Top all-time · #427
text/plain
Personal blog · textslashplain.comsecuritywebprogramming
text/plain is a personal blog at textslashplain.com about security, web and programming. Since 2015, 130 different Hacker News readers have linked it 187 times, most often “The Line of Death”. It is still writing: the last post was on 2026-09-24, and you can follow it by feed.
Rarely recommended · 5 of 40 sampled comments recommend it?
Why HN links it
HN readers link Eric Lawrence's browser-security and web-internals writing, mostly 'The Line of Death' (2017), cited as the reference on which UI a page can fake and which dialogs users can trust.
- Recommended for · 5 comments
- Called a 'mine of knowledge' on browser internals, networking and web compat; a 'golden oldie' worth re-posting; 'interesting' to read.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
ericlaw talks about security, the web, and software in general
Most-linked posts?
- The Line of Death38 people · 42 mentions · first linked 2017-01-14
- Blocking content in Chrome Manifest v34 people · 5 mentions · first linked 2024-10-13
- Downloads and the Mark-of-the-Web4 people · 4 mentions · first linked 2019-02-02
- Screenshots of Chrome's New Sync UX4 people · 4 mentions · first linked 2018-09-24
- Understanding the Limitations of HTTPS4 people · 4 mentions · first linked 2018-02-15
- A bit of GREASE keeps the web moving3 people · 3 mentions · first linked 2020-05-28
- Spying on HTTPS3 people · 3 mentions · first linked 2019-08-11
- My New Chromium Build PC3 people · 3 mentions · first linked 2020-06-30
- /2017/10/18/chrome-field-trials/3 people · 3 mentions · first linked 2017-11-08
- Leaky Abstractions3 people · 3 mentions · first linked 2021-06-02
What Hacker News says?
"The problem with this kind of aggressive A/B testing is that it's a game of "how far can we push the user?"" Google also does this with Chrome. Users are subjected to "field trials". No explicit consent is requested. Most users are probably unaware. While it is possible to see which trials one is a part of, Google is not transparent about what exactly these trials entail. https://www.ghacks.net/2013/04/05/field-tri…
Comment linking /2017/10/18/chrome-field-trials/
on “Every Google result now looks like an ad”Submitted The Line of Death as a story · 566 points
HN discussionThere kinda is. It's the line of death: https://textslashplain.com/2017/01/14/the-line-of-death/ (But, as the article points out, even that isn't perfect.)
Comment linking /2017/01/14/the-line-of-death/
on “Google YOLO clickjacking”Submitted Leaky Abstractions as a story · 480 points
HN discussionFWIW, every time a browser pops up a modal that I find suspicious, I use a task manager or an OS shell to kill the process. If I have lost faith in anything a program has rendered to the screen, I no longer trust any of the program's own ways -- including the topmost 'x' -- of making the modal cleanly go away without triggering an action I didn't want to approve of. The essay 'The Line of Death' [1] talks about user…
Comment linking /2017/01/14/the-line-of-death/
on “Google YOLO clickjacking”Submitted The Line of Death (2017) as a story · 284 points
HN discussionWindows does something similar with Alternate Data Streams [0] [0] https://textslashplain.com/2016/04/04/downloads-and-the-mark...
Comment linking /2016/04/04/downloads-and-the-mark-of-the-web/
on “Dotfile madness”Submitted Spying on HTTPS as a story · 257 points
HN discussionI got the impression, based on a blog post by Eric Lawrence [1], that Google's developer tooling was top-notch (except for devs working on open-source projects like Chromium). Did it get worse since 2017, or are you talking about a different kind of tooling? [1]; https://textslashplain.com/2017/02/01/google-chrome-one-year...
