Top
Best
New

Posted by auberonedu 15 hours ago

The Deathray: A simple way for an untrusted site to freeze a Mac(auberon.xyz)
193 points | 119 commentspage 2
xoa 10 hours ago|
While I'm sure it has its uses, particularly if someone really does want to game or do complex computational stuff purely within a web browser, I'll admit I've grown pretty cautious/tired around the ever increasing amount of hardware attack surface area the browser vendors seem to be rushing to expose as Google in particular appears determined to try to be the "operating system on the operating system" as much as it can. In this particular case it made me realize I'd awhile ago set dom.webgpu.enabled and pdfjs.enableWebGPU to false in Firefox, same as I disabled WebGL. Kinda figured if I ever saw something ultra cool I could enable it just that one time but so far I haven't. Semi-related, reviewing the available settings now for the first time in a bit I notice they have a dom.webgpu.blocked-domains with the sole entries being "easyeda.com,*.easyeda.com", I wonder what that's about?
varenc 8 hours ago||
> notice they have a dom.webgpu.blocked-domains with the sole entries being "easyeda.com,*.easyeda.com", I wonder what that's about?

I found this issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1980392 and commit: https://phabricator.services.mozilla.com/D262053

It looks like per-domain WebGPU blocking was added exclusively just for easyeda.com !

Haven't read it all, but the story seems to be that EasyEDA's WebGPU usage was broken because it relies on some aspects which Firefox hasn't implemented yet. So they made this blocklist to get Firefox to behave as if it lacked WebGPU support completely on this domain, which makes EasyEDA fallback to some other non-broken version. Maybe they couldn't get in touch with EasyEDA directly, since it seems far easier to have them just disable WebGPU for some known versions of Firefox.

ruined 3 hours ago||
incredibly, the underlying issue seems to be lack of support for shadowing built-ins and reserved keywords

which seems like an insane thing to need or support. literally just pick a different name, there are infinitely many!

i can understand just deciding to ignore the site

autoexec 10 hours ago|||
I'm with you. WebGPU has been used to compromise and fingerprint systems. Firefox (and related forks) are usually able to disable this kind of insecure fluff but it'd be nice if other browsers did as well.
mh- 9 hours ago|||
On the other hand, disabling WebGPU is offering entropy for fingerprinting, too. A vanishingly small % of users will have done so.
xoa 9 hours ago|||
>On the other hand, disabling WebGPU is offering entropy for fingerprinting, too. A vanishingly small % of users will have done so.

I think near any anti-fingerprinting efforts though presume some floor level of system security and stability. If some particular hardware exposure feature lets attackers run arbitrary low level timing and hardware testing code or crash the system or break the sandbox the game is likely over for most people.

An extra bit of entropy isn't meaningless sure, but at some point there should be some weighing of absolute attack surface against it right? Some features just seem inherently anti-privacy/anti-security and one might just have to try to deal with that via other approaches.

autoexec 9 hours ago||||
True, but randomizing other data points will keep your fingerprint unique which should help prevent associating your activity across sites/sessions.
seany 9 hours ago|||
don't some of the adblock extensions randomly modify the fingerprinting you can get from this?
autoexec 9 hours ago||
Hopefully, but it's good to have it disabled as well so that your system isn't screwed by the next zero day and to help cover you in case the fingerprinters manage to find a technique to get identifying data from WebGPU that your ad-blocker hasn't accounted for. It's a constant arms race after all. Hopefully the ad-blocker is still feeding them randomized data even with it disabled, but otherwise other randomized data points should keep your fingerprint unique even if a lack of WebGPU support stays consistent.
socalgal2 4 hours ago|||
WebGPU provides ZERO extra data that wasn't already available from WebGL in 2011. The world didn't end and it's been 15 years
Razengan 1 hour ago||
> The world didn't end and it's been 15 years

Maybe it did and you're just hooked up to the Matrix thinking it didn't

StilesCrisis 10 hours ago|||
With Chromebooks, Chrome is in fact put in the position of being a real operating system and is the only surface exposing the hardware's capabilities!
userbinator 8 hours ago|||
WebGPU/WebGL is another thing that only trusted sites should be allowed to use, just like JS in general.
stackghost 9 hours ago||
Quite so. When it first took off, I took no end of flames and downvotes for suggesting that WebGPU is a terrible idea. HTML and the browser were originally conceived to render documents, not serve as a bastardized application distribution platform.

The only arguments I've ever heard in favor of wasm/webgpu were that using native graphics/GUI toolkit APIs are a pain. That's definitely true, because I've written stuff with gtk and it sucks, but that doesn't mean we should just shovel an entire tech stack into the browser.

Just because we can, doesn't mean we should. I'm tired of these BigCos shitting everything up.

Melonai 5 hours ago|||
Yeah in the end I probably agree on WebGPU, I haven't really seen a single use of it, except for running shader code examples in browser, which might as well be replaced by a looping video.

