10 ms·
Get your GitHub badge now
- javery 15y agoWhy use an iframe? Async javascript would be better all around. Also - when you click you name in the badge it opens the link inside the small iframe.
- ryanpetrich 15y agoiframes don't block the outer page from loading or expose the page's security context (cookies, etc) to the external domain.
- javery 15y agoAsync JS doesn't block either - and cross-domain scripting rules are strict enough that it is pretty safe. The iframe code has an async Google Analytics script in it - perhaps that is the reason for the iframe (to use google analytics for tracking usage).
- BYK 15y agoJavascript version is on the horizon. We used iframe because it was quick&dirty and "good enough" to start with =)
- JoshTriplett 15y agoCurious what you mean about cross-domain scripting rules and safety. Normally, loading a third-party script via a script tag lets that script do anything the page can do, which makes it decidedly unsafe. Personally, I greatly prefer the iframe.
- javery 15y agoYou're correct - it can do just about anything. Technically it can't make ajax calls back to a domain other than where the page was served from - but you could get around that by just inserting more javascript tags. iFrames do offer a little more security here - but in this case I would still go for just script since I don't see that the downsides outweigh the added security. (you can still do a whole ton of damage from an iframe)
- JoshTriplett 15y agoWhat damage can you do from an iframe? You don't have any of the permissions of the site containing the frame.
- javery 15y agoYou can deceive the user pretty easily with content that looks like the main page and prompts them to do something you want them to do. (like login to the parent app even though they are logging into your app, anti-phishing stuff won't take effect if you keep it all in the iframe) You could also just execute whatever JS you want if there is a browser vulnerability you want to take advantage of.
- berkerpeksag 15y agoFixed. Thanks.
- deleted 15y ago[deleted]
- johns 15y agoTotal project followers is more interesting to me than how many follow me directly.
- BYK 15y agoAdded, thanks for the suggestion! =)
- bltavares 15y agoReally awesome. It's on my page already
- t4nkd 15y agoNumber of times I've commented on an HN story: 0 Number of times I've followed up on GitHub related news, anywhere: n + rand(50..100) # => always Times I've thought that Github is growing sickeningly commercial, that my attempt at best practice and code sharing is equating to (millions of) dollars in their pocket, and that other seemingly like-minded individuals want to capitalize on their successes to achieve notice: At least twice. At least when Dr. Nic made this widget, it seemed original.
- BYK 15y agoThis is a pet project and we gain nothing but experience. We were not aware of any similar projects when starting. In terms of capitalizing, please keep in mind that there are no ads and we do not intend to add any so it will cost us in the contrary when more people start to use this.
- Mathnerd314 15y agoYou could add a (small) donation link
- BYK 15y agoWe may when the service actually starts to cost us =) Thanks ;)
- lee337 15y agoNice work! With this, coderwall and all my soccer trophies/medals... my parents' fireplace will never be the same again :-)
- jamesbritt 15y agoWill this help me write more or better code, or release more often?
- vmind 15y agoIt seems to choke if you have a hyphen in your username.
- BYK 15y agoIt's already fixed. Thanks for reporting! =)
- gus_massa 15y agoIn IE8 the badge is a few pixels too wide and an horizontal scroll bar appears.
- ahmetalpbalkan 15y agoawesome project