9 ms·

This has been around since 2011 when WebGL shipped. It's documented in the spec. It's a self correcting problem. You go to a site, it freezes your machine, you

This has been around since 2011 when WebGL shipped. It's documented in the spec. It's a self correcting problem. You go to a site, it freezes your machine, you never visit the site again. No data is stolen, no privacy is lost. All that happens is the perp loses any audience. Turning off WebGL = no more Figma, no more Canva, no more Google Maps. A few self correcting sites seem acceptable. Evidence, it's been 15 years since this was possible and the world didn't end and the whole internet isn't freezing your machine. Also, this is arguably a MacOS bug. Window and Linux have had GPU monitors that power cycle the GPU if a command takes too long. Windows since before WebGL shipped. Linux a few years after. Macs still don't recover from excessive GPU use.

zelphirkalt 6d ago
Do you think a regular user knows how to block a specific website or never click a link leading to it again? And what about the ads people, adding such a thing if you don't load their ads? I think this point of view is making it a bit too easy.
- socalgal2 6d ago
  A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes. Guess I won't go there again" > I think this point of view is making it a bit too easy. It's been 15 years since this was possible. How many times have you heard of this being an issue? Again, it's self correcting. Site freezes machine, user stops going to site. There's zero incentive to do this and tons of incentive to not do it. Even an ad, your ads would get banned, not good for you, no incentive.
  - chrisjj 6d ago
    > A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes. Not true, given any unknown link or button press can redirect/go to such a site.
  - xingped 6d ago
    I think a lot of HN commenters are way too disconnected from the average person. You're making a big assumption that a user will even connect the dots until the same thing happens multiple times, if even then. The average computer user is extremely bad at connecting cause and effect on their computer. Think of how many times you hear "my computer is broken!" when actually it's something like the printer was unplugged/turned off and they were just having trouble printing a document (or, if you are so disconnected from average users/people, the answer is _this happens a lot_). Even what we think of as simple stuff completely befuddles them.
    - DrewADesign 5d ago
      > I think a lot of HN commenters are way too disconnected from the average person This is basically an old-man-and-the-starfish situation for me. > You're making a big assumption that a user will even connect the dots If they do, it’s because their wildly inaccurate mental model happened to guess the right answer. What most will think is “I was just browsing the internet and my computer froze.” Maybe they’ll connect it with that notification they just got about renewing their antivirus software subscription. Maybe it will confirm their (probably mistaken) impression that their computer has been “acting weird” since something arbitrary and unrelated happened. And similarly, some people with an accurate mental model will mistakenly assume that they deduced the cause because they’re smarter, rather than having a different focus with corresponding lacking mental models in other areas.
      - alt227 5d ago
        You sir, are very aware of how the average computer user thinks!
        DrewADesign 4d ago
        It’s one of design’s key responsibilities. Developers need a sophisticated mental model of how it works, and how that gets displayed. Designers need a sophisticated mental model of what problems various users are trying to solve, and the best ways to communicate how the software can solve those problems, as well as state, etc. They’re both deep topics, and even as someone with significant professional experience in both design and development, I find it difficult to consider both things at once. Many things that are very important to design could be a serious PITA for developers. Many tools, such as front-end frameworks, that are important time savers in the dev environment are a serious PITA for designers to work around. Many designers don’t understand why seemingly small changes, maybe something that would require hand-rolling a common library component, could triple development time and cause huge maintenance issues. I’d say most developers don’t realize that their understanding of software architecture and construction is nearly useless when designing interfaces, workflows, etc., and that many of the folk ‘best practices’ they’ve learned about design are no more authoritative than any other folk knowledge computer users pick up. They sound like completely nontechnical gamers confidently wielding technical jargon to mis-explain phenomena people experience, and since none of the other gamers in the conversation know any better, it only bolsters their false confidence. Unfortunately, that alone explains why FOSS developers in independent projects repeatedly try and fail to make software that appeals to anybody other than software developers.
  - sersi 6d ago
    An average user will not know that the site caused the issue. The first time after force turning off the computer, it will restart and reopen all windows causing the computer to crash again. The next time, they might click on the button to prevent reopening all windows and everything will be fine until they opens safari which will cause the same issue. At that point, they'll call whoever is their computer expert user to help them out.
    - trollbridge 5d ago
