PrusaSlicer 2.3.0-alpha3 is released.  

RE: PrusaSlicer 2.3.0-alpha3 is released.

Hey - I need folks to chime in on a new "feature" in Prusa Slicer alpha 2.3.0.a2--  hyper links in the normal UI, replacing what was hover text, in the region of print tab settings.

I can't count the number of times I've opened a browser to Prusa when all I wanted to do was click a check box or view hover test. 

https://github.com/prusa3d/PrusaSlicer/issues/5196

I would not mind it bringing up a local copy of help text for a deeper explanation, or even heading off the parts unknown on the web IF I INTENTIONALLY SELECTED TO BROWSE.  But to have incidental clicks open other applications is just bad form. Especially when some internet access is metered, tracked, or just not wanted.

Ideally I'm voting for it to be a right click pop-up choice, not an immediate action, and at a minimum the ability to turn it off. 

RE: PrusaSlicer 2.3.0-alpha3 is released.

Also a massive security risk, and a time saver for the ransomware criminals since they only have to make modifications to the URLs and distribute a modified version to the unsuspecting.

Opening up a web connection, particularly a one-click operation with no confirmation, is a bad idea.

RE: PrusaSlicer 2.3.0-alpha3 is released.

I guess it's horses for courses. I thought the cross reference was great idea and the way it works seems quite logical. You hover over the value if you're thinking of changing it and over the variable name if you want to know more about it.

It does warn you if you hover over the variable name by tooltiping a URL.

Perhaps it will be less of an issue when Prusa migrate to local help (assuming they ever do). 

RE: PrusaSlicer 2.3.0-alpha3 is released.

Posted by: @towlerg

[...] Perhaps it will be less of an issue when Prusa migrate to local help (assuming they ever do). 

It would definitely be less of an issue if they'd pull down refreshed HTML or other formatted help pages rather than launching a browser. 

RE: PrusaSlicer 2.3.0-alpha3 is released.

CHM files are one thing, but linking to third party sites without any user action is just plain silly.  Most people in the software industry identify such practices as click bait (and they are being nice).  None of my professional product software engineers would ever have even considered such a notion, and management would never have let it happen.  The closest is the Help About panel, it could have a hot link to a web site for license and privacy - even then, we always placed the files local because it was just a better idea and best practice.

If this continues and Prusa really does this, now I have to order the edge firewalls to block all external access by all Prusa products. Sheesh.

RE: PrusaSlicer 2.3.0-alpha3 is released.

Too funny: they are so busy making the tool a click bait trap that they forgot ho to make useful accurate web links to the product they want people to use.  More evidence that html links are prone to accidental errors as well as malicious ones.  

Download link:

https://github.com/prusa3d/PrusaSlicer/releases/tag/version_2.3.0-alpha3

ps: to the less astute - that link takes you to a place that the text does NOT indicate.

RE: PrusaSlicer 2.3.0-alpha3 is released.

And I am still trying to find any other application that has html links that open up a browser with a single conventional left click.  So far, zero.

I think the only reason people haven't flared up is that right now only a few of the links are implemented. It will be interesting when every item with hover-text hints has a web link instead of fixed labels.  

And - for whatever reason - you can't even make the Firewall block slicer from opening external links.  So now it's looking like users will need to hack the registry to keep the security risk minimal.  This keeps getting worse. lol - not.

RE: PrusaSlicer 2.3.0-alpha3 is released.

lmao - so this is the rage for increasing a revenue stream - bury facebook, google, and whoever else's analytics targets in your web page, and then make it all but impossible to keep people from accidentally opening your web page filled with said click bait targets. 

RE: PrusaSlicer 2.3.0-alpha3 is released.

It gets better - now, it seems to be randomly starting up teams when I click random locations near html links within PrusaSlicer 2.3.0a3 ... this is hilarious.  Honestly, all I am trying to do its create a couple firewall rules to block Plicer (the name I am going to continue using until this is fixed, even though I know it annoys the hell out of the devs).

RE: PrusaSlicer 2.3.0-alpha3 is released.

