3 ms·
I make no comment on the purpose of this tool, but I strongly recommend serving your Javascript, if not the whole site, under httpS. If you are going to tell ev
by aristus 16y ago
I make no comment on the purpose of this tool, but I strongly recommend serving your Javascript, if not the whole site, under httpS. If you are going to tell everyone to run arbitrary Javascript in the context of their Facebook sessions, at least take precautions that this code will not be modified in-flight.
- mjpizz 16y agoI considered SSL. However, Facebook already serves all of their own pages over plain HTTP, so serving the bookmarklet on HTTPS won't add any security AFAIK.
- aristus 16y agoPlease reconsider. Also reconsider serving data from olark.com and, generally, try to reduce your attack surface. There are too many "javascript viruses" running around already.
- varenc 16y agofacebook serves its JS over http already...as does most of the internet. An attacker would just change that js if they had that type of access.
- jcidiot 16y agomost of the internet doesn't use HTTPS, they use plain HTTP. HTTPS prevents man in the middle attacks...