9 ms·
I'm pretty surprised Google didn't have the client download the images instead. Wouldn't that be a better solution or am I missing something here? Pretty inter
by Yarnage 14y ago
I'm pretty surprised Google didn't have the client download the images instead. Wouldn't that be a better solution or am I missing something here?
Pretty interesting though and if this becomes a big enough story you can bet Google will be changing something; the last thing they need is someone using Google Docs to DOS websites.
- recursive 14y agoPerhaps the server needs to know the image dimensions for page layout.
- Yarnage 14y agoThey use quite a bit of HTML 5 so they should be able to do this client-side I would imagine. But I dunno.
- bibinou 14y agoGoogle Docs is in HTTPS so they need to proxy the assets like Github does : https://github.com/blog/743-sidejack-prevention-phase-3-ssl-proxied-assets https://github.com/blog/743-sidejack-prevention-phase-3-ssl-...
- Yarnage 14y agoInteresting. I never thought of that. It seems almost silly that you're bringing insecure content over a secure channel like that but then again it is only images.
- EvilTerran 14y ago"only images" As long as they don't do WMFs, with their code-injection-by-design functionality... http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability
- jonknee 14y agoThe function lets you specify height/width, passing it through makes some sense. It's also usually (though not in this case) to not hot link--a document can be viewed by thousands of people. There are some privacy issues too, viewing a Google Doc could have your browser making requests to unknown servers that could return whatever they want.