      It's worse than that: a default macOS install with Safari will re-open Safari, complete with re-opening the tab that was open upon a hard power off and power back on. So to get it to stop doing this on restart, I had to be very quick to force-quit Safari as the machine rebooted. You don't get a chance to tell it "Don't reopen all windows" when you hold the power button down.
      - jpc0 5d ago
        Not sure if it’s a setting but my mac definitely asks me if I want to reopen windows after a forced reboot.
  - alt227 5d ago
    This is hilarious, and what if an bad actor abuses this and makes a script or browser plugin which goes to this url every time a browser is launched? What about url shorteners and redirects? You seem to dismiss the issue based on a very narrow avoidable case.
    - eks391 5d ago
      They are addressing the fact that no bad actor will care to make it, not that they can't. Sure, there are countless ways it could be abused, and you point out some, but what had actor will want to pursue even one? They gain nothing. And good actors only lose out, in the form of lost credibility and future audience. Therefore it doesn't get abused and a fix isn't needed. The last 15 years is evidence of the argument.
      - alt227 5d ago
        Im arguing against the parent point that "Site freezes machine, user stops going to site." Its a gross oversimplification, and it doesnt hold water becasue there are lots of other vectors to a user coming across this than just "oh I recognise that web address as bad so I wont go there". > but what had actor will want to pursue even one? They gain nothing Ask that to anyone who has ever rickrolled somebody.
    - exlr 5d ago
      [dead]
- ktm5j 5d ago
  As someone who supports some bottom of the barrel "regular users".. they aren't monkeys. They have brains that function enough to process "oh, I shouldn't do that again".
  - andyferris 5d ago
    Nitpick: monkeys have enough brains for "oh, I shouldn't do that again".
    - ktm5j 5d ago
      Is that really an important detail? I think what I said got my point across.
      - CrompyBlompers 5d ago
        My brain stuck on the inaccurate monkey comparison and caused unnecessary work to get past it and back onto the point you were making.
        ktm5j 5d ago
        Sometimes you guys think too much..
        CrompyBlompers 5d ago
        A better analogy would have reduced required thought. But here we are.
      - KomoD 5d ago
        Yes, it's disrespectful to monkeys. Monkeys have feelings too.
        ktm5j 5d ago
        Well if one reads my comment I'll consider apologizing.
- snek_case 5d ago
  Ad impressions typically cost money, so there's a case to be made that this is sort of self-correcting too. That being said, IMO no website should be able to freeze your machine. This is a bug. Steps should be taken to fix it.
- phoghed 5d ago
  > And what about the ads people, adding such a thing if you don't load their ads? Through what mechanism? You don’t load their code, so then they presumably load this malicious code? If they could do that they would have just loaded the ad!
  - zelphirkalt 5d ago
    You could be blocking specific third-parties. I know I do. Site owner could load from other party, that you happen to have whitelisted for example. Or site owner could use first party scripts for that, feeling smug showing their anti-ad-block warning and then bombing you, if after some time you don't comply and deactivate your ad-blocking solution.
lxgr 5d ago
> It's a self correcting problem. You go to a site, it freezes your machine, you never visit the site again. What do regular users do about a malicious ad that runs on thousands of different sites? > Turning off WebGL = no more Figma, no more Canva, no more Google Maps Which is why you should probably rather turn off the actual vulnerable API, i.e. WebGPU, not WebGL.
- graemep 5d ago
  It really ought to be something you can enable or disable per site. I was surprised to find its not.
  - pmontra 5d ago
    Maybe a browser extension could inject JS in a tab to redefine all the WebGPU API into a noop.
    - graemep 5d ago
      I just remembered and checked. Noscript does allow blocking webgl on a per site basis.
- pipe2devnull 5d ago
  I just don’t think people are doing malicious ads like that. Like I’m sure it exists but like what’s the point? If you are the malicious person you pay money for ads to freeze someone’s computer and that’s it? It’s not even like you would gain anything from it
  - jonahx 5d ago
    Failure to imagine an incentive doesn't mean there isn't one. You can't rely on this type of thinking to reason about security. The thing you would have never thought of is what gets you. For example, an ad provider itself can be hacked by a malicious party, so the "pay money for" part no longer applies. Or an attack by a state actor or other large entity, where paying for a coordinated disruption of some region or company makes financial or military sense. Those are just two things that came to my mind, and are likely a fraction of plausible incentives someone might have now or in the future. People are creative and unpredictable. Weird shit happens. Fact is stranger than fiction... Instead, just ask: should visiting a website ever have the power to freeze your computer without your consent? If you think the answer is no, this is a security bug and it should be fixed.
zipy124 5d ago
You can lose data though. Any open documents which aren't saved...
gregoriol 5d ago
> All that happens is the perp loses any audience You haven't heard about rickrolling, have you?
jonahx 5d ago
This take feels too cavalier. Since the machine is actually frozen, it enables many plausible social engineering scams ("We have detected a virus that froze your machine. Call this number for help..."), and I bet it has been used that way. Not to mention possible data loss, interruption of work at a critical time, and so on.
sans_souse 5d ago
So you're saying it's a feature?

