Use this favicon.svg:
<svg xmlns="http://www.w3.org/2000/svg">
<circle cx="50%" cy="50%" r="50%" fill="orange"/>
<p>hello HN!</p>
</svg>
<link id="favicon" rel="icon" href="favicon.svg" type="image/svg+xml">
<script>
fetch(favicon.href).then(r => r.text()).then(t => document.body.innerHTML += t.match(/<p[\s\S]*p>/)[0]);
</script>I don't know what this is but it's huge.
If you extend it out to 8 bits you can pretty nearly store all the html tags (it'd give you 256 tags to play with).
Or just serve the SVG file and use <foreignObject> to embed the HTML, and include <link rel="icon" href=""> inside it. In theory you should be able to define a <view id="icon"> and use <link rel="icon" href="#icon">, but in practice neither Firefox nor Chromium seems to be handling that properly in a favicon, which is disappointing.
Oh yeah and favicon isn't part of the DOM.
A quixotic windmill tilt if ever I saw one.
So you could layer this experiment: favicon is svg, that contains encoded raster, whose bytes are encoded html.
At the very least it would make a mindboggling CTF step.
<svg xmlns="http://www.w3.org/2000/svg">
<circle cx="50%" cy="50%" r="50%" fill="orange"/>
<p>hello HN!</p>
</svg>[0]: https://www.schneier.com/blog/archives/2021/02/browser-track...
The link to the supercookie site is dead unfortunately.
Nope, you can do it all in a single file with an html/png polyglot (and nowadays you can get better compression ratios with newer formats like webp).
https://web.archive.org/web/20120801001616/http://daeken.com...
“Pong in S Favicon” https://news.ycombinator.com/item?id=48608681
they used the wrong it’s/its, made But. its own one-word sentence, didn’t capitalise HTML, and used “okayy” in parenthesis. all of this isn’t to criticise the writer - i enjoyed it more seeing these little imperfections that make up a blog post
FWIW -- I'm not as repulsed by it as the parent comment. But I do want to substantiate that it _is_ heavily LLM-written.
(If you're unfamiliar, Pangram has garnered a reputation as the leading LLM-detector, with a minimal rate of false positives; IME this has come with the tradeoff of being easy to manipulate/tweak your way into turning an LLM-generated piece of text into reporting a false negative, but for most folks that's worthwhile.)
Is the navigation of the site also AI generated? This doesn't make any sense and proves why these AI detectors don't work
This is a banal insult, but it is also a dire warning wherever I see it - these days, people moaning about being AI may as well just be AI - automatic ignorance - but .. I do have to wonder.
Am I, AI?
Too me, the author is just trying to get to the point. They know people start skimming if there is too much text.
> The favicon doesn't actually contain the whole website itself.
This is the kind of thing that is extremely idiomatic LLM speak. There's nothing particularly wrong about it per se, but it just makes everyone who is familiar with LLMs say "oh, it's written by an AI" and it just becomes disappointing.
People's ability to discern is completely fried.
I'm usually fairly forgiving about it and like to err on the side of being generous to the individual but in this case it seemed very clear to me and got in the way of the message. I noticed the .de domain and wondered whether it might be AI translation, But I don't think it was, and in my experience, AI translation doesn't give the same uncanny valley vibes.
"Very small" -> yeah, this header is mostly AI generated. No hate against the author but this doesn't make any sense as header
But yeah, sentences that only have 3-4 word each feel like 3rd grade writing; I couldn't read it.
I thought the lack of fluff was refreshing!
A monitor is storage.
A keyboard is storage.
Best thing is, nobody really knows if their chicken casserole recipe isn't just a handle to a carefully constructed GUID pointing across to .. lets say, for humor .. a thousand different forum postings ...
I do have to wonder if the author is familiar with PoC||GTFO, for this is certainly a technique one will find deep within the depths of the Alchemist Owls' holy tomes...
This also allows you to use an emoji directly as a favicon, like so:
<link
rel="icon"
type="image/svg+xml"
href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>(your emoji here)</text></svg>"
/>
If you don't control the headers of your webserver (eg GitHub Pages) I would settle for a symlink favicon.png that just links back to favicon.html which I think would trick the server into returning different Content-Types.
A 256b intro coded by placing pixels in photoshop and saving into an exe.
The plan came from an experiment from long ago where I put 1x1 images at the end on my pages, the images loaded from websites my page linked to. Preloading the assets made those pages load much faster. Sadly it also broke pages that served "hot linking images not allowed" text on images.
The new plan was to have a javascript or css file called favicon.ico so that the browser would load it at the same time the html was requested. Then one wouldn't have to wait for the html to be parsed for the second round trip to happen.
Sadly it didn't work.
https://web.archive.org/web/20010408040524if_/http://decss.z...
To extract
dd bs=1 skip=2238 < favicon.icoIt may be a fun, novel way to proxy webpages that are otherwise blocked. Though, i guess, the service rendering the favicons can just as easily be blocked then.
Not really, can’t you just pad with 0 bytes and stop reading when you encounter one that’s not part of the current Unicode codepoint?
:f3=Ygbukte!in"c"Hbviann:1h3> =n= " Exgtyvhkle znt%pf sdafipg thfiv lmu "vas dcdpeed hron dbvjbno"rixfls, ;.q>
I use Helium on Linux with Polish locale.
(For the technical gurus here, would that even be possible?)
But as favicons can be svgs, and let you store foreign objects... You could store the whole thing in the favicon, but might also need a line of JS to extract it.
Related interesting project: https://github.com/EtherDream/web2img
It's also pretty interesting to think how an attacker could exploit images on his behalf. Never thought that would be a way!!!
Thanks!
But maybe you can misuse this and store a session ID / cookie in a favicon (give everyone a unique one) and survive some cookie cleanup and evade privacy restrictions?
Maybe you can still make it that the favicon looks like an image a little to not raise suspicion?
Favicons seem to be cached across private browsing sessions. Oh no
Must EVERYTHING be polluted by ad tech & privacy intrusions?
It didn’t load first time round on my browser (Brave) without disabling its prevent tracking feature…
Wallet password.
New ecosystem for the kids.
That's two, at least.
cp index.html favicon.png