SoylentNews is people
SoylentNews
Submitted via IRC for SoyCow3941
Some of the recent additions to the Cascading Style Sheets (CSS) web standard are so powerful that a security researcher has abused them to deanonymize visitors to a demo site and reveal their Facebook usernames, avatars, and if they liked a particular web page of Facebook.
Information leaked via this attack could aid some advertisers link IP addresses or advertising profiles to real-life persons, posing a serious threat to a user's online privacy.
The leak isn't specific to Facebook but affects all sites which allow their content to be embedded on other web pages via iframes.
The actual vulnerability resides in the browser implementation of a CSS feature named "mix-blend-mode," added in 2016 in the CSS3 web standard.
The mix-blend-mode feature allows web developers to stack web components on top of each other and add effects for controlling to[sic] the way they interact. As the feature's name hints, these effects are inspired by the blend modes found in photo editing software like Photoshop, Gimp, Paint.net, and others. Example blend modes are Overlay, Darken, Lighten, Color Dodge, Multiply, Inverse, and others.
The CSS3 mix-blend-mode feature supports 16 blend modes and is fully supported in Chrome (since v49) and Firefox (since v59), and partially supported in Safari (since v11 on macOs and v10.3 on iOS).
(Score: -1, Redundant) by Anonymous Coward on Monday June 04 2018, @08:51PM (1 child)
The AC is correct: Given agreement between browser and content-creator, it is better to allow the content-creator to decide layout. Obviously.
The browser is just some random courier; I'd much rather have the passionate artist determine presentation.
Perhaps the browser and the server should negotiate display characteristics. This could be simplified by defining standard characteristics, such as "A4" size, and various dimensions used by smartphones, tablets, and the like.
The web is such a shitty lets-be-first-to-market-then-go-rock-climbing-in-Europe-because-we-are-fit-20-something-year-old-beautiful-people kind of place.
(Score: 1, Troll) by realDonaldTrump on Monday June 04 2018, @10:50PM
Let me tell you, 20-something-year-old beautiful people can be amazing. People don't know this, my wife Melanie was 28 years old when we started dating. I was 51 and married. The haters said it wouldn't work out. WRONG, it's been PERFECTO. We've had so much fun, she always looks incredible, we have a beautiful son. Believe me, I'd date another 20-something in a heartbeat. Except that when my daughter was in high school she made me promise not to date younger than her. But maybe she forgot!!