Hacker News Reader

This looks like it's trying to exercise every dark corner of the user's browser in order to ensure that the browser is a real, eyeball-facing browser and not just a URL fetcher, PhantomJS/SlimerJS, or a clickjacking plugin being used to fraudulently click ads.

It sounds like it would be quite easy to circumvent just by running a real browser... especially with lightweight VMs.

View on HN

which it also attempts to enumerate common files such as virtualbox or vmware drivers via <link> and <img> off file://

Shouldn't it be impossible for a website to determine what files exist or do not exist on a local machine? That sounds like a serious security problem. It seems that no non-file:// site should ever be allowed to load a file:// resource, much less query the element for its size or error state afterward.

You're completely correct.

Those kinds of security issues are the low-hanging fruit that's largely been fixed by now.

Reply on news.ycombinator.com