Browserball

Browserball(weareinstrument.com)

381 points by ABNWZ 10 years ago | 73 comments

markmahoney 10 years ago |

I built this in like 2009 or 2010. Super curious how it managed to resurface now.

This is amazing.

Kind of like when I first dragged a window across multiple monitors in the 90s. We are so used to content being stuck in artificial containers that it's kind of crazy when it transcends them.

Pxtl 10 years ago | |

There was a clever game called Metal Marines back then that exploited this idea - the game was a 1v1 base-building RTS where each player's "base" was on its own map in its own window. When you fired missiles or launched APCs from one base into the other, the missile would fly out of your base window, over the desktop and into the other window to hit his base. The effect was jaw-dropping even though it was a simple and cartoony game.

viraptor 10 years ago | | |

Thank you! I was looking for that game a few days ago, but couldn't remember the name at all! And it looks like there's a reboot of it on Steam: http://store.steampowered.com/app/335940/

zyxley 10 years ago | | |

That game was amazing. I wish I'd gotten good enough at it to ever get past the first few levels.

21 10 years ago |

What's the reason for allowing web pages to get absolute screen coordinates?

This is a privacy leak. I have a 24" screen, and I don't keep the browser window maximized because it would be too big. I presume other people do to, and I'm pretty sure most have a preferred size and position.

vesinisa 10 years ago | |

Just use NoScript if you are concerned. JavaScript allows a large number of other ways to identify you as well. Direct ways of course include cookies / local storage / Web SQL, but other indirect ways include localization preferences, OS / browser / plugin / extension fingerprinting, HID inputs, side channel profiling etc. etc. – some combination of these allows uniquely identifying at least 80% of web users.[1][2][3]

Allowing a site to execute JS in your browser is equal to trusting them, like it or not, and browser vendors are definitely in the business of adding new APIs rather than reducing attack surfaces.

[1]: https://wiki.mozilla.org/Fingerprinting

[2]: https://github.com/Valve/fingerprintjs2

[3]: http://noc.to/

ErikRogneby 10 years ago | | |

Might as well say don't use the web. Disabling javascript will break most sites with a few rare exceptions. (like HN)

TazeTSchnitzel 10 years ago | |

> What's the reason for allowing web pages to get absolute screen coordinates?

Back in the 90's, Microsoft and Netscape were all too happy to give JS developers the world with almost no regard for security consequences.

We've spent the last 20 years trying to fix their mistakes.

neerdowell 10 years ago | | |

We only spent 15 years trying to fix the mistakes. The last 5 have been spent repeating them.

phkahler 10 years ago | |

>> What's the reason for allowing web pages to get absolute screen coordinates?

Web developers have always pushed for more access to information about the user and their environment. Browser and tool developers are happy to provide that access. There's always some use case that sounds reasonable, but you're right that it's just a security issue waiting to happen.

These holes are also being talked about in the new Wayland display server on Linux. Warping a mouse pointer, color picking, knowing your apps place on the desktop are all security violations. They are being very careful with that stuff because it's an insecure free for all with X.

Every time I upload an attachment to gmail or a picture to facebook, I wonder how secure things are. Those seem to require user action, but do they really?

TeMPOraL 10 years ago | | |

> Web developers have always pushed for more access to information about the user and their environment. Browser and tool developers are happy to provide that access. There's always some use case that sounds reasonable, but you're right that it's just a security issue waiting to happen.

I'm torn. On the one hand I understand the privacy implications; on the other hand, if you'd want to be serious about those, you'd have to get rid of JavaScript and half of CSS. Every interesting feature can be turned into a privacy/security violation; how far are we willing to go in removing them?

digi_owl 10 years ago | | |

> These holes are also being talked about in the new Wayland display server on Linux. Warping a mouse pointer, color picking, knowing your apps place on the desktop are all security violations. They are being very careful with that stuff because it's an insecure free for all with X.

I know the quip about how in IT paranoia is not a sickness but a job requirement, but damn it...

As for web developers pushing for more information. No surprises there, its so they can more precisely fine tune the layout of the "app" (notice how they refer to what used to be called a site with a term that used to denote something running locally).

That it also can be used to fingerprint the computer, and by extension the user, is a side effect, not a goal.

nxzero 10 years ago | |

Right, never max out your window, it's a known data leak used to fingerprint users.

gnur 10 years ago | | |

I'd say that maximizing is more general then having a custom sized window. There are only so many resolutions in use (and I would guess 50%+ is either hd, full hd or qhd). Resizing your windows yield nearly unlimited options for browser sizes.

aidenn0 10 years ago | | |

You can get screen resolution from JS, so I don't see how maxing out the window makes any difference.

zbjornson 10 years ago | |

I've used it to automatically position auxillary windows adjacent to the main window in a data analysis application. I don't see how it reveals anything private about the user... my screen resolution and window location are not secrets to me.

catmanjan 10 years ago | | |

But they may be unique to you, making you more identifiable/trackable. The TOR browser warns you when resizing the window that it reduces privacy.

Personally I don't care either, just thought you might want to know!

empath75 10 years ago | |

Just out of curiosity, what can someone do with this information?

nommm-nommm 10 years ago | | |

Create a unique fingerprint for your browser used to track you through the web.

startling 10 years ago | | |

Correlate your visits across unrelated websites.

sleepychu 10 years ago | |

How do you know the coordinates are absolute?

It seems like the child windows are 'special', perhaps the web page can obtain the relative coordinates of these child panels?

Cpoll 10 years ago | | |

It's using window.screenY (and screenX, of course,) which gives absolute coordinates. https://developer.mozilla.org/en-US/docs/Web/API/Window/scre...

