Hacker News Reader

Comment by munsters | Hacker News Reader

I had no idea what a DX7 cartridge was, but out of curiosity I clicked the "Click here to generate" link. It immediately downloaded a file.

I'm sure you have no malicious intent here, but my immediate reaction was that it's a virus or something bad. I immediately deleted the file. The experience felt like one of those scammy popups that initiates a download.

You should really put a label or something to indicate to the user that clicking the link is going to download something.

View on HN

I think people are talking about "Click" differently.

- There is a click on the link on this page that leads to the webpage. Nothing is downloaded at this time.

- There is a click on the target webpage "Click to generate cartridge". Those who know what DX7 is, who are presumably a target audience, would understand this will generate a file.

For those who do not know what DX7 is or what's happening, well... why are you clicking in the first place - if you have no idea what'll happen, a file is a legitimate possibility;) - but I think mostly it'll differ whether they have "Always ask me where to download" (in which case it'll prompt for location), or "Always download in default folder", in which case yes indeed it'll download a file.

But at that point you've already clicked two times voluntarily on a strange page whose provenance or purpose you don't know, AND you have enabled "Don't ask me for downloads", AND you didn't bother to scroll down two millimeters for explanation but just clicked on first thing that said click me, soooooo... at some point it's no longer author's responsibility and the cries lose their credibility ¯\_(ツ)_/¯

There have been a bunch of these sites that were images, before. It's not unreasonable to expect that it would generate another image and display it.

"But at that point you've already clicked two times voluntarily on a strange page whose provenance or purpose you don't know"

How many times have you clicked on an HN submission that you already knew 100% about? This site is for people to showcase their projects, of course curious visitors are expected to poke around.

This app looked like a single page - it's not at all obvious it's even possible to scroll down. It resizes to the browser window so the FAQ is always hidden unless you scroll. This is quite obviously based off "this face does not exist", so its perfectly reasonable to expect it to play something in the browser.

That it automatically downloaded a file is down to your browser, not the site. If you have "ask before downloading" (or similar) set, it'll prompt to download.

Well that is a common social vulnerability of the Hacker News crowd: if you give a link to some binary file for any retro system people here will install an emulator it runs on and execute it, ever if you say that it's actually a viral payload. For example: http://swiftlytilting.com/downloads/PCM.demo.wgraphics.zip (that is viral)

It is difficult to overstate how strongly I want to download and poke through that file, even knowing it's a bad idea.

Just unzip it and then cat the contents into aplay!

dQw4w9WgXcQ alert!! :)

That is cool. It's even a valid NES cartridge according to `file`. Nice. I needed `aplay -f 16` FWIW.

I shall respond with this: https://www.youtube.com/watch?v=iJgNpm8cTE8

Technically you want to increase the sample rate (to around 14.5kHz) rather than change the depth to 16, but yeah it basically works either way.

Oh, thanks. And that's hilarious that both work.

I tried to run it in my homegrown emulator - sadly it crashed because I haven't implemented mapper 2 (and bank swapping). If it's what I think it is though, you're right, very viral. ;)

This appears specific to your setup and testing process. I tried this with several browsers, and this did not occur for me.

Browsers: Firefox, Chrome, Edge

Perhaps you're referring to the link on the website which says "Click here to generate Cartridge!"?

Which follows the somewhat expected path for the picture context.

I had the same thing happen on Safari on iOS.

I did not expect to be downloading a file, either. Like many people, I have no idea what a "DX7 cartridge" is. From context, I assumed this was a picture generator like "This face does not exist".

I know what one is. I'm a fan of fm synthesis and dx-model synths and variants.

But if I had known it automatically downloaded a patch I wouldn't click. It did this without me clicking anything.

What browser are you using? It requires a click for me on Firefox. From a quick glance at the source I don't see anything that would automatically initiate a download.

Chrome 81.0, Android.

Reply on news.ycombinator.com