Some harmless, old-fashioned fun with CSS | Hacker News Reader

Some harmless, old-fashioned fun with CSS

lcamtuf.blogspot.com

105 pointsspindritf32 comments

"Sorry, this game works only in Firefox and Chrome."

Welcome back to 1998. For the record, it works fine in Safari too. Why do people even do this?

It should be obvious. They are likely developing on a Mac, primarily in Chrome. They check it in Firefox, maybe resolve 5-minutes worth of bugs, then call it a day.

It's a demo, and firing up VMs or slow BrowserStack instances isn't worth their time; they already accomplished what they wanted for their target audience: themselves.

Modern Safari is impossible to test against without buying a Mac ever since Apple stopped releasing current nightlies. (Running Safari6 in a VM isn't adequate since it disables webgl and changes some other behaviors)

That is false. There are plenty of inexpensive services that let you use an in-browser remote desktop client to test against many different web browsers, including Safari.

I just told you why those don't work. They don't have a real GPU so WebGL and other features don't work or don't behave like a real mac. Try it yourself against a website that uses modern HTML5 features. Same goes for audio.

But this doesn't use WebGL or audio, and in fact runs perfectly well in a VM, so what exactly is your point?

Also, "modern HTML5 features" covers plenty of things that work well without a GPU. It is only a tiny set of features that do not work. For the vast majority of modern sites, testing via a VM works just fine.

If it hasn't been tested in Safari, they should not state that it does not work in Safari. A better message would be "We have only tested this in Chrome and Friefox on Windows, so this application might not work for you."

It is a bit like the difference between "File X does not exist", and "Could not find a file named X". Computer programs should be polite to the limit of serfdom, or they will come over as arrogant.

I believe that http://nightly.webkit.org is what you want. You'll have to build it yourself, but that can be automated.

So now we're complaining that our security vulnerabilities aren't cross-platform enough?

No, he was complaining that it is more cross-platform than they say it is.

I was more annoyed about the screen resolution limitations that are greater than the majority of laptop resolutions still in common use (though I will concede that the quality of laptop screens have been abysmal until lately)

Yeah, this sucks, but why is this the top comment? This is just some uninteresting nitpick about the implementation and adds nothing to the topic that is covered here. This is a brilliant proof of concept and who gives two shits which browsers this works with as long as we can use it somehow and learn from it?

This is very cute, but I think the CAPTCHA attack it cites is more interesting: a CAPTCHA can be inserted just about anywhere without raising undue alarm, CSS allows the text to be warped almost (if not exactly, with CSS shaders) like a real, image-based, CAPTCHA, and the user directly types back what was seen rather than the site having to guess based on performance on an asteroids game.

Even if text is not warped I doubt users are concerned. Some CAPTCHAs are better than others, some warp the text more than others, so unwarped letters not necessarily stand out.

Wait, how is he doing this? Wish there was a tiny bit more explanation in the post...

CSS lets you color links based on whether the user has visited them or not.

Most of the Asteroids in the game are links - they use those same CSS rules to color themselves based on whether you've visited them or not.

Script on the page can't tell what color the asteroids are, but it can tell what asteroids you've clicked on. By making the visited-link color the same as the background color of the webpage, we get the user to give away the color of the links, because they'd only be clicking on the links that they can see - the ones with a color different to the background.

Thank you, that was a much clearer explanation of what was happening. Also explains why I'd occasionally see a black circle drift over one of the colored ones.

Thanks, that was a clearer explanation than his. Nifty.

Btw, why do they want to do this?

Imagine you had a brilliant idea to start a company which served demographically targeted advertisements to users across the web. Since you are brand-spanking-new you have very little data about users. You need to find a way to quickly and cheaply build demographic data about users so you can actually accomplish your mission.

If you launch a ton of these types of games, you could build a pretty decent database of user's browsing histories. If you are using news sites as your sites of interest, you could use that browsing history to build up demographic data about each of the people who play your game (demographics for large sites like CNN are pretty well known).

There are certainly other reasons, but this is the first one that came to mind.

Real life example - back when the CSS history snooping trick still worked, a travel site I worked on used to offer additional discounts to people who'd visited competitor sites that we knew were beating our regular pricing.

he's tossing a bunch of link elements that are 0x0 px with an 8px border at your ship for you to click on. Only ones with addresses you've visited are visible:

a:visited { background-color:pink;}

Because you're clicking the border and not the element which is 0x0 you're not redirected but he knows the mouse position and from there can figure out which link you clicked on.

To get picky, it's actually border-color:pink;

oops, right on!

http://i.imgur.com/2fhLhPF.png

That's cute.

I got the same, and I'm relatively sure I've visited Facebook and Twitter at least once...

Then perhaps you didn’t shoot all the asteroids?

yeah it said I did not visit http://www.facebook.com/home.php when I have and I shot all asteroids.

https?

I got http://i.imgur.com/SVweWee.png

Read that paper linked by the article.

Those attacks look so fun! I like the LCD attack in particular.

I hope this demo doesn't send any data back to a server, or else, Hello FBI.

It tells me I need a higher resolution screen. Bummer. Guess my tiny bedside netbook is safe then

Reply on news.ycombinator.com