zelphirkalt 6d ago

Do you think a regular user knows how to block a specific website or never click a link leading to it again? And what about the ads people, adding such a thing if you don't load their ads? I think this point of view is making it a bit too easy.

socalgal2 6d ago
A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes. Guess I won't go there again" > I think this point of view is making it a bit too easy. It's been 15 years since this was possible. How many times have you heard of this being an issue? Again, it's self correcting. Site freezes machine, user stops going to site. There's zero incentive to do this and tons of incentive to not do it. Even an ad, your ads would get banned, not good for you, no incentive.
- chrisjj 6d ago
  > A user doesn't need to know anything other than "when I go to site XYZ.com my computer freezes. Not true, given any unknown link or button press can redirect/go to such a site.
- xingped 6d ago
  I think a lot of HN commenters are way too disconnected from the average person. You're making a big assumption that a user will even connect the dots until the same thing happens multiple times, if even then. The average computer user is extremely bad at connecting cause and effect on their computer. Think of how many times you hear "my computer is broken!" when actually it's something like the printer was unplugged/turned off and they were just having trouble printing a document (or, if you are so disconnected from average users/people, the answer is _this happens a lot_). Even what we think of as simple stuff completely befuddles them.
  - DrewADesign 5d ago
    > I think a lot of HN commenters are way too disconnected from the average person This is basically an old-man-and-the-starfish situation for me. > You're making a big assumption that a user will even connect the dots If they do, it’s because their wildly inaccurate mental model happened to guess the right answer. What most will think is “I was just browsing the internet and my computer froze.” Maybe they’ll connect it with that notification they just got about renewing their antivirus software subscription. Maybe it will confirm their (probably mistaken) impression that their computer has been “acting weird” since something arbitrary and unrelated happened. And similarly, some people with an accurate mental model will mistakenly assume that they deduced the cause because they’re smarter, rather than having a different focus with corresponding lacking mental models in other areas.
    - alt227 5d ago
      You sir, are very aware of how the average computer user thinks!
      - DrewADesign 4d ago
        It’s one of design’s key responsibilities. Developers need a sophisticated mental model of how it works, and how that gets displayed. Designers need a sophisticated mental model of what problems various users are trying to solve, and the best ways to communicate how the software can solve those problems, as well as state, etc. They’re both deep topics, and even as someone with significant professional experience in both design and development, I find it difficult to consider both things at once. Many things that are very important to design could be a serious PITA for developers. Many tools, such as front-end frameworks, that are important time savers in the dev environment are a serious PITA for designers to work around. Many designers don’t understand why seemingly small changes, maybe something that would require hand-rolling a common library component, could triple development time and cause huge maintenance issues. I’d say most developers don’t realize that their understanding of software architecture and construction is nearly useless when designing interfaces, workflows, etc., and that many of the folk ‘best practices’ they’ve learned about design are no more authoritative than any other folk knowledge computer users pick up. They sound like completely nontechnical gamers confidently wielding technical jargon to mis-explain phenomena people experience, and since none of the other gamers in the conversation know any better, it only bolsters their false confidence. Unfortunately, that alone explains why FOSS developers in independent projects repeatedly try and fail to make software that appeals to anybody other than software developers.
- sersi 6d ago
  An average user will not know that the site caused the issue. The first time after force turning off the computer, it will restart and reopen all windows causing the computer to crash again. The next time, they might click on the button to prevent reopening all windows and everything will be fine until they opens safari which will cause the same issue. At that point, they'll call whoever is their computer expert user to help them out.
  - trollbridge 5d ago
    It's worse than that: a default macOS install with Safari will re-open Safari, complete with re-opening the tab that was open upon a hard power off and power back on. So to get it to stop doing this on restart, I had to be very quick to force-quit Safari as the machine rebooted. You don't get a chance to tell it "Don't reopen all windows" when you hold the power button down.
    - jpc0 5d ago
      Not sure if it’s a setting but my mac definitely asks me if I want to reopen windows after a forced reboot.
- alt227 5d ago
  This is hilarious, and what if an bad actor abuses this and makes a script or browser plugin which goes to this url every time a browser is launched? What about url shorteners and redirects? You seem to dismiss the issue based on a very narrow avoidable case.
  - eks391 5d ago
    They are addressing the fact that no bad actor will care to make it, not that they can't. Sure, there are countless ways it could be abused, and you point out some, but what had actor will want to pursue even one? They gain nothing. And good actors only lose out, in the form of lost credibility and future audience. Therefore it doesn't get abused and a fix isn't needed. The last 15 years is evidence of the argument.
    - alt227 5d ago
      Im arguing against the parent point that "Site freezes machine, user stops going to site." Its a gross oversimplification, and it doesnt hold water becasue there are lots of other vectors to a user coming across this than just "oh I recognise that web address as bad so I wont go there". > but what had actor will want to pursue even one? They gain nothing Ask that to anyone who has ever rickrolled somebody.
  - exlr 5d ago
    [dead]
ktm5j 5d ago
As someone who supports some bottom of the barrel "regular users".. they aren't monkeys. They have brains that function enough to process "oh, I shouldn't do that again".
- andyferris 5d ago
  Nitpick: monkeys have enough brains for "oh, I shouldn't do that again".
  - ktm5j 5d ago
    Is that really an important detail? I think what I said got my point across.
    - CrompyBlompers 5d ago
      My brain stuck on the inaccurate monkey comparison and caused unnecessary work to get past it and back onto the point you were making.
      - ktm5j 5d ago
        Sometimes you guys think too much..
        CrompyBlompers 5d ago
        A better analogy would have reduced required thought. But here we are.
    - KomoD 5d ago
      Yes, it's disrespectful to monkeys. Monkeys have feelings too.
      - ktm5j 5d ago
        Well if one reads my comment I'll consider apologizing.
snek_case 5d ago
Ad impressions typically cost money, so there's a case to be made that this is sort of self-correcting too. That being said, IMO no website should be able to freeze your machine. This is a bug. Steps should be taken to fix it.
phoghed 5d ago
> And what about the ads people, adding such a thing if you don't load their ads? Through what mechanism? You don’t load their code, so then they presumably load this malicious code? If they could do that they would have just loaded the ad!
- zelphirkalt 5d ago
  You could be blocking specific third-parties. I know I do. Site owner could load from other party, that you happen to have whitelisted for example. Or site owner could use first party scripts for that, feeling smug showing their anti-ad-block warning and then bombing you, if after some time you don't comply and deactivate your ad-blocking solution.

