Hacker News: ericlaw

New comment by ericlaw in "Web Security is Too Hard"

ericlaw — Tue, 04 Aug 2026 19:14:51 +0000

Note that I said: "One of my", and Cloudflare has hired a HUGE percentage of the best networking talent I've encountered.

New comment by ericlaw in "Web Security is Too Hard"

ericlaw — Tue, 04 Aug 2026 19:13:50 +0000

Fun fact: still can in Chromium-based browsers. https://textslashplain.com/2023/03/22/attack-techniques-spoo...

New comment by ericlaw in "Windows Shell Previews"

ericlaw — Mon, 20 Oct 2025 17:27:44 +0000

The October 2025 Patch Tuesday patches locked down previews of files in the Windows Explorer shell. This post explains why.

New comment by ericlaw in "[dead]"

ericlaw — Mon, 25 Nov 2024 04:17:50 +0000

Mistakes and Successes in building the Fiddler web debugger

Blocking content in Chrome Manifest v3

ericlaw — Sun, 13 Oct 2024 18:49:20 +0000

Article URL: https://textslashplain.com/2024/10/13/content-blocking-in-manifest-v3/

Comments URL: https://news.ycombinator.com/item?id=41830498

Points: 6

# Comments: 0

New comment by ericlaw in "Beware: URLs Are Pointers to Mutable Entities"

ericlaw — Fri, 13 Oct 2023 20:16:38 +0000

Almost everybody knows this, yet most of us don't think through the implications, leading to some surprising results.

Beware: URLs Are Pointers to Mutable Entities

ericlaw — Fri, 13 Oct 2023 20:16:38 +0000

Article URL: https://textslashplain.com/2023/10/13/beware-urls-are-pointers-to-mutable-entities/

Comments URL: https://news.ycombinator.com/item?id=37875108

Points: 3

# Comments: 1

New comment by ericlaw in "The .zip TLD sucks"

ericlaw — Sun, 14 May 2023 13:08:28 +0000

There is no visible "OK" button on a SmartScreen reputation warning.

New comment by ericlaw in "New TLDs: Not Bad"

ericlaw — Sat, 13 May 2023 20:42:05 +0000

.com files still work fine on Windows; Visual Studio installs devenv.com, for example (IIRC, it's there for a somewhat wacky reason. See %PATHEXT%)

New comment by ericlaw in "Captive Portals"

ericlaw — Fri, 15 Jul 2022 19:38:04 +0000

Happy to add those, if you can point to some information about actual implementations?

New comment by ericlaw in "Captive Portals"

ericlaw — Fri, 15 Jul 2022 19:36:05 +0000

Is your contention here that there's somehow a human male with two Ethernet ports that is manipulating HTTPS traffic and I'm just too "lazy" to admit that?

https://blog.cloudflare.com/monsters-in-the-middleboxes/

View-Source in Chromium

ericlaw — Thu, 11 Nov 2021 21:41:57 +0000

Article URL: https://textslashplain.com/2021/11/11/view-source/

Comments URL: https://news.ycombinator.com/item?id=29193561

Points: 1

# Comments: 1

New comment by ericlaw in "Chromium: Permit blocking of view-source: with URLBlocklist"

ericlaw — Thu, 11 Nov 2021 21:39:12 +0000

The many many upstart browsers (including mine) that are eager for Chrome to do something so foolish so we can collect all of their irate users?

New comment by ericlaw in "Chromium: Permit blocking of view-source: with URLBlocklist"

ericlaw — Wed, 10 Nov 2021 06:06:54 +0000

To answer a few questions here:

1. I landed this fix because there was a policy that did not work properly. We could instead document that the URLBlocklist policy works for every scheme but one, or we could fix it. Fixing it makes more sense.

2. This policy only can be set on managed machines.

3. This policy, in isolation, is trivially circumvented. Managed environments block many things, including many of the proposed circumventions here.

4. I've built one of the world's most popular tools for viewing and modifying web traffic. The narrative that this feature has broad implications for anything is absurd.

New comment by ericlaw in "Leaky Abstractions"

ericlaw — Thu, 03 Jun 2021 13:39:21 +0000

The abstraction leaks because the performance characteristics are inherently impossible to mask from the higher layers.

There are other places where the abstraction leaks as well (try to add a file with a Unicode name to a Compressed Folder).

It's true that you could add more and more code to try to make the abstraction leak less.

New comment by ericlaw in "Leaky Abstractions"

ericlaw — Thu, 03 Jun 2021 02:36:39 +0000

As noted in the blog post, he's the author of the Shell Namespace code, but not the ZIP code beneath.

New comment by ericlaw in "Bypassing anti-incognito detection in Google Chrome"

ericlaw — Sat, 20 Jul 2019 11:54:22 +0000

Tracked by https://crbug.com/959839

New comment by ericlaw in "Facebook password spied by Chrome extension used by over 30k users"

ericlaw — Fri, 28 Jun 2019 13:30:53 +0000

It certainly appears to be monitoring the entry of passwords into Facebook, but given the stated purpose of the extension ("Record activities undertaken in the content area for later playback") it's not clear to me that this is the same as "stealing". We'd need to see code that shows the recorded content being exfiltrated to somewhere else, which should be pretty obvious by watching network traffic and or doing a full review of the code.

New comment by ericlaw in "Browsers"

ericlaw — Mon, 17 Dec 2018 13:51:20 +0000

Many "irrational" decisions are related to interactions with anti-bot/anti-fraud logic.

I worked on IE in the days when there were many crazy conspiracy theories about silverlight and IE collaborating to ruin the open web. This sounds similar.

New comment by ericlaw in "Google Chrome–One Year In (2017)"

ericlaw — Tue, 30 Oct 2018 21:53:02 +0000

Thanks! Followup post has a little bit more: https://textslashplain.com/2018/05/07/google-chrome-twoish-y...