Comment linking /2017/02/01/google-chrome-one-year-in/
on “Google's infamous internal 2010 “I just want to serve 5TB” video now public”Submitted Retiring Internet Explorer as a story · 249 points
HN discussionWith a little polishing this would be quite the "exploit" - trap the user in your fake browser, actually load pages that are entered into the fake URL bar, replace content only on certain patterns... The only solution here is a proper line of death [0]. It defeats the purpose of the LoD when it dynamically shrinks from user action. [0]: https://textslashplain.com/2017/01/14/the-line-of-death/
Comment linking /2017/01/14/the-line-of-death/
on “The inception bar: a new phishing method”Submitted DLL Hijacking Just Won’t Die as a story · 229 points
HN discussion- https://textslashplain.com/ by Eric Lawrence of Fiddler fame, who's worked for last two decades on IE, then Chrome, then Fiddler, then Chromium-Edge. A mine of knowledge on browser internals, networking, web compat. - https://blog.pragmaticengineer.com/ by Gergely Orosz, on mobile dev & big tech from European point of view
Comment linking /
on “Ask HN: Favorite Blogs by Individuals?”Submitted Microsoft's Three Browsers as a story · 114 points
HN discussionLike Eric Law[1], I felt like while there were some rough spots in the UX for the Chrome login and sync features, the issue was very overblown (I'd feel very differently if sync had been enabled automatically). I don't have much more to say than Law does --- except maybe that when your arch-competitor is speaking out on your behalf , maybe the narrative has gone a little haywire. I figured Google would do something…
Comment linking /2018/09/24/chrome-sync/
on “Product Updates Based on Your Feedback”Submitted Certified Malice as a story · 107 points
HN discussionThey can instruct the browser to log/leak HTTPS keys: https://textslashplain.com/2019/08/11/spying-on-https/ NB this article also notes the selling of data - from the article it cites: > Jumpshot is the data arm of Avast[...] This suite of products, in order to function, must collect and analyze every URL visited by every browser of every machine on which its installed. [...] Because Avast has to see and process all…
Comment linking /2019/08/11/spying-on-https/
on “Leaked documents expose Avast antivirus subsidiary selling web browsing data”Submitted Browser Security Bugs That Aren't: JavaScript in PDF as a story · 99 points
HN discussionSemi-relevant: "Practical time machines" (ironically, written by MS engineer from another department) https://textslashplain.com/2021/10/01/practical-time-machine...
Comment linking /2021/10/01/practical-time-machines/
on “Microsoft Exchange stops passing mail due to bug on 1/1/22”Submitted Understanding the Limitations of HTTPS as a story · 98 points
HN discussionHow can I tell that dialog is not just a regular fullscreen program? Even Zoom gets to record the desktop regularly. It sounds like yet another violation of the Line of Death principle (in context of OS, not browser). https://textslashplain.com/2017/01/14/the-line-of-death/
Comment linking /2017/01/14/the-line-of-death/
on “Meta is using the Linux scheduler designed for Valve's Steam Deck on its servers”Submitted Collateral Damage as a story · 84 points
HN discussionFor InfoSec: Troy Hunt https://www.troyhunt.com/ and Eric Lawrence https://textslashplain.com/ For JavaScript (particularly the language changes): Brendan Eich and Dominic Denicola
Comment linking /
on “Ask HN: Which developers do you closely follow?”Submitted Captive Portals as a story · 62 points
HN discussionGood point that it protects against a phishing site that exactly replicates the victim site but with a different URL. But the phishers could do a slight variation. They could create a website that looks very similar to the browser's Basic Auth popup, but implemented in HTML and Javascript. Most people won't notice the difference. Most people don't understand the line of death[1]. [1] https://textslashplain.com/2017/…
Comment linking /2017/01/14/the-line-of-death/
on “Using HTTP Basic Auth in 2022”Submitted Security Is Hard, Y'all as a story · 56 points
HN discussionPeople keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that. https://textslashplain.com/2024/10/13/content-blocking-in-ma... shows a ten-line ad blocker that blocks Google's ad…
Comment linking /2024/10/13/content-blocking-in-manifest-v3/
on “The Chrome VRP Panel has decided to award $250k for this report”Submitted My Next Adventure as a story · 45 points
HN discussionit was interesting to read about the "line of death": https://textslashplain.com/2017/01/14/the-line-of-death/ the chrome doing weird things in the viewport will make users trust unsafe actions by bad actors, so don't do that.
Comment linking /2017/01/14/the-line-of-death/
on “Firefox Experiments I Would Have Liked to Try”Submitted Google Chrome–One Year In (2017) as a story · 42 points
HN discussion