I don't think the method you're describing exists. If you want child coordinates relative to parent coordinates, you would use both the parent and child's absolute coordinates.

21 10 years ago | | |

Go to https://jsfiddle.net/hj697tbg/ and move the window around for a demo.

helb 10 years ago | | |

You can get absolute position of windows or even mouse cursor without any "child window magic": http://codepen.io/anon/pen/pyVYvb

ethana 10 years ago |

I remember this demo when Chrome first came out. I thought that was the coolest thing.

edit: I found the original site that I linked to this. Courtesy of archive.org: http://web.archive.org/web/20120214090814/http://blog.insicd...

bshimmin 10 years ago |

I think the thing I like most about this is how it's evidently very imperfect - the ball sometimes goes missing, the rules for what velocity it needs to bounce from one window to another seem hazy, etc - but none of that really matters: it's fun and cool to play about with for a minute or two, it doesn't at all take itself seriously, and you know that any real implementation of this sort of thing, if there were an actual need for it, would be implemented more robustly anyway.

kirkbackus 10 years ago |

I made a project in college like this that utilized the Windows API to enumerate the rectangles of the windows and you could create shapes and other things that you can throw around your desktop

https://www.youtube.com/watch?v=38qWXZ0hDv4

DonHopkins 10 years ago |

I am frustrated that it's 2016, and we still can't tilt windows diagonally.

_yosefk 10 years ago | |

Drawing programs such as Photoshop and Corel Painter can do it (in fact they tilt the window you paint into while keeping menus etc. straight which is what one wants them to do.) I guess it's a bit harder to do in one's program than it ought to be though, especially with the stellar hardware support provided by the cheapest integrated GPU.

agumonkey 10 years ago | |

Meaning ?

DonHopkins 10 years ago | | |

Then you could make the ball roll down towards the corner and drop into another window, of course!

The NeWS window system let you reshape the entire framebuffer to any orientation or clipping, as well as individual windows and sub-windows, in the late 1980's.

Why shouldn't I be able to lay down on my side next to a laptop and read a web page off the screen sideways, or adjust the rotation of the window to match the inclination of my pillow?

The other thing I want the window manager to support (which NeWS couldn't do since PostScript only supports 2D affine transforms) is estimating my head position relative to the screen, and projecting the window in perspective so it looks rectangular from an oblique viewing angle, so I can watch a movie on an extra screen off to the side.

If you could rotate windows around on the screen, Browser Ball should be able to use the laptop accelerometer to detect the true direction of gravity, and bounce the ball accordingly as you turned the windows and the laptop itself around.

Unfortunately Apple stopped putting accelerometers in laptops with SSD drives, since they were only used to retract the heads when falling.

You can do a lot of fun things by modeling and tracking the positions of multiple people's heads and multiple devices in augmented reality! Here are two people using two tablets, two laptops, and a desktop computer together with Pantomime: [1]

[1] https://vimeo.com/149319403

neogodless 10 years ago |

Everything was made to be broken. Got this neat effect where the ball was spinning rapidly in the corner of each spawned window! http://imgur.com/gmwQOCb

junto 10 years ago |

This is one of those awesomely pointless conceptual experiments. Love it.

visakanv 10 years ago | |

The internet Ig Nobel!

cyphar 10 years ago |

I remember playing with this at least 8 years ago. It's really scary that there's enough information disclosure in browsers that it's possible to do this.

softawre 10 years ago | |

> really scary

This is really scary to you? I get that you can do fingerprints, and honestly there's a LOT more than just browser window position/size in them, but "really scary"?

Maybe we need to stop exaggerating on this sort of stuff if we want people to take us seriously.

cyphar 10 years ago | | |

Fine. It's scary that browsers allow for so much fingerprinting. This toy webapp is an example of a larger picture of "things that we really shouldn't allow to happen". So "really scary" was referring to the issue of browser fingerprinting as a whole, not just one toy webapp.

zbjornson 10 years ago | |

What do you see being disclosed? The origin has control over the windows it creates and nothing else.

beeboop 10 years ago | | |

You can very uniquely identify people based on browser positioning and sizing.

This tester uses it I believe: https://panopticlick.eff.org/

nxzero 10 years ago |

YouTube Demo: https://m.youtube.com/watch?v=XmH2QF92Jwo

mavci 10 years ago | |

why so serious?

tjtate 10 years ago |

they did this with the birds in the wilderness downtown experiment like 5 years ago right? http://www.thewildernessdowntown.com/

tokenizerrr 10 years ago | |

I just wanted to try that since it seems interesting. Sadly it tells me to enter the address of the home where I grew up, but then promptly refuses to recognize anything that I put in. It also says I can try schools, but does not recognize any of those either.

Maybe it only recognizes American addresses or something, but I don't know any of those.

edit: Ok I got it working by putting in Amsterdam, which happens to be a city and not an address.

mjs7231 10 years ago |

Is the full ball rendered behind an overlapping window? The world may never know.

ptibbetts 10 years ago |

I can't remember the last time I was so happy to have 3 screens

stevep98 10 years ago |

Reminds me of the Amiga Boing Ball demo from 1984.

https://www.youtube.com/watch?v=-ga41edXw3A

ahabman 10 years ago |

Security issues aside, has anyone tackled how to intentionally span multiple monitors using similar techniques? e.g. A dedicated four monitor web-based media dashboard.

krolow 10 years ago |

remembers one project that i did 4 years ago https://www.youtube.com/watch?v=NgA5EvOryU0