Tried to visit iheartumami.com using my (defensive) browser. The popup is nothing that was generated by the website, but rather an error message of the browser’s own creation. Yet I can see very well that the webpage rendered fine.
Normally if my Auto Overlay Remover extension does not remove a popup, I can force it to run to get rid of the popup. But because iheartumami.com was designed by some obnoxious sneaky motherfuckers, they somehow tricked the browser into falsely believing that it failed to load the page. The browser’s own popup blocks us from seeing the whole page. The user is /forced/ to:
- click cancel, which just loops. The assholes have you re-fetching the page and wasting bandwidth, b/c why would they give a shit about carbon footprints?
- click ok, which leads to yet another popup that demands you enable ads and popups with nothing else rendered, thus defeating the overlay remover.
- or leave it in an tab while viewing another, in which case the page reloads repeatedly non-stop which abuses both the user’s bandwidth and the website’s bandwidth.
This particular assault which somehow abuses our browser’s error detection has become increasingly popular lately.
The circumvention: $ torsocks lynx iheartumami.com. But not useful if pics are important.
The popup is nothing that was generated by the website, but rather an error message of the browser’s own creation.
A script on that page is just calling
confirm. There’s no ‘tricking’ going on.There’s no ‘tricking’ going on.
Why do I feel lied to? The page renders just fine and yet there is a msg “There was a problem loading the page.”
You may or may not be being lied ro. Something not visible might not have loaded. Or it’s a lie. Either way, just close the tab since you don’t trust the site.
Either way, just close the tab since you don’t trust the site.
That makes sense if you have a non-defensive browser. The whole purpose of a defensive browser is to visit websites I do not trust. Is the browser disservicing me? “There was a problem loading the page. Click OK to learn more: [cancel] [OK]”. Clicking “OK” gives:
(note “failed to fetch” is misinformation – but we can see that that lie is obviously generated by the website)
The browser told me “There was a problem loading the page,” not the website. That’s deception. The browser should not know (nor give a shit) about the wishes of an ad-blocker-hostile website. The browser should talk to me about connectivity issues (e.g. syn-ack-synack handshaking failure) and html that is so broken it cannot cope. The browser should not be the spokesperson for a website owner (which it does by using the browser-to-user comms mechanism). Why? Because the browser serves the user, and only the user. Or at least anyone self-respecting should expact as much. (sidenote: Mozilla does not agree with the principle that software should serve its user in light of this mothballed bug report).
Then what? So clicking OK gave me the info, but I never told the browser it was okay to give that info in place of the webpage that it rendered. It should come in a separate tab so as to avoid data loss.
Clicking “cancel” causes the browser to needlessly re-fetch everything at the user’s own expense and then re-ask the same question in a loop. That’s not what cancel means. If you hit ESC while a page is loading, you will see that it stops fetching and executing, but it does not destroy what is there. That’s what cancel means. Cancel certainly does not mean “toss what you ahve and try to reload the page”.
Maybe you should argue that with the developers of JavaScript 30 years ago then. confirm() is a JavaScript method any page can use, it’s not being created by the browser, it’s a dialog being involved by JavaScript that the browser is displaying on behalf of the site. If you don’t want to see them then turn scripting off.
I’m undecided on whether the js inventors fucked up on this, but ATM I’m convinced that the browser devs are at fault for giving users no indication that the dialog box is an instruction from the payload and not from the browser itself. It’s an infosec shit-show that users cannot discern a browser msg from a website msg.
If you don’t want to see them then turn scripting off.
We can do better, in principle. Now that I have come to distrust the
confirm()method by iheartumami.com, I would like the granularity to configure my specific distrust for that particular call by that particular js source. When aconfirm()instruction is reached on that site, I would like the js program to be killed. I suppose this would be comparable to controlling perms given to an AOS app.This isn’t exactly a new thing it was pretty common in the late 90s early 00s. They fell out of favor mostly because browsers started blocking them from redirecting and modals were more effective because they didn’t look so generic and it made users trust them more.
Yep, modals were a sneaky AF invention, (even more than popups, IMHO) for your stated reason as well as so many more, in practice. ☝🏼
you don’t trust the site.
Also about trust: trust is not all-or-nothing. Trust has context. I might trust my drug dealer to bring me some good quality cocaine. But I might distrust that very same person to house-sit for me. I do not wholly bluntly state: “I distrust Alice” and therefore wholly refuse to talk to Alice. I engage Alice in accordance with my trust for a particular situation.
It’s fucking annoying how people talk about trust as a binary… something you have or have not. I don’t trust a website with running Javascript from Cloudflare, but maybe I trust it enough to run its 1st party js. People have a right to autonomy. I will be the judge of what I trust and to what extent.
If I’ve learned anything in all my years (and especially with all the awesome work in said span from LGBTIA+, neurodivergent, and other communities), it’s that most of reality is on a spectrum. 🖖🏼
This seems more a problem with your ‘defensive browser’, since Firefox gives you the option to stop a website from creating popup dialogs after the 2nd loop, and has had that feature for forever.
Indeed this form of enshitification exploits browsers’ deficiencies. FF only has 3.6% of the marketshare. So a pusher of this variety of enshitification is not too bothered if an unpopular browser controls for the dark pattern.
