Top
Best
New

Posted by auberonedu 14 hours ago

The Deathray: A simple way for an untrusted site to freeze a Mac(auberon.xyz)
193 points | 119 comments
water-drummer 17 minutes ago|
On Graphene OS, it froze Brave, but Vanadium was able to deal with it swiftly. Not sure if that has anything to do with JavaScript JIT.
fionera 9 minutes ago||
Tried it and now I cant boot even in safe mode. I love it
asimovDev 1 minute ago|
are you saying that it corrupted the OS install / bricked your Mac?
dataf3l 10 minutes ago||
it crashes this hardware apparently:

  - macOS 14.7.3 (23H417)
  - Chrome 152.0.7977.84
  - Hardware: MacBookPro17,1 (Apple M1)
isolay 1 hour ago||
> Just hope that your browser doesn't automatically reopen the same tab when it starts up again

Busted. My browser is configured to do just that.

concinds 42 minutes ago||
Chrome asks whether to reopen windows if it didn't exit normally. Safari appears to just YOLO it. Don't know about Firefox.
amelius 36 minutes ago||
Unplug your ethernet cable?
guidopallemans 18 minutes ago||
Just hope they don't add a service worker to remain functional offline
washadjeffmad 7 hours ago||
Back in the 90s when the web was non-commercial and fun, I added a "Don't Click Me" link that loaded a 'browser test' page (after a series of "are you really really sure?" dialogs) that exploited every historical browser bug I could find. Infinite popups, inescapable dialogs, ActiveX quirks, various hangs and crashes, the works.

If it didn't crash your computer, it eventually displayed a single popup that said "Congrats on not using Internet Explorer!". I wish I still had the hate emails.

Matheus28 5 hours ago||
I remember when `alert` would lock up the entire browser UI. So if you put it on an infinite loop, that was it. You had to kill the browser process to shut it off.
parl_match 5 hours ago|||
there was a common "shock site" called "last measure" that did this. it loaded all sorts of offensive images, blasted a loop of a guy yelling something offensive about pornography, and then proceded to lock up your machine.
davkan 5 hours ago||
Oh man I had forgotten about last measure. I remember multiple times scrambling for the power button.
QuantumNomad_ 2 hours ago||
And also the more innocent “You Are An Idiot, hahaha hahaha” page that would sing those words and spam pop up windows with white and black text blinking, that would float around the screen. Every time you click close on one window, two new ones pop up.

With that one, Ctrl+Alt+Delete, Task Manager, kill iexplore.exe was usually all you needed to do thankfully. No hard power off necessary.

amatecha 2 hours ago||
I was just talking about that one with someone a few days ago! Amazing hahah XD I still remember the song and was singing it while laughing profusely at how obnoxious that site was!
r3trohack3r 7 hours ago||
Were there multiple of these sites?

If not, I have fond memories of using yours!

socalgal2 4 hours ago||
This has been around since 2011 when WebGL shipped. It's documented in the spec. It's a self correcting problem. You go to a site, it freezes your machine, you never visit the site again.

No data is stolen, no privacy is lost. All that happens is the perp loses any audience.

Turning off WebGL = no more Figma, no more Canva, no more Google Maps. A few self correcting sites seem acceptable. Evidence, it's been 15 years since this was possible and the world didn't end and the whole internet isn't freezing your machine.

Also, this is arguably a MacOS bug. Window and Linux have had GPU monitors that power cycle the GPU if a command takes too long. Windows since before WebGL shipped. Linux a few years after. Macs still don't recover from excessive GPU use.

zelphirkalt 3 hours ago|
Do you think a regular user knows how to block a specific website or never click a link leading to it again? And what about the ads people, adding such a thing if you don't load their ads?

I think this point of view is making it a bit too easy.

socalgal2 3 hours ago||
A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes. Guess I won't go there again"

> I think this point of view is making it a bit too easy.

It's been 15 years since this was possible. How many times have you heard of this being an issue? Again, it's self correcting. Site freezes machine, user stops going to site. There's zero incentive to do this and tons of incentive to not do it. Even an ad, your ads would get banned, not good for you, no incentive.

sersi 1 hour ago|||
An average user will not know that the site caused the issue. The first time after force turning off the computer, it will restart and reopen all windows causing the computer to crash again. The next time, they might click on the button to prevent reopening all windows and everything will be fine until they opens safari which will cause the same issue. At that point, they'll call whoever is their computer expert user to help them out.
xingped 2 hours ago||||
I think a lot of HN commenters are way too disconnected from the average person. You're making a big assumption that a user will even connect the dots until the same thing happens multiple times, if even then. The average computer user is extremely bad at connecting cause and effect on their computer. Think of how many times you hear "my computer is broken!" when actually it's something like the printer was unplugged/turned off and they were just having trouble printing a document (or, if you are so disconnected from average users/people, the answer is _this happens a lot_). Even what we think of as simple stuff completely befuddles them.
DrewADesign 46 minutes ago||
> I think a lot of HN commenters are way too disconnected from the average person

This is basically an old-man-and-the-starfish situation for me.

> You're making a big assumption that a user will even connect the dots

If they do, it’s because their wildly inaccurate mental model happened to guess the right answer. What most will think is “I was just browsing the internet and my computer froze.” Maybe they’ll connect it with that notification they just got about renewing their antivirus software subscription. Maybe it will confirm their (probably mistaken) impression that their computer has been “acting weird” since something arbitrary and unrelated happened. And similarly, some people with an accurate mental model will mistakenly assume that they deduced the cause because they’re smarter, rather than having a different focus with corresponding lacking mental models in other areas.

chrisjj 2 hours ago|||
> A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes.

Not true, given any unknown link or button press can redirect/go to such a site.

jonathanlydall 9 minutes ago||
> I was surprised when it hung my computer and of course asked "Does it do that every time?"

A true scientist! (see https://xkcd.com/242/)

StilesCrisis 9 hours ago||
Metal is based on C++14, which means you can write Duff's Device in a shader. I've tried it on various Macs and it causes all sorts of critical failures in the compiler, but never an actual kernel panic. (It's pretty trivial to reproduce in KodeLife)
gucci-on-fleek 5 hours ago||
Huh, this completely crashed my Firefox on Linux, which I've never had happen before. At least the rest of the programs on my desktop seem to have been completely unaffected.
alwaysmrno 1 hour ago|
Froze my Brave browser on Windows for about 10 seconds. Every page turned white. then they refreshed and worked again, except the offending page. As the author speculated that tab was frozen.
More comments...