rather than windows then you do indeed burn the feature with fire. And IMO it's worth doing anyway, because no one has the right to open a browser window on my computer except me. It's possible in FireFox by changing browser.link.open_newwindow.restriction to 0 in about:config [2].

[1] https://youtu.be/QFZ-pwErSl4?t=558

[2] https://support.mozilla.org/en-US/questions/1066799

FireFox used to have an option to disallow pop ups to move themselves... I can't find that setting anymore, and I think Chrome used to as well, it still might. It's one of the first things I disable on my browsers due to some prank sites using this tactic for maximum trolling.

The "dom.disable_window_move_resize" preference is still there. There doesn't seem to be UI for it, but it can certainly be set in about:config.

I wonder what could possibly be a use case why they would allow it and even built an API/interface for that.

"how do I burn this feature with fire?"

What I do (for different reasons, but would still be effective) is to not allow Javascript to execute. Sites that are so poorly designed that they cannot operate without Javascript enabled are sites I simply don't use.

Window.moveBy()

https://developer.mozilla.org/en-US/docs/Web/API/Window/move...

Reply on news.ycombinator.com