Eric Lawrence

It is frustrating how slow .zip (and more recently .7z) support built into Windows Explorer is. This is a great article on why it's so unreasonably slow to modify these archives: https://textslashplain.com/2021/06/02/leaky-abstractions/ But it doesn't seem to explain why it's so much slower at regular extraction.

I fear we're regressing. There is a concept in browser UX design called the "line of death"[1] - the delineation between trusted browser UX and untrusted website UX. Unfortunately, because it looks ugly, every new year of visual designers further weaken its guarantees. Here's an interesting anecdote from an earlier time. In the 2000s, back when the internet was a lot newer, and UX best practices were much less well understood, and internet users were starting to see the first big wave of "evil" websites, many of us independently discovered a surprisingly simple and surprisingly effective mitigation. If you choose a custom browser theme, preferably with bright colors, websites can't fake browser UX elements. The default theme will clearly mismatch, and websites can't guess what theme you did pick. [1] - https://textslashplain.com/2017/01/14/the-line-of-death/

For those who are new to this, the classic article on this kind of phishing is The Line of Death [0]. Basically, the phishing site can create false title and URL bars. [0] https://textslashplain.com/2017/01/14/the-line-of-death/

Oh great, a security nightmare come true. https://textslashplain.com/2017/01/14/the-line-of-death/

I am reminded very strongly of the line of death: https://textslashplain.com/2017/01/14/the-line-of-death/ Now, don't get me wrong, I love the idea of progressive web apps, but the web is also easily the very least secure thing I do with my computer on a regular basis. The last thing I want is yet another way for a web page to pretend to look like a native app. Even with my decades of experience, I am liable to be fooled in a hasty, tired moment, and I suspect I'm not alone.

I'm a little concerned about the new Safari interface [0], which very smoothly integrates the tab/address bar with page content. For example, the background color of the page flows behind the open tabs such that it looks like one unified interface, rather than browserchrome || pagecontent. This is all great to experience as web apps increasingly take over the functions of native apps. It does help them feel more like first-class citizens, rather than plain documents pulled up through a program. But it easily brings up new potential abuses by phishing sites, spammy notifications, and other bad actors. The new design seems to start breaking down the browser UI's Line of Death [1], at least in perception. [0] https://www.apple.com/v/macos/monterey-preview/a/images/overview/safar… [1] https://textslashplain.com/2017/01/14/the-line-of-death/

- https://textslashplain.com/ by Eric Lawrence of Fiddler fame, who's worked for last two decades on IE, then Chrome, then Fiddler, then Chromium-Edge. A mine of knowledge on browser internals, networking, web compat. - https://blog.pragmaticengineer.com/ by Gergely Orosz, on mobile dev & big tech from European point of view

Each user's version of Chrome is not necessarily the same. As a result of field trials/variations, some Chrome users are running code that is not yet (and may never be) available to the public. https://textslashplain.com/2017/10/18/chrome-field-trials/ https://www.ghacks.net/2013/04/05/field-trials-in-chrome-how-to-random… https://stackoverflow.com/questions/12183575/what-is-following-header-…

Thanks! Followup post has a little bit more: https://textslashplain.com/2018/05/07/google-chrome-twoish-years-in/

For InfoSec: Troy Hunt https://www.troyhunt.com/ and Eric Lawrence https://textslashplain.com/ For JavaScript (particularly the language changes): Brendan Eich and Dominic Denicola

I'm a bit confused about how it actually works, and somehow they decided to not include a demonstration video. If clicking on it does trigger a location permission prompt: what's the point? The "issues" with prompts getting denied can already be solved by web developers doing this themselves, rather than just blindly firing off a request on page load. If clicking on it does not trigger a location permission prompt: have we forgotten about the Line Of Death [0]? Clicking random website-styled elements should never result in dangerous actions being taken - and leaking the user's physical location is definitely dangerous. Sure, they are trying to restrict the styling, but that's a fools' errant: somebody will just make a browser game where the button looks to refer to something ingame, but actually leak your real-world location. Besides, who's actually asking for this? Location is perhaps useful for Google Maps-like websites to save you a few seconds of scrolling, but in practice it has mostly been spammy websites trying to get me to "subscribe to local news". Making geolocation easier is the last thing I want in my browser! [0]: https://textslashplain.com/2017/01/14/the-line-of-death/

Meanwhile: https://textslashplain.com/2026/08/04/security-is-hard-yall/ > The Cloudflare folks apparently want security issues reported via HackerOne (which wouldn’t let me log in because the Cloudflare CAPTCHA HackerOne uses seems to be broken…).

