Hacker News Reader

Comment by GrumpySloth | Hacker News Reader

Downloading a file is something that happens automatically when you e.g. navigate (or are automatically redirected) to a link which is served with Content-Type of application/octet-stream. Example: <https://0x0.st/H7bb.bin>. If you don’t modify your browser somehow, it’s not something you as a user can protect yourself against.

View on HN

Not that I'd recommend browsing on an older, unpatched OS, but the modification in question is easy, and IMO worth the extra single click or keypress it introduces in exchange for eliminating "drive-by downloads" from questionable sites.

Chrome: Settings → Downloads → check "Ask where to save each file before downloading".

Edge: Settings → Downloads → check "Ask me what to do with each download".

Firefox: Settings → General → under "Files and Applications", check "Always ask you where to save files".

Safari (macOS): Settings → General → as "File download location", choose "Ask for each download". While you're here, uncheck "Open “safe” files after downloading" (Apple scare quotes "safe" appropriately, yet AFAIK still enables this option by default, even after it's been a factor in multiple exploits over the years).

Hmm. It looks like files with the .lnk or .pif file extension can only be downloaded on a user gesture: https://chromium.googlesource.com/chromium/src/+/39841e54180...

So it can't be done silently. Although, I do wish the type was marked "DANGEROUS" a la dll files.

Reply on news.ycombinator.com