For WASM though, I do not agree at all! It's genuinely a great system for high performance browser code. So much stuff I use now had WASM as the backbone, and I even started applying it outside of the browser in some of my architecture. I wish we had way more enthusiasm behind things like WASM, and way less for something like WebUSB.

lmz 8 hours ago|||
The BigCos are the reason you have that browser in the first place. If you don't like it, you know where to download ... links or something.
stackghost 8 hours ago|||
Hey you’re right, we should gladly accept every decision the big corps make. They know best, after all. We should probably lick their boots too, in gratitude for their benevolence.
lmz 8 hours ago||
The application delivery thing was done as far back as Netscape threatening to relegate Windows to "a poorly debugged set of device drivers" so Web-whatever is simply another step in that direction. Like I said, if you purists want just document delivery, you can use links or w3m or maybe Gemini.
mitxela 7 hours ago||
Some kind of market forces kept Netscape in check back then. Now they aren't.

Like, Tesco would prefer that my operating system was a roast chicken, Baowu Group would prefer it was made of steel, Berghain would prefer that it had to queue for hours to possibly get in, and Jagex would prefer it was an in-game GUI within RuneScape. None of those companies got their way, what makes Netscape special?

slicendice 10 hours ago||
I want to click it so bad, but I can't bring myself to do it.
asimovDev 10 minutes ago||
Call of the void is strong in this one
willio58 10 hours ago|||
After a long day at work I saw the page, saw the warning to not click it, and I proceeded to click it lol.

Locked up my entire M1 Macbook Pro, held power button and I was back into chrome in <20s but I did kinda go "why did I just do that?"

navtoj 8 hours ago|||
I tried it on macOS Sequoia and it froze everything except the cursor movement.
12_throw_away 9 hours ago|||
honestly i bet it feels good as fuck to click on malware, just once
LoganDark 10 hours ago||
For me it just caused Safari to stop working until I quit and restarted it.
embedding-shape 10 hours ago|||
A Denial of Browsing attack.
LoganDark 9 hours ago||
I have two other web browsers open at any given time, so probably not really. I guess it would be if it truly did bring down the entire system.
bittercynic 10 hours ago|||
On my M1 MacBook Air with MacOS 12 it hangs. The mouse pointer still moves, but I can't bring up the force quit dialogue, and couldn't get anything else to work either. A youtube video in another tab kept playing until I held the power button to force a shutdown.
LoganDark 10 hours ago||
I'm using macOS 27.0 RC on M4 Max
monster_truck 11 hours ago||
Remember when that unicode string nuked iOS 7 and you could set it as your SSID to get them stuck in a loop? good times.
LoganDark 10 hours ago|
Kinda reminds me of that wifi network with a funky name from Doctor Who that gets you uploaded to the cloud. (episode: The Bells of Saint John)
tetrahedon 5 hours ago||
There are more of these hiding in WebGPU. Some work on iOS as well. I reported them to Apple but they were closed as not having security relevance.
socalgal2 4 hours ago|
that's because they don't hav any security relevance.
ta8903 4 hours ago||
most bugs don't
g-b-r 58 minutes ago||
It freezes a Pixel 10 on Chrome, Webviews and Brave..!

I tried several webview-based browsers, Chrome, and Brave, with them the phone completely freezes (except that the audio keeps going for a bit).

I tested webview browsers because by chance the first place I ran it on was Telegram's internal browser (on which the phone does freeze).

It doesn't do anything on Firefox though, and weirdly enough not even on the Chromium-based Cromite (after enabling WebGL).

I only tried waiting for a few minutes, but it wasn't giving signs of life.

If someone wants to try, keep in mind that to force restart a Pixel you have to press the power button for 30 seconds (during which you might break out in a cold sweat).

mjmjmjmj 46 minutes ago|
pixel 9 fold with Graphene, nothing significant in vanadium (after manually enabling JS)
davsti4 8 hours ago||
I supposed you could just turn it off?

In Chrome on Linux:

WebGPU is experimental on this platform. See https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#... deathray/:9

Failed to create WebGPU Context Provider main @ deathray/:9 (anonymous) @ deathray/:113

Uncaught (in promise) TypeError: Failed to execute 'configure' on 'GPUCanvasContext': Failed to read the 'device' property from 'GPUCanvasConfiguration': Required member is undefined. at main (deathray/:17:17)

SugarReflex 10 hours ago||
On a Windows 11 work machine - this is causing my Teams to blink black and come back randomly. Yes I used my work machine.
john_owl 2 hours ago||
I was lucky, the website is down due a certificate error.
wzdd 5 hours ago||
This issue is older than the M chips: a formative OpenCL moment on my Intel MacBook involved locking it up in this way. By contrast, a similar CUDA kernel running on Linux was forcibly stopped after some short-ish time.

Worse and less defensible on the web of course.

krackers 10 hours ago|
>This spills over into other processes wanting to use the GPU, namely the WindowServer.

Why does this spill over? Unlike CPU which is multiplexed by the kernel's scheduler (so infinite loops can't lock out other programs), is the GPU not multiplexed in the same fashion?

kimixa 10 hours ago||
Often not in the same way - even if there are multiple queues (that can be given a priority), they're often limited in what they can schedule between.

Often there's shared resources that are statically allocated to shaders (register space, local memory etc.) that means you often can't "just" add a new task if those shared resources are already in use. But not using those resources to their full would cause performance issues.

And the internal state of a GPU is often very large, much larger than a CPU, so suspending the current tasks, saving out their state and replace it with a "higher priotity" one can be very expensive - so often an afterthought of support at best.

More comments...