Live data from Hacker News

Show HN: Pen.io

pen.io

91–100 of 102 posts

Re: Show HN: Pen.io

#93
post #4

Very cool idea, and nice site. I noticed that you are serving your own jquery. I've read that it's better to link to Google's host as it is more likely to be cached (and other reasons). Is this a conscious decision on your part, or is it just a part of the puzzle you haven't wrestled with yet? (Honest question- I don't know the right answer because I haven't wrestled with it yet.) Google jquery link:

You shouldn't have to depend on CDNs as there's no guarantee they'll be up all of the time. I usualayy have a local fallback that can be triggered in this way: !window.jQuery && document.write(unescape('%3Cscript src="/js/jquery-1.4.2.min.js"%3E%3C/script%3E')) The second script looks for the jQuery global object that should exist after the CDN fetch. If it doesn't exist, it knows to get your own copy. (If you're won…

That looks like a neat trick. Thank you.

Re: Show HN: Pen.io

#95

Earlier quoted context omitted.

You shouldn't have to depend on CDNs as there's no guarantee they'll be up all of the time. I usualayy have a local fallback that can be triggered in this way: !window.jQuery && document.write(unescape('%3Cscript src="/js/jquery-1.4.2.min.js"%3E%3C/script%3E')) The second script looks for the jQuery global object that should exist after the CDN fetch. If it doesn't exist, it knows to get your own copy. (If you're won…

Have you tested that to make sure that it blocks on the first script tag in every browser? Over the internet (as opposed to on your dev box), I'd expect that to always evaluate to false and therefore include your local script. You might want to look into putting that call into window.onload so that it does what you think it does.

I believe all browsers block execution of the script (and rendering of other proceeding content) so his code should work generally.

Even the latest browsers that do not block further object (scripts requests during the download and execution of the script will execute scripts sequentially, so his check for "is jQuery present" will not fire until the external script has either returned and executed (so the check passes, and nothing else happens) or errored (so jQuery is not present and the document.write executes, making it load from the local resource).

Re: Show HN: Pen.io

#96
post #4

Very cool idea, and nice site. I noticed that you are serving your own jquery. I've read that it's better to link to Google's host as it is more likely to be cached (and other reasons). Is this a conscious decision on your part, or is it just a part of the puzzle you haven't wrestled with yet? (Honest question- I don't know the right answer because I haven't wrestled with it yet.) Google jquery link:

I can't use external CDNs in my day-job as our clients require certain audits that I doubt the CDN would agree to, though that isn't a problem for this project.

The reason I server my own jQuery (rather than using the CDN-with-local-fallback option given in collypops' reply) even for my own personal projects is the paranoia of not wanting to trust code from an external source. OK so Google's CDN (or any of the other players) is much less likely to get hacked than my personal servers, but their CDN is also much more likely to be the target of a DNS poisoning attack. If an attacker manages to convince many people's machines to send requests for jQuery to them rather than Google via DNS poisoning then any site using jQuery could have unwanted code injected - if I serve my own jQuery file this risk is gone (unless the DNS spoofing attack targets my domain names specifically, of course, but I'm not a big enough fish for anyone to care to try that).

Re: Show HN: Pen.io

#97
post #31

Very nice site and well executed, however... It doesn't support Unicode? I created http://namuna.pen.io/ with devnagari script and it shows garbled text. I hope you know that ~2-3 billion people don't use Roman Script.

appeared correctly for me on ff 3.6/win

Re: Show HN: Pen.io

#98
I'd recommend reversing the workflow like http://min.us.

Accept the content first, then authenticate when users try & save. It removes a barrier to entry, and for people just testing, doesn't waste subdomains.

I'd also recommend ditching the subomain for a subdir. Regular people don't really get it. Yes, there are major services that do it, but i know from experience that social networking has trained average folks for years to use subdirs vs subdomains (twitter, facebook, myspace).

Re: Show HN: Pen.io

#99
post #50
post #25

Be careful with JavaScript and saving plain text passwords in cookies: http://cookie.pen.io I just stole your password. :)

sorry my mistake and thanks for picking it up. Passwords are now hashed and working on the js now

Why do you need to store a password in JS at all?
Post reply on HN