Hacker News Reader

Comment by socalgal2 | Hacker News Reader

This has been around since 2011 when WebGL shipped. It's documented in the spec. It's a self correcting problem. You go to a site, it freezes your machine, you never visit the site again.

No data is stolen, no privacy is lost. All that happens is the perp loses any audience.

Turning off WebGL = no more Figma, no more Canva, no more Google Maps. A few self correcting sites seem acceptable. Evidence, it's been 15 years since this was possible and the world didn't end and the whole internet isn't freezing your machine.

Also, this is arguably a MacOS bug. Window and Linux have had GPU monitors that power cycle the GPU if a command takes too long. Windows since before WebGL shipped. Linux a few years after. Macs still don't recover from excessive GPU use.

View on HN

This take feels too cavalier.

Since the machine is actually frozen, it enables many plausible social engineering scams ("We have detected a virus that froze your machine. Call this number for help..."), and I bet it has been used that way.

Not to mention possible data loss, interruption of work at a critical time, and so on.

Do you think a regular user knows how to block a specific website or never click a link leading to it again? And what about the ads people, adding such a thing if you don't load their ads?

I think this point of view is making it a bit too easy.

A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes. Guess I won't go there again"

> I think this point of view is making it a bit too easy.

It's been 15 years since this was possible. How many times have you heard of this being an issue? Again, it's self correcting. Site freezes machine, user stops going to site. There's zero incentive to do this and tons of incentive to not do it. Even an ad, your ads would get banned, not good for you, no incentive.

> A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes.

Not true, given any unknown link or button press can redirect/go to such a site.

I think a lot of HN commenters are way too disconnected from the average person. You're making a big assumption that a user will even connect the dots until the same thing happens multiple times, if even then. The average computer user is extremely bad at connecting cause and effect on their computer. Think of how many times you hear "my computer is broken!" when actually it's something like the printer was unplugged/turned off and they were just having trouble printing a document (or, if you are so disconnected from average users/people, the answer is _this happens a lot_). Even what we think of as simple stuff completely befuddles them.

> I think a lot of HN commenters are way too disconnected from the average person

This is basically an old-man-and-the-starfish situation for me.

> You're making a big assumption that a user will even connect the dots

If they do, it’s because their wildly inaccurate mental model happened to guess the right answer. What most will think is “I was just browsing the internet and my computer froze.” Maybe they’ll connect it with that notification they just got about renewing their antivirus software subscription. Maybe it will confirm their (probably mistaken) impression that their computer has been “acting weird” since something arbitrary and unrelated happened. And similarly, some people with an accurate mental model will mistakenly assume that they deduced the cause because they’re smarter, rather than having a different focus with corresponding lacking mental models in other areas.

You sir, are very aware of how the average computer user thinks!

It’s one of design’s key responsibilities. Developers need a sophisticated mental model of how it works, and how that gets displayed. Designers need a sophisticated mental model of what problems various users are trying to solve, and the best ways to communicate how the software can solve those problems, as well as state, etc. They’re both deep topics, and even as someone with significant professional experience in both design and development, I find it difficult to consider both things at once. Many things that are very important to design could be a serious PITA for developers. Many tools, such as front-end frameworks, that are important time savers in the dev environment are a serious PITA for designers to work around. Many designers don’t understand why seemingly small changes, maybe something that would require hand-rolling a common library component, could triple development time and cause huge maintenance issues. I’d say most developers don’t realize that their understanding of software architecture and construction is nearly useless when designing interfaces, workflows, etc., and that many of the folk ‘best practices’ they’ve learned about design are no more authoritative than any other folk knowledge computer users pick up. They sound like completely nontechnical gamers confidently wielding technical jargon to mis-explain phenomena people experience, and since none of the other gamers in the conversation know any better, it only bolsters their false confidence. Unfortunately, that alone explains why FOSS developers in independent projects repeatedly try and fail to make software that appeals to anybody other than software developers.

Yes, a lot of HN commenters are disconnected from reality. The reality is this issue existed for 15 years and there's been no issue. But here, HNers are freaking out like it's the end of the world and WebGL and WebGPU must be banned, even though they have 16 years of evidence to the contrary and zero evidence to back up their made up fears

An average user will not know that the site caused the issue. The first time after force turning off the computer, it will restart and reopen all windows causing the computer to crash again. The next time, they might click on the button to prevent reopening all windows and everything will be fine until they opens safari which will cause the same issue. At that point, they'll call whoever is their computer expert user to help them out.

