4 ms·

This looks great, if anything I think it's a shame it's not implemented using Web-Components, as they would be a perfect fit here for several reasons: intuitive

by kolme 3y ago

This looks great, if anything I think it's a shame it's not implemented using Web-Components, as they would be a perfect fit here for several reasons: intuitive, ease of use and maybe would even solve some security concerns.

sesm 3y ago
How would you allow cells to communicate with each other while being isolated from the rest of the page?
- microflash 3y ago
  Through events. You can add reactivity and state propagation through events.
tommiegannert 3y ago
What are your security concerns?
- kolme 3y ago
  Code in the cells breaking out and manipulating the page where they are embedded.
  - tlarkworthy 3y ago
    don't upload malicious code in your blog then. The same thing happens when you import a 3rd party library. I see this as a feature not a bug.
  - gitgud 3y ago
    Pretty sure adding a JS interpreter in your webpage is impossible to do without security concerns... But maybe using an <iframe> would make it a little more secure...
    - seanwilson 3y ago
      What's the worst that could happen with an `<iframe sandbox="allow-scripts">` on your page (where the iframe will be treated as if it's from a different origin to the current page)? https://codepen.io/ https://codepen.io/ runs custom user JavaScript, HTML and CSS for example via iframes.
      - cxr 3y ago
        Like CSP, iframes' sandbox attribute was conceived for an environment where it only works as part of a defense-in-depth strategy. It had to be; iframe is not a completely new element—consider what things looked like the day after the first browser to support the sandbox attribute was released: you had some X% of users who would be protected by it, and some Y% who would not, where Y >> X, and the set of people belonging to Y weren't "wrong" for belonging to that set—an author expecting sandbox to be the first, last, and only line of defense against malicious code is the one in the wrong. (Same with CSP.)
        seanwilson 3y ago
        Looks like `iframe sandbox` has been supported in major browsers for around 10 years though, including IE10.
        cxr 3y ago
        That doesn't change the fundamental character of sandbox being one part of a defense-in-depth strategy instead of being the first-last-and-only line of defense. When you begin using and relying on a security-related feature in a way it was never designed to be used, then you are playing with fire and arguably already compromised. Browser vendors can change their implementation at any time on the basis that newer releases still satisfy the intent. Example: what approach are you using in your hypothetical to actually get the cell contents into the iframe?
        deleted 3y ago
        [deleted]
  - xg15 3y ago
    As long as a user can only run the code they (or the page author) has entered by themself, I don't see an issue. It gets more problematic if you allow users to store modified cells and link to them. Then a malicious user could write a cell amd trick another user into executing it.
  - deleted 3y ago
    [deleted]
benno128 3y ago
I have a project that does this: https://runno.dev https://runno.dev No shared state between elements, but it’s an interesting idea. Edit: It runs other languages as well, like Python, C, Ruby.
- ldelossa 3y ago
  Wow this is cool. I've been looking for 'runnable C examples' on my blog. Do you know if I can integrate this with Hugo easily?
  - benno128 3y ago
    Thanks! If you’ve got a way to add node packages to your frontend then it is pretty straightforward. If not, using unpkg (https://unpkg.com/ https://unpkg.com/) in a script tag should work. Happy to help you figure it out! Post in the discussion board on GitHub or email me (address on the website).

by kolme 3y ago

sesm 3y ago

How would you allow cells to communicate with each other while being isolated from the rest of the page?

microflash 3y ago
Through events. You can add reactivity and state propagation through events.

tommiegannert 3y ago

What are your security concerns?

kolme 3y ago
Code in the cells breaking out and manipulating the page where they are embedded.
- tlarkworthy 3y ago
  don't upload malicious code in your blog then. The same thing happens when you import a 3rd party library. I see this as a feature not a bug.
- gitgud 3y ago
  Pretty sure adding a JS interpreter in your webpage is impossible to do without security concerns... But maybe using an <iframe> would make it a little more secure...
  - seanwilson 3y ago
    What's the worst that could happen with an `<iframe sandbox="allow-scripts">` on your page (where the iframe will be treated as if it's from a different origin to the current page)? https://codepen.io/ https://codepen.io/ runs custom user JavaScript, HTML and CSS for example via iframes.
    - cxr 3y ago
      Like CSP, iframes' sandbox attribute was conceived for an environment where it only works as part of a defense-in-depth strategy. It had to be; iframe is not a completely new element—consider what things looked like the day after the first browser to support the sandbox attribute was released: you had some X% of users who would be protected by it, and some Y% who would not, where Y >> X, and the set of people belonging to Y weren't "wrong" for belonging to that set—an author expecting sandbox to be the first, last, and only line of defense against malicious code is the one in the wrong. (Same with CSP.)
      - seanwilson 3y ago
        Looks like `iframe sandbox` has been supported in major browsers for around 10 years though, including IE10.
        cxr 3y ago
        That doesn't change the fundamental character of sandbox being one part of a defense-in-depth strategy instead of being the first-last-and-only line of defense. When you begin using and relying on a security-related feature in a way it was never designed to be used, then you are playing with fire and arguably already compromised. Browser vendors can change their implementation at any time on the basis that newer releases still satisfy the intent. Example: what approach are you using in your hypothetical to actually get the cell contents into the iframe?
        deleted 3y ago
        [deleted]
- xg15 3y ago
  As long as a user can only run the code they (or the page author) has entered by themself, I don't see an issue. It gets more problematic if you allow users to store modified cells and link to them. Then a malicious user could write a cell amd trick another user into executing it.
- deleted 3y ago
  [deleted]

benno128 3y ago

I have a project that does this: https://runno.dev https://runno.dev No shared state between elements, but it’s an interesting idea. Edit: It runs other languages as well, like Python, C, Ruby.

ldelossa 3y ago
Wow this is cool. I've been looking for 'runnable C examples' on my blog. Do you know if I can integrate this with Hugo easily?
- benno128 3y ago
  Thanks! If you’ve got a way to add node packages to your frontend then it is pretty straightforward. If not, using unpkg (https://unpkg.com/ https://unpkg.com/) in a script tag should work. Happy to help you figure it out! Post in the discussion board on GitHub or email me (address on the website).