5 ms·
Reading TFA: > One of the recent additions to the CSS language was a feature that would allow it to load and run JavaScript code from within a CSS rule. What
by oefrha 6y ago
Reading TFA:
> One of the recent additions to the CSS language was a feature that would allow it to load and run JavaScript code from within a CSS rule.
What in the actual fuck?!?
Then, looking at the actual code:
<script type="text/javascript" xml="space">// <![CDATA[
new Function(getComputedStyle(document.documentElement)?.getPropertyValue('--script'))();
...
Okay, just accessing some random CSS variable from a script tag.
I wish tech journalists could ask someone with technical knowledge to double check before parroting hyped BS like this.
- eznzt 6y agoSomeone with technical knowledge is not going to talk to a journalist. Ugh, now I have to wash my hands after typing that word.
- swirepe 6y agoWhich word, knowledge?
- zenexer 6y agoI wouldn’t put Catalin Cimpanu in that category. I find his articles to generally be technically-accurate and thorough. Everyone makes mistakes, though, and he’s certainly gotten a lot more popular following his transition to ZDNet. (Perhaps the link was changed? The current article seems to explain the issue accurately and completely; I doubt that was a simple edit.)
- zenexer 6y agoCatalin Cimpanu is one of the better journalists, and is usually quite good when it comes to technical accuracy. If the article ever had the quote you included, it appears to have been removed and replaced with a fairly thorough explanation of what’s actually happening. (Perhaps the link has been changed?) Just to be clear, this would’ve worked decades ago. There’s no inherent need to use CSS3 variables for this. It could’ve just as easily been hidden in a normal property.
- yorwba 6y agoThe quote is present in the first Internet Archive snapshot of the article: https://web.archive.org/web/20201209131227/https://www.zdnet.com/article/hackers-hide-web-skimmer-inside-a-websites-css-files/ https://web.archive.org/web/20201209131227/https://www.zdnet...
- zenexer 6y agoThat’s a shame. I’m glad it was fixed, though.
- rendall 6y agoI remember when media, even websites, would issue corrections eg "An earlier version of this article incorrectly claimed that a new feature of CSS allows javascript execution. The article has been updated with correct information. ZDNet regrets the error"
- zenexer 6y agoIndeed. That would’ve been nice. It may even be there, but there was so much other junk on the page that I could barely tell what was the article and what was an ad on a mobile device.
- ryanlol 6y agoHe’s really not. https://www.zdnet.com/article/unsecured-mongodb-databases-expose-kremlins-backdoor-into-russian-businesses/ https://www.zdnet.com/article/unsecured-mongodb-databases-ex... You’d think that basic critical thinking would keep anyone from putting their name on this story.