It's worse than that: a default macOS install with Safari will re-open Safari, complete with re-opening the tab that was open upon a hard power off and power back on.

So to get it to stop doing this on restart, I had to be very quick to force-quit Safari as the machine rebooted. You don't get a chance to tell it "Don't reopen all windows" when you hold the power button down.

Not sure if it’s a setting but my mac definitely asks me if I want to reopen windows after a forced reboot.

This is hilarious, and what if an bad actor abuses this and makes a script or browser plugin which goes to this url every time a browser is launched?

What about url shorteners and redirects?

You seem to dismiss the issue based on a very narrow avoidable case.

They are addressing the fact that no bad actor will care to make it, not that they can't.

Sure, there are countless ways it could be abused, and you point out some, but what had actor will want to pursue even one? They gain nothing. And good actors only lose out, in the form of lost credibility and future audience. Therefore it doesn't get abused and a fix isn't needed.

The last 15 years is evidence of the argument.

Im arguing against the parent point that "Site freezes machine, user stops going to site." Its a gross oversimplification, and it doesnt hold water becasue there are lots of other vectors to a user coming across this than just "oh I recognise that web address as bad so I wont go there".

> but what had actor will want to pursue even one? They gain nothing

Ask that to anyone who has ever rickrolled somebody.

As someone who supports some bottom of the barrel "regular users".. they aren't monkeys. They have brains that function enough to process "oh, I shouldn't do that again".

Nitpick: monkeys have enough brains for "oh, I shouldn't do that again".

Is that really an important detail? I think what I said got my point across.

My brain stuck on the inaccurate monkey comparison and caused unnecessary work to get past it and back onto the point you were making.

Sometimes you guys think too much..

A better analogy would have reduced required thought. But here we are.

Yes, it's disrespectful to monkeys. Monkeys have feelings too.

Well if one reads my comment I'll consider apologizing.

Ad impressions typically cost money, so there's a case to be made that this is sort of self-correcting too.

That being said, IMO no website should be able to freeze your machine. This is a bug. Steps should be taken to fix it.

> And what about the ads people, adding such a thing if you don't load their ads?

Through what mechanism? You don’t load their code, so then they presumably load this malicious code? If they could do that they would have just loaded the ad!

You could be blocking specific third-parties. I know I do. Site owner could load from other party, that you happen to have whitelisted for example. Or site owner could use first party scripts for that, feeling smug showing their anti-ad-block warning and then bombing you, if after some time you don't comply and deactivate your ad-blocking solution.

You can lose data though. Any open documents which aren't saved...

> It's a self correcting problem. You go to a site, it freezes your machine, you never visit the site again.

What do regular users do about a malicious ad that runs on thousands of different sites?

> Turning off WebGL = no more Figma, no more Canva, no more Google Maps

Which is why you should probably rather turn off the actual vulnerable API, i.e. WebGPU, not WebGL.

It really ought to be something you can enable or disable per site. I was surprised to find its not.

Maybe a browser extension could inject JS in a tab to redefine all the WebGPU API into a noop.

I just remembered and checked. Noscript does allow blocking webgl on a per site basis.

I just don’t think people are doing malicious ads like that. Like I’m sure it exists but like what’s the point? If you are the malicious person you pay money for ads to freeze someone’s computer and that’s it? It’s not even like you would gain anything from it

Failure to imagine an incentive doesn't mean there isn't one. You can't rely on this type of thinking to reason about security. The thing you would have never thought of is what gets you.

For example, an ad provider itself can be hacked by a malicious party, so the "pay money for" part no longer applies.

Or an attack by a state actor or other large entity, where paying for a coordinated disruption of some region or company makes financial or military sense.

Those are just two things that came to my mind, and are likely a fraction of plausible incentives someone might have now or in the future. People are creative and unpredictable. Weird shit happens. Fact is stranger than fiction...

Instead, just ask: should visiting a website ever have the power to freeze your computer without your consent? If you think the answer is no, this is a security bug and it should be fixed.

That’s why I said I’m sure it does exist but based on it only freezing the computer until you reboot it that’s not useful for hackers doing it to make money and doesn’t seem that useful for disruption unless of course you do hack a bigger ad network then I could see it legitimately being disruptive rather than a slight nuisance. It definitely should be fixed though, it’s crazy it’s gone so long with no fix

> All that happens is the perp loses any audience

You haven't heard about rickrolling, have you?

So you're saying it's a feature?

Reply on news.ycombinator.com