Top
Best
New

Posted by auberonedu 15 hours ago

The Deathray: A simple way for an untrusted site to freeze a Mac(auberon.xyz)
205 points | 126 commentspage 3
eliwang 8 hours ago|
Jesus Christ! My mac reopen the windows when it restarts. And it opens the Deathray again! I had to quit safari immediately I saw the dot below its icon. And it took me yet another restart to fix the weird problems in other apps.
germandiago 3 hours ago|
Thank you. I was tempted to press but I was afraid of making a mess. I won't.
sgentle 11 hours ago||
Could be a useful way to force user-interaction-gated flows. A "your computer is infected, click this button in 10 seconds or it will crash" type button which, at this point, most modestly-knowledgeable users would know not to click. However, after seeing their computer actually crash when the countdown hits 0, perhaps they would be more inclined to click "allow" on whatever prompt follows when they see it again.

Of course, plenty of other uses. Disable your adblocker or we crash your computer. Watch the whole ad or we crash your computer. Click the follow button or we crash your computer.

Maybe I'm crazy, but "crash your computer" as a building block seems powerful enough to be a security issue. Is denial of service not a security thing anymore?

mitxela 7 hours ago|
> Is denial of service not a security thing any more?

It is, but only when a big corp isn't doing it. X is allowed to deny you service without an account and Reddit is allowed to deny you service without uploading your personal documents to Persona.

code_duck 6 hours ago||
That’s not what denial of service is.
mitxela 5 hours ago|||
denial of service is when service is denied
thin_carapace 5 hours ago|||
what about when big companies drown the web with crawling activity, forcing webmasters to implement fingerprinting and thus massively delaying actual users from accessing webpages that would otherwise load instantly?
ilnmtlbnm 15 hours ago||
Amazing!

I encountered the same type of death freeze when trying (and failing) to run models in browser tabs, but didn't spend much time trying to understand how severe it is.

Hope they don't disable WebGPU...

nottorp 3 hours ago||
It's at best denial of service. Except it's easily avoidable by never going back to that site again.

The funny thing is the page describing the problem stutters like crazy in firefox/mac while the rotating nuclear hazard wheel is displayed.

g-b-r 1 hour ago||
It freezes a Pixel 10 on Chrome, Webviews and Brave..!

I tried several webview-based browsers, Chrome, and Brave, with them the phone completely freezes (except that the audio keeps going for a bit).

I tested webview browsers because by chance the first place I ran it on was Telegram's internal browser (on which the phone does freeze).

It doesn't do anything on Firefox though, and weirdly enough not even on the Chromium-based Cromite (after enabling WebGL).

I only tried waiting for a few minutes, but it wasn't giving signs of life.

If someone wants to try, keep in mind that to force restart a Pixel you have to press the power button for 30 seconds (during which you might break out in a cold sweat).

mjmjmjmj 1 hour ago|
pixel 9 fold with Graphene, nothing significant in vanadium (after manually enabling JS)
TedDoesntTalk 11 hours ago||
Is this why Oregon Trail Deluxe freezes on Mac?

https://oregontrail.ws/games/the-oregon-trail-deluxe/play/

splittydev 10 hours ago||
It kind of froze my Mac Studio M2 Ultra, but I was able to still move the mouse and force-quit Safari using Command+Q. Once I did, everything immediately went back to normal.
xcc3641 7 hours ago||
Does this reproduce with just the compute pass, or does WindowServer deadlock on the canvas drawable?
auberonedu 6 hours ago|
https://news.ycombinator.com/item?id=49653562
itstrueitried 11 hours ago||

    while (true) console.log('this will freeze/crash dev tools') 
For more of a "I've been hacked!" effect, load infinite 3D models in Three.js that have millions of vertices each. You get those black boxes where the system has so low RAM it can't even draw the browser window.
anakaine 11 hours ago||
Shall we term this a Denial of Memory attack. Then in order to Contain it we have a ConDoM fix?
LoganDark 11 hours ago||
This doesn't even always work unless you log two different messages, because some DevTools will just keep a running count of how many of the same message there has been in a row.
yesitdoes22 10 hours ago||
fwiw it froze my tab in seconds just pasting that into dev tools
LoganDark 9 hours ago||
I think running it in the DevTools console is different from having a script on the page.
yesitdoes22 8 hours ago||
No actually. The only reason it crashes in dev tools is that it is rendering the printed console log.

If you printed to some div in the page, you will get the same effect.

Do you understand the topic? Doesn't seem like it

LoganDark 5 hours ago||
> Do you understand the topic? Doesn't seem like it

Since you are so polite I tested all of it just now and it turns out you are correct that running it directly from the devtools console does not cause any worse behavior than running it from a normal script tag.

However indeed logging only a single message simply causes it to be combined and show a counter instead of crashing. Logging two different messages causes the log to explode pretty instantly and hang DevTools fairly quickly.

For context on how not-crashy a single message log was, I was able to navigate to the Sources tab and pause the webpage in the middle of its infinite loop, which is not something you should be able to do if the DevTools are truly overwhelmed. (When that happens, sometimes the Sources tab simply does not load, other times trying to pause execution simply does nothing.)

LoganDark 11 hours ago|
Apple Silicon Macs have a lot of GPU problems. I find that after running any significant GPU workload, the entire operating system starts getting super slow until a reboot. Even if the entire process tree that ever touched the GPU has been completely terminated for days.
abecedarius 8 hours ago|
Sounds like a problem that'd hit anyone running LLMs. I haven't tried on mine so far, but people do talk about ordering a $10k Mac Studio just for that. Anyone else see this? Does the OS version matter?
dermacentor 5 hours ago|||
Never.
LoganDark 2 hours ago|||
I don't think I had the issue before macOS 26, but honestly I have no way to tell. I did run into one other HN commenter that suffers from the same slowness problem, but they didn't connect it to workloads, only uptime. I think it was the same issue though.
More comments...