28 ms·
It would be nice if people could lay off the script injections. It's clearly insecure, but that's not really the point. It makes the experience worse for everyo
by mayop100 13y ago
It would be nice if people could lay off the script injections. It's clearly insecure, but that's not really the point. It makes the experience worse for everyone if you alert(), etc.
- X4 13y agoyup. I guess some couldn't resist the urge. I hope there aren't more malicious minds, trying to steal cookies or stuff.
- stuross 13y agoAlmost certainly someone is stealing cookies and this should be taken down soon. However, I actually enjoyed this post and was really informative all around.
- FiloSottile 13y agoFiddles run unsecure code by design, so they do in a separate domain.
- X4 13y agosource: http://hastebin.com/verowotihe.html http://hastebin.com/verowotihe.html
- jcampbell1 13y ago> It's clearly insecure, but that's not really the point. No, that is the point. I even pointed it out hours ago: https://news.ycombinator.com/item?id=6727448 https://news.ycombinator.com/item?id=6727448 The failure is the lesson. The previous version was a clever hack written by a clever person. This is ignorance, and the lesson is that allowing users to run arbitrary code on other user's computers is bad idea.
- FiloSottile 13y agoI'm pretty sure that OP knew the issue, not just you, so it's not ignorance. And it's not the moment to cite The Good Parts either. There is no failure here to be seen. There is a clever hack to make a spreadsheet shared quick and dirty. Just a reminder that all the JS code you run, in particular on jsFiddle, is untrusted and is part of the security model of the JS engine in your browser that evil JS code must not be able to do any harm. If it did, report it to the browser vendor and earn a bounty.