Some pages break out of the iframe and take over the browser

[ryanwitt]

This is a big problem for usability and not a new one.

I've experimented with at least notifying the user when it's happening (see the bottom of ui.js, there is an attempt to bust framebusting by using the popular onbeforeunload technique), but this blocks outgoing clicks.

At the very minimum, busting attempts should be stopped and the user should be told what happened, and outgoing links should work.

This paper has been very interesting, but I haven't finished reading it carefully yet. It seems nytimes.com may have read it too, as it can break out of double framing (see the doubleframe branch).

[ryanwitt]

This is further complicated by the X-Frame-Options header, which seems to be on a very slow rollout. Noscript seems to cause it to be enforced in FF. May have to advise users how to turn it off for testing certain sites.