Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Google prepend while(1); to their JSON responses?

stackoverflow.com

Post reply on HN
Print view View original

51–60 of 120 posts

Re: Why does Google prepend while(1); to their JSON responses?

#51

Post by slig »

samfisher83 wrote: post #46
Tloewald wrote: post #4

Earlier quoted context omitted.

I'd say it's because of advertising mostly, but a lot of similar tech (that is usually ad supported) like Disqus. It's interesting that today cross-domain sandboxing applies to almost everything except JavaScript. If I load an image cross domain and draw it into a canvas, the contents of that canvas are sandboxes, but I can cheerfully mix and match code across domains too. Seems like it would be a good thing to do bu…

Having advertisers not tracking you seems like a benefit not a con.

A benefit for us; a con for those developing or sponsoring the browsers we use.

Re: Why does Google prepend while(1); to their JSON responses?

#53

Post by hdhzy »

vesinisa wrote: post #45
winterlight wrote: post #33

Earlier quoted context omitted.

Modern web development is already hard by itself, specially when it comes to security. A saner runtime language is needed to replace the sub par standard that is javascript. One with a robust type-system and coherent semantics. It won't fix every problem, but a least it would prevent abuses such as the one in question.

WASM (WebAssembly) is about developing a very simple cross-browser bytecode that allows implementing any runtime on top of it. The first versions are already rolling out in latest major browser versions, but at this stage you don't yet get DOM access from WASM. After the initial phase when DOM access is implemented, it's the beginning of end for JavaScript. Future browsers might well implement JS as a pre-shipped run…

Web Assembly is specifically designed not to replace JavaScript [0].

[0]: http://webassembly.org/docs/faq/#is-webassembly-trying-to-re...

Re: Why does Google prepend while(1); to their JSON responses?

#54

Post by hdhzy »

blntechie wrote: post #52
samfisher83 wrote: post #3

Why don't browsers strip cookies when they are doing cross domain javascript fetches?

It's not the same but aren't the httpOnly cookies kind of serve the same purpose? JS can't read these cookies at all?

JS can't (that protects against stealing the token) but the server still receives it even when the request originates from foreign domain. That's the gist of CSRF [0].

[0]: https://en.wikipedia.org/wiki/Cross-site_request_forgery

Re: Why does Google prepend while(1); to their JSON responses?

#55

Post by _pmf_ »

hdhzy wrote: post #53
vesinisa wrote: post #45

Earlier quoted context omitted.

WASM (WebAssembly) is about developing a very simple cross-browser bytecode that allows implementing any runtime on top of it. The first versions are already rolling out in latest major browser versions, but at this stage you don't yet get DOM access from WASM. After the initial phase when DOM access is implemented, it's the beginning of end for JavaScript. Future browsers might well implement JS as a pre-shipped run…

Web Assembly is specifically designed not to replace JavaScript [0]. [0]: http://webassembly.org/docs/faq/#is-webassembly-trying-to-re...

That's what they have to tell to placate JS apologists.

Re: Why does Google prepend while(1); to their JSON responses?

#56

Post by hdhzy »

MereInterest wrote: post #42
0x0 wrote: post #23

Earlier quoted context omitted.

But an attacker would simply use https://.." , instead of <script src="httpsb://.." ?

Only if that is supported by the site being attacked. If the site only accepts httpsb connections, then the attacker would not have a way in.

If the site accepts httpsb it can as well support the Origin header [0] and the problem is solved.

[0]: https://wiki.mozilla.org/Security/Origin

Re: Why does Google prepend while(1); to their JSON responses?

#57

Post by _pmf_ »

tossaway322 wrote: post #47

Jeez, why not live w/o JavaScript? We keep trying to accomodate a defunct language with insoluble problems. Isn't that an error in our thinking processes? https://www.wired.com/2015/11/i-turned-off-javascript-for-a-...

Not only that. They keep piling on new shit APIs. Half of the WebGL exploits are probably yet unveiled, there's a side channel attack using the new ambient light sensor API, but hey, my phone can get darker based on ambient light, hooray!

Re: Why does Google prepend while(1); to their JSON responses?

#58

Post by hdhzy »

homakov wrote: post #48
captainmuon wrote: post #18

Earlier quoted context omitted.

It would be easy to make sending credentials opt-in in a new HTTP or HTML version. The way it's done now is backwards IMHO. Define httpsb:// do be like https:// , but any site may make ajax and similar requests to it (without credentials). Then make some kind of exception (like csrf protection), or use legacy https, in case you need to send cookies.

I proposed a header instead of a protocol btw https://medium.com/@homakov/request-for-a-new-header-state-o...

Sounds good but I suspect it will meet the same fate as XHTML 2: designed to be clean and perfect but in reality it would take to much effort to implement and maintain.

From your professional experience you can probably tell people would rather have slightly insecure site that works and gives profits rather than broken one because SOTA started including some new feature you didn't know...

People would rather enable these individual headers one by one and see their effect. In h2 headers are compressed so it's not a big deal (besides looking ugly).

Re: Why does Google prepend while(1); to their JSON responses?

#59

Post by vesinisa »

hdhzy wrote: post #53
vesinisa wrote: post #45

Earlier quoted context omitted.

WASM (WebAssembly) is about developing a very simple cross-browser bytecode that allows implementing any runtime on top of it. The first versions are already rolling out in latest major browser versions, but at this stage you don't yet get DOM access from WASM. After the initial phase when DOM access is implemented, it's the beginning of end for JavaScript. Future browsers might well implement JS as a pre-shipped run…

Web Assembly is specifically designed not to replace JavaScript [0]. [0]: http://webassembly.org/docs/faq/#is-webassembly-trying-to-re...

I was commenting to the GP about technologies to replace JavaScript. On the long term WASM is the best candidate, though it's indeed not one of the intended goals of the project. JS will be with us eternally, rest assured. But if DOM-enabled WASM would one day gain wide adoption, developers targeting contemporary browsers of the future would at least have a wider selection of runtimes to choose form in addition to JS.

Re: Why does Google prepend while(1); to their JSON responses?

#60

Post by emmelaich »

hdhzy wrote: post #28
winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

Note that these protections are only needed because Google supports every imaginable browser version even outdated ones. You most certainly do not need to do the same. Array and object globals cannot be overridden now (since 2007) for literals [0] and for ambient authority problem with CORS just check the Origin header. [0]: https://johnresig.com/blog/re-securing-json/

That would a good note to add to that StackOverflow question.
Post reply on HN