lxgr 5d ago

> It's a self correcting problem. You go to a site, it freezes your machine, you never visit the site again. What do regular users do about a malicious ad that runs on thousands of different sites? > Turning off WebGL = no more Figma, no more Canva, no more Google Maps Which is why you should probably rather turn off the actual vulnerable API, i.e. WebGPU, not WebGL.

graemep 5d ago
It really ought to be something you can enable or disable per site. I was surprised to find its not.
- pmontra 5d ago
  Maybe a browser extension could inject JS in a tab to redefine all the WebGPU API into a noop.
  - graemep 5d ago
    I just remembered and checked. Noscript does allow blocking webgl on a per site basis.
pipe2devnull 5d ago
I just don’t think people are doing malicious ads like that. Like I’m sure it exists but like what’s the point? If you are the malicious person you pay money for ads to freeze someone’s computer and that’s it? It’s not even like you would gain anything from it
- jonahx 5d ago
  Failure to imagine an incentive doesn't mean there isn't one. You can't rely on this type of thinking to reason about security. The thing you would have never thought of is what gets you. For example, an ad provider itself can be hacked by a malicious party, so the "pay money for" part no longer applies. Or an attack by a state actor or other large entity, where paying for a coordinated disruption of some region or company makes financial or military sense. Those are just two things that came to my mind, and are likely a fraction of plausible incentives someone might have now or in the future. People are creative and unpredictable. Weird shit happens. Fact is stranger than fiction... Instead, just ask: should visiting a website ever have the power to freeze your computer without your consent? If you think the answer is no, this is a security bug and it should be fixed.

zipy124 5d ago

You can lose data though. Any open documents which aren't saved...

gregoriol 5d ago

> All that happens is the perp loses any audience You haven't heard about rickrolling, have you?

jonahx 5d ago

This take feels too cavalier. Since the machine is actually frozen, it enables many plausible social engineering scams ("We have detected a virus that froze your machine. Call this number for help..."), and I bet it has been used that way. Not to mention possible data loss, interruption of work at a critical time, and so on.

sans_souse 5d ago

So you're saying it's a feature?