Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • I played with this once hoping the browser wouldn't care what the file was.

    The plan came from an experiment from long ago where I put 1x1 images at the end on my pages, the images loaded from websites my page linked to. Preloading the assets made those pages load much faster. Sadly it also broke pages that served "hot linking images not allowed" text on images.

    The new plan was to have a javascript or css file called favicon.ico so that the browser would load it at the same time the html was requested. Then one wouldn't have to wait for the html to be parsed for the second round trip to happen.

    Sadly it didn't work.

    by econ
  • That reminded me of Inigo's "real pixel coding" https://www.youtube.com/watch?v=FvS_DG8yIqQ

    A 256b intro coded by placing pixels in photoshop and saving into an exe.

    by cfrs
  • Cool! Here is a GH repo demonstrating unbounded favicons I made 11 years ago - it crashes some browsers - wanna guess how long it took each one to fix it :D https://github.com/benjamingr/favicon-bug
    by inglor
  • I'd love to see you try serving the exact same file for both but the trick is that you need to return different Content-Type headers depending on what is requested. When the browser requests /favicon from a navigation event it will use Accept: text/html etc, you return the file with Content-Type: text/html and inside the response you have a <link rel="favicon" href="/favicon" type="img/png"> literally the same resource but the browser will now likely fetch with Accept: image/... and you could return the same file with Content-Type: image/png and the same resource will get used for both. Unless the browser caches the response, I feel like this would work.

    If you don't control the headers of your webserver (eg GitHub Pages) I would settle for a symlink favicon.png that just links back to favicon.html which I think would trick the server into returning different Content-Types.

    by clusmore
  • Fun Fact: You can use any inline SVG for a favicon and keep it right in the HTML document.

    This also allows you to use an emoji directly as a favicon, like so:

      <link
    rel="icon"
    type="image/svg+xml"
    href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>(your emoji here)</text></svg>"
  />
    (HN isn't showing the emoji)
    by jorisw
  • Just as a heads-up, if you do this and you want to use #rrggbb color codes or url(#id) links, you have to escape the # as %23, otherwise it gets parsed as a URL fragment and your SVG code is cut off there.
    by Timwi
  • Oh, I am so aligned with this mentality:

        A monitor is storage.

    A keyboard is storage.
    Forum posts are storage. Markov-approved tweaks in an edit, over time, certainly enough for quite a lot of storage. Dual-use storage to boot, since .. you know .. sometimes the comments are socially interesting.

    Best thing is, nobody really knows if their chicken casserole recipe isn't just a handle to a carefully constructed GUID pointing across to .. lets say, for humor .. a thousand different forum postings ...

    I do have to wonder if the author is familiar with PoC||GTFO, for this is certainly a technique one will find deep within the depths of the Alchemist Owls' holy tomes...

    by MomsAVoxell
  • Codes within codes. Wheels within wheels.
    by drob518
  • I found the agressively staccato, clearly LLM-generated content extremely difficult to read.
    by esquivalience
  • Which bit? The short sentences?
    by scottmcdot
  • It’s the new internet. So, so annoying.
    by estetlinus
  • I found the writing engaging and enjoyable to read.
    by istjohn
  • There should be a pathology for thinking things must be LLM generated when it's simply not always the case.

    People's ability to discern is completely fried.

    by stevenhuang
  • I complained about this style of writing on Medium a few months ago. The author of the article replied that it's a preferred style if you anticipate your writing to be read on a small smartphone screen. This kind of makes sense. Whether that article (or this one) was AI-generated or not, I don't know.
    by themadturk
  • I like the way it's written. I often write in a similar manner and I have never used LLMs to generate an writing for me. I have written exactly this way at work.

    Too me, the author is just trying to get to the point. They know people start skimming if there is too much text.

    by benhill70
  • for the first time in a while on HN, i disagree with the characterisation as AI-generated. at most it was drafted with an LLM, but the final output is pretty human to me.

    they used the wrong it’s/its, made But. its own one-word sentence, didn’t capitalise HTML, and used “okayy” in parenthesis. all of this isn’t to criticise the writer - i enjoyed it more seeing these little imperfections that make up a blog post

    by bstsb
  • Halfway through I was sure that there would be a reveal at the end of the article that the article itself was stored in the site's favicon, thus explaining the short, terse sentences. I was genuinely disappointed when I realized it wasn't. Missed opportunity!
    by k2enemy
  • Is this timing coincidence? I just submitted 1h (30 mins before this) ago a website I just made about storing your stock porfolio in a URL + favicon!

    https://news.ycombinator.com/item?id=48606396

    by franciscop
  • Then there is this one. Seems to be a trend.

    “Pong in S Favicon” https://news.ycombinator.com/item?id=48608681

    by Tagbert
  • PNG has comment chunks tEXt, zTXt, and iTXt. You can have a completely normal image whose file is stuffed with as much content as you want. That is less fun, I suppose.
    by Walf
  • Yes, that would also work, thanks for pointing it out
    by weetii
  • > You still need a tiny bootstrap loader to decode the image.

    Nope, you can do it all in a single file with an html/png polyglot (and nowadays you can get better compression ratios with newer formats like webp).

    https://web.archive.org/web/20120801001616/http://daeken.com...

    by Retr0id
  • You can even make the file compatible with ZIP (and PDF) on top of that, see https://github.com/gildas-lormeau/Polyglot-HTML-ZIP-PNG/raw/... (and https://github.com/gildas-lormeau/Polyglot-HTML-ZIP-PNG)
    by gildas
  • You can use the favicon cache as storage too, by redirecting users across domains. It's been proposed as a potential fingerprinting risk[0], and if a browser naively reuses the cache for incognito mode, it could be used to track users across browser profiles.

    [0]: https://www.schneier.com/blog/archives/2021/02/browser-track...

    by sheept
  • Wasn't this fixed or mostly fixed?
    by koolala
  • My thoughts instinctively went to "this has to be being used for fingerprinting" when I read OPs blog. Are anti fingerprinting measures taking into account the use of the canvas api with favicons?

    The link to the supercookie site is dead unfortunately.

    by ai_fry_ur_brain
  • Instead of going via pixels, why not use a SVG favicon and directly store markup inside it and extract it?

    Use this favicon.svg:

        <svg xmlns="http://www.w3.org/2000/svg">
    <circle cx="50%" cy="50%" r="50%" fill="orange"/>
    <p>hello HN!</p>
    </svg>
    use this in your <head> to use a svg favicon:

        <link id="favicon" rel="icon" href="favicon.svg" type="image/svg+xml">
    finally, use this in your <body> to extract it and add it to your document body:

        <script>
    fetch(favicon.href).then(r => r.text()).then(t => document.body.innerHTML += t.match(/<p[\s\S]*p>/)[0]);
    </script>
    by Tepix

  •   <svg xmlns="http://www.w3.org/2000/svg">
    <circle cx="50%" cy="50%" r="50%" fill="orange"/>
    <p>hello HN!</p>
    </svg>
    by slash0x4
  • An SVG can embed raster images: base64 encoded bytes.

    So you could layer this experiment: favicon is svg, that contains encoded raster, whose bytes are encoded html.

    At the very least it would make a mindboggling CTF step.

    by berkes
  • Just because it's my windmill to tilt at: `[\s\S]` can be written shorter and more precisely as `[^]`.
    by reichstein