Interesting. Chrome's "Under the Hood > Content Settings > Mouse Cursor" setting doesn't affect this. I would have thought it would prevent this.
Also, stuff like this is why we can't have nice things in browsers. You can't trust the internet.
Also, stuff like this is why we can't have nice things in browsers. You can't trust the internet.
Javascript makes a lot of cool stuff possible, but outside of some heavy-weight web applications that I have to trust anyway like my webmail interface or online storage manager, or games where the interactive components are the only reason why I'm visiting the site to begin with, I'm starting to wonder whether trusting the internet is not inviting more trouble than it's worth.
Maybe I'm "old-fashioned" but I'd love to go back to all the sites I visit functioning with just static web content, no clientside scripting at all, and letting me consume videos and stuff in a trusted media player plugin.
More and more of the applications we use and our private data live in the cloud. We now access our personal files, manage our bank and investment accounts, and make retail purchases on our web browser.
Browsing the web with JavaScript enabled by default allows code written by complete strangers to run on your browser!
There have been various vulnerabilities (especially in IE) but just like any other software they get fixed.
Leave aside the various vulnerabilities (including cross-site-scripting ones!) that get discovered with disturbing frequency, and please consider the subject of this thread: it's possible to make someone click a "Like" button without their realizing it! How many other similar tricks can JavaScript be used for by people with nefarious intentions?
No matter how "safe" any runtime environment is, allowing strangers to execute arbitrary code on your computer is never a great idea.
This is why I allow JavaScript code to run on my browser only when it comes from sources I trust.
HTML5 generally solves this with <audio> and <video>. If implemented correctly by browsers, they should not require any scripting on the site itself to work.
That said, "trusted" media player plugins (think Flash) have been the targets of many successful attacks as well.
I'm thinking a dumb unscriptable video playback frame that draws its own controls and isn't remote-controlled by javascript.
I've seen plenty of sites that see that see I don't have javascript enabled (or unblocked) and conclude that welp, that guy probably doesn't have speakers, let's display a unhelpful message instead of embedding media content.
Of course there'll still be some attack surface just like people have been managing to exploit image decoding libraries over the years, but at least it wouldn't be engineered against usability by default.