@-2

"lmao - so this is the rage for increasing a revenue stream - bury facebook, google, and whoever else's analytics targets in your web page, and then make it all but impossible to keep people from accidentally opening your web page filled with said click bait targets." Are you accusing Prusa of doing ant of the above?

RE: PrusaSlicer 2.3.0-alpha3 is released.

> And I am still trying to find any other application that has html links that open up a browser with a single conventional left click.  So far, zero.

Ideamaker?

A "?" icon in the left bottom corner of their "Advanced settings" dialog opens a web browser with their help desk.

RE: PrusaSlicer 2.3.0-alpha3 is released.

Posted by: @vojtech-bubnik

[...] A "?" icon in the left bottom corner of their "Advanced settings" dialog opens a web browser with their help desk.

Indeed, although it's well out of the way for a casual inadvertent click. ideaMaker is closed source, so somewhat less chance of somebody distributing malicious versions with as much ease, but they are also guilty of not indicating what is to be done.

A lot of corporations won't allow the installation of software that does this sort of thing for exactly these reasons. It would be a good idea to provide a user preference to disable "link to external content". I'm a bit more worried about it in Prusa's case because of past moves they've made like linking user accounts between the online shop and forums. A would-be attacker not only could link to a malicious site but also knows that there's a good chance the user will connect to Prusa's site with an authenticated account. 

RE: PrusaSlicer 2.3.0-alpha3 is released.

Quick follow-up: The Prusa online account holds a complete mailing address, confirmation of permission to process personal data and -- for some reason -- a field for date of birth. Not sure how difficult it would be for someone familiar with the process to auto-order some neat stuff, but it would be nice to hear that this has been anticipated and protected against.

While the "whatabout" defense of ideaMaker doing something similar is valid (but hardly reassuring), Raise 3D only links to a generic support page with no user credentials. My concern is that it is very easy to inadvertently click the green text which opens a browser to the Prusa help site, and from there a click takes me to the Prusa online store using the same credentials that I used to log into these forums.

RE: PrusaSlicer 2.3.0-alpha3 is released.

I think we have two issues here. One is the UI issue and the other is the security issue.

> I can't count the number of times I've opened a browser to Prusa when all I wanted to do was click a check box or view hover test. 

I do not understand why you are clicking on the item label. It never did anything in PrusaSlicer 2.2 and older. Now clicking on the label opens a web browser and the tooltip shows the hyperlink. Everything is transparent.

> But to have incidental clicks open other applications is just bad form. Especially when some internet access is metered

ok, I can understand that being connected over the cell phone may be expensive. I wonder what system you are using, where you have a fine control of the amount of internet communication to minimize data usage.

> tracked

PrusaSlicer downloads profiles over internet. The help is on the same Prusa site. I don't think it may be harmful for you that somebody finds out you were connected to Prusa3D site. Maybe I am not conscious or security aware enough? Would you please enlighten me?

> or just not wanted.

I can understand that opening a browser may take time on an old computer or it may be annoying.

> Ideally I'm voting for it to be a right click pop-up choice, not an immediate action, and at a minimum the ability to turn it off. 

We may do that after all, if we get enough of feedback as of yours.

> ideaMaker is closed source, so somewhat less chance of somebody distributing malicious versions with as much ease, but they are also guilty of not indicating what is to be done.

I am not buying that argument. PrusaSlicer is open source, so anybody could produce a malicious version of it, and the malicious build of PrusaSlicer could do much worse things than opening a web browser with some web page. That is the beauty of open source. Anybody could fork it and build his version. We have no control over it, it is up to the users to download and use a build produced by us. It is all about trust. If you don't trust us, then you should not install our software in the first place.

We are trying to play safe. PrusaSlicer downloads profile updates from PrusaSlicer site. We only allow the profile updates to be downloaded from our site for security reasons. There is a pull request to lift that restriction, but I would not merge it. https://github.com/prusa3d/PrusaSlicer/pull/4129

> A lot of corporations won't allow the installation of software that does this sort of thing for exactly these reasons.

Why? Because they fear that somebody will fake their DNS and the request will be redirected? Or because they don't trust the vendor of the software? Then they should not allow installing such software on their machines in the first place. I am not buying into this argument.

RE: PrusaSlicer 2.3.0-alpha3 is released.

