Hacker News Reader

Comment by crakenzak | Hacker News Reader

What are the implications of this? Can’t you just curl/wget the html?

Chrome uses a `view-source` scheme to trigger showing the source of a web page. This change allows Chrome Enterprise administrators to add `view-source:*` to their blocklist so Chrome instances governed by an enterprise policy with that enabled (like at a school or company) wouldn't be able to visit those pages and so wouldn't be able to view source in the browser.

Would also need to block ctrl+s/save. Which seems pretty drastic for anything other then a dedicated testing machine.

Also pasting "javascript:whatever" in the omnibar. I'm sure there's some nice version of:

  javascript:alert(document.body.innerHTML);

You can't actually paste that into the omnibar in chrome. It will eat the first part.

Yes, you have to manually type "javascript:" then paste the code. Or copy everything but the leading 'j' and hand type that after pasting. Or put it in a bookmark. Also, alert() truncates the text, but makes for a nice short demo. You could append a <pre> element to the page, or similar.

Taking advantage of a long-lost HTML tag (<plaintext>) that tells the parser to switch the tokenizer to "PLAINTEXT" state[0] with no escape:

    javascript:document.body.innerHTML="<plaintext>"+document.body.innerHTML

From MDN[1]:

> The <plaintext> HTML element renders everything following the start tag as raw text, ignoring any following HTML. There is no closing tag, since everything after it is considered raw text.

You could use the <pre> tag, but that can be "escaped" from if a </pre> tag exists on the page. Escaping the angle brackets with < and > would fix it, but <plaintext> is more elegant IMO.

[0]: https://html.spec.whatwg.org/#plaintext-state

[1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/pl...

Yeah, that works great. Then the kids just put that in a bookmark called "view-source". Probably also easy enough to make another bookmark that puts it back to normal.

This kind of stuff can make sense when you consider "enterprise" environments like school labs.

Notice on the bug report that the reproduction steps include setting a "DeveloperToolsDisabled" registry entry. Curl / wget wouldn't always be accessible in this kind of locked down setup (and they're probably trying to make it difficult even if it's impossible to block completely).

Doesnt this solution strike you as scorched earth? Kids figure out things, instead of improving said software, lockdown the actual browser?

It's nearsighted to the point of disbelief.

At that level of pay you stop caring for anything making sense?

Just saying. Apart from drug addicts doing blunt cybercrimes, I find the most creapy things are done by devs that got used to a big paycheck -- additionally, sometimes got fkd in academia before and just became a well trained cynic.

You have to be logged in to Google to use Google Forms. You can emulate a login using curl/wget but it's harder.

You could also install another browser if that was allowed.

Seems like they have added the ability to block devtools on sites as well...

Certainly seems like we'll need tools which don't close things off like this.

On computers that would use this "feature", curl and wget wouldn't be available for use.

Or look in the network tab too?

You can block devtools as well it looks like

Reply on news.ycombinator.com