The problem is that if information can flow from the untrusted window to the trusted window then information can flow from the untrusted window to the trusted window. It's like https://textslashplain.com/2017/01/14/the-line-of-death/ except there isn't even a line in the first place, just the fuzzy point where you run out of context.

How can I tell that dialog is not just a regular fullscreen program? Even Zoom gets to record the desktop regularly. It sounds like yet another violation of the Line of Death principle (in context of OS, not browser). https://textslashplain.com/2017/01/14/the-line-of-death/

Speaking of responsibility: I want ad networks (a scourge on modern society) to be very liable when their systems are spreading malware and scams. IIRC the last time my mom came to me with a fake "You Must Upgrade Now" ad on her phone (from an otherwise-legit puzzle game), the ad-network did have a feedback function... but strangely there wasn't any category for fraud. It might be less of an issue if there were clearer ad-vs-not boundaries, but that starts getting into issues like the browser security line of death [0]. [0] https://textslashplain.com/2017/01/14/the-line-of-death/

I found this: https://textslashplain.com/2016/03/06/using-https-properly/ Seems like it at least partially corroborates OP's recollection!

People keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that. https://textslashplain.com/2024/10/13/content-blocking-in-manifest-v3/ shows a ten-line ad blocker that blocks Google's ads, https://github.com/extesy/hoverzoom/discussions/670 is a list of polite email messages from people who'd like to have elevated access to browsers.

> Another challenge, especially on big screens, is the way the permission prompt gets commonly displayed: above the line of death[0], that is, outside of the area of the browser window that the app can draw onto. So the proposal is to... put the permissions grant flow _below_ the line of death? Permissions grants _should_ break out of the untrusted context! It's a privilege escalation that only the browser (and its associated UI) should be able to grant! [0] https://textslashplain.com/2017/01/14/the-line-of-death/

> the Chrome team has tried to reduce the potential for abuse in the new “Manifest V3” system, but pundits and others have popularized elaborate conspiracy theories that this was just a way for Google to crack down on adblockers for their own business interests. > (This is an especially silly claim, since [Google ads are trivially blockable in the new system](https://textslashplain.com/2024/10/13/content-blocking-in-manifest-v3/…

> is that it's comnpletely unstyled Another reason might be that vendor making it look like a native browser window would blur the line of death[1]. It would make it easier for malicious website to make a popup "browser update" in the middle of the page that redirects to seemingly legit Chrome download page and downloads modified executable. [1]: https://textslashplain.com/2017/01/14/the-line-of-death/

How does Arc handle the line of death[1]? [1] https://textslashplain.com/2017/01/14/the-line-of-death/ (Though I realise after reading this that this concept isn't really all that relevant anymore)

One approach to guard against Hyrum’s Law is GREASE (aka “Generate Random Extensions And Sustain Extensibility” used in the TLS 1.3 protocol) i.e. behavior randomization to avoid inadvertent dependencies on unspecified behavior: https://textslashplain.com/2020/05/18/a-bit-of-grease-keeps-the-web-mo… What are other approaches?

I’ve seen it called “The Line of Death” https://textslashplain.com/2017/01/14/the-line-of-death/

> In general, the idea is that Edge developers check in their code to the internal Main branch. Code from Microsoft employees is joined by code pulled by the “pump” from the upstream Chromium project, with various sheriffs working around the clock to fix any merge conflicts between the upstream code pumped in and the code Microsoft engineers have added. Source: https://textslashplain.com/2022/08/04/understanding-browser-channels/ Microsoft have their own branch, where they add Edge-specific changes, and they regularly pull changes from the Chromium source (probably not all changes) and merge them to their branch. If you don’t consider this a fork, then please explain why.

Don't trust any text that a malicious adversary could change. This is the email version of the Line of Death https://textslashplain.com/2017/01/14/the-line-of-death/

Was curious about 7-zip too, TIL about "origin laundering": https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-we…

You can’t implement what you suggest in a browser. The only trusted identity that browsers have is the parent page in the URL bar — which Plaid doesn’t remove. If Plaid tried to create some kind of secondary URL bar, phishing pages could just recreate it. aka the “line of death”: https://textslashplain.com/2017/01/14/the-line-of-death/

That article: https://textslashplain.com/2017/01/14/the-line-of-death/

If you're worried about this attack in particular, then drag the window above the line of death. https://textslashplain.com/2017/01/14/the-line-of-death/ Now, if you got put into fullscreen mode without realizing it, that's another problem.

The red death zones strike again https://textslashplain.com/2017/01/14/the-line-of-death/ Seems like web browsers aren't really secure enough for anything that needs a password anymore.