@bobstro

> Quick follow-up: The Prusa online account holds a complete mailing address, confirmation of permission to process personal data and -- for some reason -- a field for date of birth. Not sure how difficult it would be for someone familiar with the process to auto-order some neat stuff, but it would be nice to hear that this has been anticipated and protected against.

What does it have to do with PrusaSlicer help page being opened?

> While the "whatabout" defense of ideaMaker doing something similar is valid (but hardly reassuring), Raise 3D only links to a generic support page with no user credentials. My concern is that it is very easy to inadvertently click the green text which opens a browser to the Prusa help site,

That may be.

> and from there a click takes me to the Prusa online store using the same credentials that I used to log into these forums.

If I understand you correctly, you claim that just going to help.prusa3d.com is toxic because you may be logged into prusa3d? Which click would bring you to https://shop.prusa3d.com/ ? PrusaSlicer does not send you there, you would have to do it yourself. I still don't get it.

RE: PrusaSlicer 2.3.0-alpha3 is released.

@-2 @bobstro

To make everybody happy, we will open a dialog, asking whether you want to open the browser or not, and we will allow you to remember your choice and not ask again. 

Still I would like to understand the security consequences of our current implementation.

RE: PrusaSlicer 2.3.0-alpha3 is released.

Reading through this thread, I'm just really sad, that you think so little of us.
We were just trying to make accessing the documentation easier.

RE: PrusaSlicer 2.3.0-alpha3 is released.

Posted by: @mikolas-zuza

Reading through this thread, I'm just really sad, that you think so little of us.
We were just trying to make accessing the documentation easier.

Don't take it that way... or at least don't take my comments that way. The most valuable thing you can get in business is feedback. If you're not getting feedback, that means customers are just leaving and you'll never know why.

I'm not here to score points at anybody's expense, but I am glad there's a discussion on the downside to this approach. It's not that it's a horrible idea, but it should be done with security in mind upfront rather than trying to play catch-up after a serious incident.

I'm going to reply to the questions above when I have more time. Let me just summarize by saying that I work in cybersecurity and have seen the consequences that can result from not thinking something through. The single biggest security threat to companies these days is a user with a web browser.

Please take my comments as valuable feedback -- which you're welcome to disregard -- intended to help make your excellent software even better. I assume most posters here feel the same. I hope you've read many of my other posts where I praise PrusaSlicer and Prusa in general. What you've done with the rickety Slic3r code that you started with is truly amazing and it keeps getting better. It's just that this one may have implications that need to be fully understood.

Now I do think there's room for improvement with bridging... but that's another discussion. 😀 

Stay safe!

RE: PrusaSlicer 2.3.0-alpha3 is released.

Posted by: @vojtech-bubnik

@-2 @bobstro

To make everybody happy, we will open a dialog, asking whether you want to open the browser or not, and we will allow you to remember your choice and not ask again. 

Still I would like to understand the security consequences of our current implementation.

Unfortunately I'm busy this afternoon, so can't reply properly right now.

In short, when PrusaSlicer opens a browser on the user's desktop, it has whatever settings and permissions that user has enabled. This means the browser opened by PrusaSlicer is the user for all intents and purposes. If that user has logged into their forum account and that forum account is tied to their online store account, the browser has the user's permissions to jump between tabs.

Try this for yourself: Log out of the online store and forums. Log back in only on the forums. Then open another tab and navigate to the store. If you're already logged in, you'll notice you can access your full account data.

The danger is that this access could be used in an attack:

• If somebody manipulates the PrusaSlicer code and distributes it (e.g. linking to it from 3rd party web sites), they could be inserting a URL that opens a malicious site to install malware, then has access to the user's browser (incl. Prusa web store info). This is made worse by the fact that PrusaSlicer is installed as 3rd party software and not "approved and verified" by Microsoft or Apple.
• If the Prusa help site is hacked, the page those helpful links land on can be manipulated to point to malicious sites or to let the attacker gather useful personal information such as what's contained in the online store accounts.

Those are just a couple of quick examples. The ransomware attackers are using much more tricky techniques as well.

In short: Browsers are dangerous, particularly if they do something the user isn't in full control over.