jimmydorry
Joined 8 years ago
Joined 8 years ago
Finally... The CEF they used was 2 years out of date, and after RCE exploits [0] occuring in the wild getting big enough that they got picked up in the media [1], we finally have a fix 1 month later.
[0] https://blog.scrt.ch/2026/09/22/how-one-twitch-chat-message-...
[1] https://news.ycombinator.com/item?id=49852143
[2] https://www.scworld.com/brief/vulnerable-obs-overlay-and-chr...
Bringing it back to the topic on hand, this is very much an area I wouldn't want to see a heavy handed EU legislate something that just further cements the incumbants and makes everything worse forever... just like mandatory micro-USB would have been. I can totally see the EU legislating something like a mandatory Meta communication protocol with compulsory attestation from Meta servers.
1. https://news.ycombinator.com/item?id=46843805
Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.
"Please stop looking at all network requests, especially when you don't need to."
doesn't result in action... while:
"You can no longer look at all network requests" requires extension makers to update to the new paradigm.
Google has no shortage of options for serving up ads that can't be blocked by normal ad blockers across all their properties (youtube, search, etc.). They in-line the ads these days! And if they really cared about the fraction of a fraction of a percent of people that even install any kind of adblocker, they could make the served ad content un-blockable by serving it the exact same as the content.