esailija

36 ms·

361.
by esailija 13y ago
The cookie scenario is not really practical since you can prevent javascript from reading cookies with httponly and I could bet a lot google uses httponly cookies where it matters. The real threats I imagine is social engineering it enables
362.
by esailija 13y ago
In practice enforced privacy is rarely used in languages other than Javascript. In Java, C#, Ruby, Python, PHP advisory privacy is the default. You would enforce privacy when you need to run untrusted code in same process (like the Servlets
363.
by esailija 13y ago
There isn't true privacy by default in Java or C# so how can they get by? Are they relying on the fact that programmers won't use reflection to access private? Does the client run the program with security manager on? What if the
364.
by esailija 13y ago
What is the time it takes you to find this "library" and verify its fitness for your purpose? You can see that it causes runtime errors in IE8 and one had to read the source code to see this because it's not mentioned anywher
365.
by esailija 13y ago
What implementations actually do in code is almost always very different from what the specification wording suggests. For example, in V8 the handling of a line terminator used as a semicolon is practically the same had you used a semicolon
366.
by esailija 13y ago
That's not right, it is a translator/compiler. It simply translates a python code string into a JS code string, and then calls `eval()` on the JS code string. The `eval()` step can optionally be skipped so that you can precompile. This is
367.
by esailija 13y ago
You can do `<script type="anything-you-want"></script>`. It's just an attribute. The browser will not run any code in the tag because the `type`-attribute is invalid now. The next step is to create a compiler for your `anyth
368.
by esailija 14y ago
What are the browser checks for?
369.
by esailija 14y ago
A native method for binding methods has existed for a long time and is called just that: f = obj.doSomething.bind(obj); Wrapping functions like in the example is different and is very common among cargo cultists
370.
by esailija 14y ago
Right. But I have seen actual code do this plenty of times and there was no explanation in the article so I naturally assumed it was just like those cases where basics of functions are not understood.
371.
by esailija 14y ago
You can replace function(data) { return doSomething(data); } With doSomething Named functions are just as first-class as anyonymous ones...
372.
by esailija 14y ago
Using a declarative DSL designed for validation rules should make it much simpler, it would minimize the amount of writing the boilerplate stuff that comes with a general purpose language and would focus solely on the actual validation rule
373.
by esailija 14y ago
There are also other problems such as nesting functions inside other functions inside other functions which is IMO much harder to maintain than a clean flat list of functions defined in the prototype. Don't even get me started on using "sel