IdeaWell

Project ideas from Hacker News discussions.

The Deathray: A simple way for an untrusted site to freeze a Mac

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

Three prevalent themes in the discussion

  1. Whether the freeze is system‑wide or limited to the browser
  2. LoganDark: “It only froze Safari tabs for me. Not even Safari's own UI except for the web pages themselves.”
  3. wpm: “Yes, but it didn't kernel panic my computer, it just forced WindowServer to quit, but it ‘helpfully’ reopens all of your windows/apps, so it reloads the tab that caused the deadlock to begin with, rinse and repeat.”

  4. StilesCrisis: “Blowing up a browser tab with bad JavaScript is not considered to be a problem. But kernel panicking the computer is different--this brings us back to the bad old days of MacOS where a buggy program could force a freeze/restart at any time.”

  5. Whether the issue stems from WebGPU specifically or from a generic JavaScript infinite loop

  6. mikestew: “There's more to it than just a loop. If it was just a loop, it would peg a CPU core and be done with it. But you'll have to reread TFA to find out how it takes out the window server, thus freezing the rest of the system.”
  7. LoganDark: “An infinite loop in JavaScript causes a different issue. It doesn't cause the rest of your tabs to stop working too. Or allegedly the entire rest of the OS though I can't reproduce that.”

  8. xoa: “I’ve grown pretty cautious/tired around the ever‑increasing amount of hardware attack surface area the browser vendors seem to be rushing to expose…”.

  9. Security/denial‑of‑service implications and potential for abuse

  10. sgente: “Maybe I'm crazy, but ‘crash your computer’ as a building block seems powerful enough to be a security issue. Is denial of service not a security thing anymore?”
  11. mitxela: “It is [a DoS], but only when a big corp isn't doing it. X is allowed to deny you service without an account and Reddit is allowed to deny you service without uploading your personal documents to Persona.”
  12. socalgal2: “It's been 15 years since this was possible. How many times have you heard of this being an issue? Again, it's self‑correcting. Site freezes machine, user stops going to site. There's zero incentive to do this and tons of incentive to not do it.”

🚀 Project Ideas

Generating project ideas…

GPUWatch

Summary

  • A macOS menubar utility that monitors GPU activity and WindowServer responsiveness, automatically detecting and terminating processes that cause system-wide freezes from runaway WebGPU or JavaScript loops.
  • Core value proposition: Protects users from accidental system lock‑ups while preserving legitimate GPU workloads, giving peace of mind when experimenting with graphics‑heavy web apps.

Details

Key Value
Target Audience macOS developers, power users, and anyone experimenting with WebGPU/WebGL or heavy graphics in the browser
Core Feature Real‑time GPU utilization tracking, heuristic detection of deadlock patterns, one‑click kill of offending tabs/processes, and optional auto‑restart of WindowServer
- Tech Stack Swift/UIKit for menubar, EndpointSecurity.framework for process monitoring, Metal Performance Shaders for GPU metrics, LaunchAgent for background service
Difficulty Medium
Monetization Revenue-ready: $2/month subscription (free tier with basic alerts)

Notes

  • HN users complained about “WindowServer deadlock” and having to hold the power button (e.g., “I had to hold the power button to force a shutdown”) – GPUWatch would kill the offending process before a hard reset is needed.
  • Provides a tangible discussion point for macOS GPU scheduling improvements and could evolve into a system‑wide safety daemon.

SafeSite Extension

Summary

  • A browser extension (Chrome/Firefox/Safari) that uses static analysis and runtime heuristics to block pages that execute tight infinite loops or abusive WebGPU compute shaders, preventing tab or system freezes.
  • Core value proposition: Lets users browse risky sites safely by automatically neutralizing denial‑of‑service‑style JavaScript/WebGPU payloads while preserving normal site functionality.

Details

Key Value
Target Audience Everyday web users, security‑conscious developers, and QA testers who need to visit untrusted URLs
Core Feature Content‑script that detects long‑running loops, excessive GPU command submissions, and triggers a safe‑mode pause or tab kill; includes whitelist/blacklist UI
Tech Stack WebExtensions API (JavaScript/TypeScript), Service Worker for background monitoring, WebGPU API feature detection, optional Rust via WebAssembly for heavy heuristics
Difficulty Low
Monetization Hobby

Notes

  • Commenters noted that “an infinite loop in JavaScript causes a different issue” but the deathray site froze the whole OS; SafeSite would stop such pages before they affect WindowServer.
  • Could spark discussion on browser‑level defenses against GPU‑based DoS and inspire similar built‑in protections.

WebGPU Sandbox Service

Summary

  • A disposable remote‑browser hosting service (similar to BrowserStack but focused on safety) where users can open any URL in an isolated VM with GPU access disabled or tightly sandboxed, ensuring that any crash or freeze stays contained.
  • Core value proposition: Enables developers and curious users to test potentially hazardous WebGPU/WebGL content without risking their host machine, providing a quick “reset‑by‑closing‑the‑session” experience.

Details

Key Value
Target Audience Web developers, graphics researchers, security analysts, and educators who need to experiment with unsafe graphics code
Core Feature On‑demand disposable containers (e.g., Firecracker VMs) with a minimal browser, optional GPU passthrough throttling, instant snapshot restore, and session logging
Tech Stack Backend: Go or Rust managing Firecracker/KVM; Frontend: React‑based web client using WebRTC for streaming; Browser: modified Chromium with WebGPU flags; Infrastructure: AWS/GCP or bare metal
Difficulty High
Monetization Revenue-ready: Pay‑per‑minute pricing ($0.01/min) with free trial minutes

Notes

  • Several HN users described having to “hold the power button” and losing work; a sandbox would let them click the deathray link without consequences.
  • The service could become a teaching tool for GPU safety discussions and drive community‑built blocklists of dangerous sites.

Read Later