Hacker News Reader

Comment by walrus01 | Hacker News Reader

There is no way that 'pointer lock' should be something you can just click and get your pointer hijacked. You could label that button anything or make it any clickable element. Who the hell at web browser developers thought that was a good idea to implement?

Why not have a "Do you want to allow this site to take control of your pointer?" prompt, same as when a site first wants to use your microphone or camera?

View on HN

I get a "$WEBSITE has control of your pointer. Press Esc to take back control" message in Firefox when that happens, and the message is pretty big and in your face. Does other popular browsers not have this message? Solves the problem in an elegant way.

Interestingly, in Firefox, if I trigger the Protocol Handler permission and then Pointer Lock, the Pointer Lock notification is hidden by the Protocol Handler bar. Seems like this could be abused.

Screen recording:

https://b-cdn.s3.maddison.io/99Q967Cnvz--2021-03-26_02-58-20...

There are a ton of use cases that demand it, so it was added a long time ago (around the same time as Fullscreen, I think). The current user experience for it (opt-out instead of opt-in) has likewise been around for ages. I think I remember seeing an explicit permission prompt very early on but they got rid of it.

"You could label that button anything" sadly applies to a significant number of dangerous things a website can do, pointer lock is not near the top of the list.

I think lots of stuff like RDP extensions, or browser-based gaming (e.g. Stadia) are using it.

Maybe it's used for fullscreen games?

I'm sure it is, and works great for that, I just think it needs one more layer of user consent and understanding before it's turned on.

I see it in emulators, like this one: https://www.pcjs.org/software/pcx86/sys/windows/3.10/

(click one of the Windows apps once it boots)

I was surprised by this too, now have in firefox about:config dom.pointer-lock.enabled = false

Reply on news.ycombinator.com