Hacker News Reader

Comment by arcatek | Hacker News Reader

I remember seeing a demo of a website which didn't have any tag - I think the stylesheet was served by an http header that the browsers were automatically linking. I can't find the url.

[edit] Here it is! It still doesn't work in Chrome. http://css-tricks.com/using-css-without-html/

View on HN

Since we're talking about obscure hacks, I've seen a website putting ads in an <iframe>, whose URL was the same as the parent (top) URL, and there was even no HTTP request being done for an iframe document (probably due to the URL being already cached by the browser) - so it was not possible to block it via a blocking proxy.

I only managed to block it with the adblock's element hiding query like `domain.com##iframe` or through a userscript.

You went to all that trouble to block an ad? It must have been one hell of a distraction.

Or an interesting technical challenge. I know that's why I would have done it.

I remembered using this trick to put a "THIS IS STAGING" banner for my project back few years ago (after reading Eric Meyer's article[1]) It was pretty cool back then.

[1]: http://meyerweb.com/eric/thoughts/2009/01/22/using-http-head...

Far more interesting than a simple exploitation of the 'content' CSS attribute.

This, combined with data: URIs, could be fun...

I can see where the next exploits will come from, the stylesheet doesn't even appear on Firefox Dev Tools.

It does for me (Fx35, Windows), but yeah this looks pretty obscure, like the recent bash exploits from 30-year-old features barely anyone knew.

Apart from exploits, semi-related, I just hope the ad industry won't find out about using inline data URIs any soon. This would make ad blocking way more difficult.

Adds are served from a separate IP in part to keep websites honest. As long as this happens browsers can fairly easily tell what's an add. IMO, a more risky option is for add networks to start hosting webpages and I can easily see Google taking this approach.

Pity that it doesn't work in Webkit/Blink browsers, only in Firefox (and old Opera).

Reply on news.ycombinator.com