Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does Google prepend while(1); to their JSON responses?

stackoverflow.com

Post reply on HN
Print view View original

71–80 of 120 posts

Re: Why does Google prepend while(1); to their JSON responses?

#71

Post by peterwwillis »

trav4225 wrote: post #66
winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

Yup! In my personal (and basically worthless) opinion, this is why the entire "web application" ecosystem is a giant, flawed mess. It's basically what happens when a system originally designed to represent and transfer rich textual documents (HTML/HTTP) is bastardized into a application architecture. Yes, I'm being somewhat hyperbolic. Bring on the downvotes! ;-)

It's worse than that. Because better solutions were "hard" or long-term and competing organizations couldn't agree on shared standards, they took an application and protocol designed to traverse documents, and built on complex hacks until it essentially became a pseudo-operating system, which now not only drives part of the global economy, but also changed the type and quality of information that most people receive.

Re: Why does Google prepend while(1); to their JSON responses?

#72

Post by oblio »

amelius wrote: post #64
vesinisa wrote: post #59

Earlier quoted context omitted.

I was commenting to the GP about technologies to replace JavaScript. On the long term WASM is the best candidate, though it's indeed not one of the intended goals of the project. JS will be with us eternally, rest assured. But if DOM-enabled WASM would one day gain wide adoption, developers targeting contemporary browsers of the future would at least have a wider selection of runtimes to choose form in addition to JS…

I can also see it happen that browsers will one day shut down plain JavaScript, only allowing WASM. Certainly if the security burden becomes too big.

That's awfully optimistic of you.

First of all browsers are committed to backwards compatibility.

Secondly, there's huge amounts of Javascript written right now, nobody's going to throw away billions of dollars worth of investments. People complain about Cobol written in the 60's, when the programmers counted in the thousands. Javacript today is written by millions of programmers.

And thirdly, Javascript evolves, as do browsers.

Re: Why does Google prepend while(1); to their JSON responses?

#73

Post by oblio »

vesinisa wrote: post #59
hdhzy wrote: post #53

Earlier quoted context omitted.

Web Assembly is specifically designed not to replace JavaScript [0]. [0]: http://webassembly.org/docs/faq/#is-webassembly-trying-to-re...

I was commenting to the GP about technologies to replace JavaScript. On the long term WASM is the best candidate, though it's indeed not one of the intended goals of the project. JS will be with us eternally, rest assured. But if DOM-enabled WASM would one day gain wide adoption, developers targeting contemporary browsers of the future would at least have a wider selection of runtimes to choose form in addition to JS…

On the other hand, if you thought modern browsers are bloated, just wait for everyone to compile their runtimes on top of WASM.

It's not very hard to imagine, especially in an enteprise environment, running a browser 15-20 years from now and that browser loading the equivalent of the JVM, .NET CLR, Ruby VM, etc., on top of WASM :)

Re: Why does Google prepend while(1); to their JSON responses?

#74

Post by oblio »

peterwwillis wrote: post #71
trav4225 wrote: post #66

Earlier quoted context omitted.

Yup! In my personal (and basically worthless) opinion, this is why the entire "web application" ecosystem is a giant, flawed mess. It's basically what happens when a system originally designed to represent and transfer rich textual documents (HTML/HTTP) is bastardized into a application architecture. Yes, I'm being somewhat hyperbolic. Bring on the downvotes! ;-)

It's worse than that. Because better solutions were "hard" or long-term and competing organizations couldn't agree on shared standards, they took an application and protocol designed to traverse documents, and built on complex hacks until it essentially became a pseudo-operating system, which now not only drives part of the global economy, but also changed the type and quality of information that most people receive.

So you're basically saying that the current web is a reflection of human kind, with all its flaws and quirks? :)

Re: Why does Google prepend while(1); to their JSON responses?

#75

Post by nullnilvoid »

winteriscoming wrote: post #12

Everytime I read about such constructs, it makes me realize, as a regular developer, how complex web application security is and how difficult it is to think about and cover your application against each and every such potential problem.

Indeed, there are so many traps you can fall into when writing web apps. It feels like when web was designed, security was not given due attention and efforts.

Re: Why does Google prepend while(1); to their JSON responses?

#76

Post by minitech »

minitech wrote: post #50
CJefferson wrote: post #20

Earlier quoted context omitted.

The risk there is some parsers might carry on past the syntax error and try to continue parsing. This is JavaScript after all.

No, that’s not a real risk.

I’m not sure why this is downvoted. No JavaScript engine does that. “This is JavaScript after all” is ridiculous FUD.

Re: Why does Google prepend while(1); to their JSON responses?

#77

Post by Tloewald »

samfisher83 wrote: post #46
Tloewald wrote: post #4

Earlier quoted context omitted.

I'd say it's because of advertising mostly, but a lot of similar tech (that is usually ad supported) like Disqus. It's interesting that today cross-domain sandboxing applies to almost everything except JavaScript. If I load an image cross domain and draw it into a canvas, the contents of that canvas are sandboxes, but I can cheerfully mix and match code across domains too. Seems like it would be a good thing to do bu…

Having advertisers not tracking you seems like a benefit not a con.

I agree, but of the four major browsers, two are directly underwritten by advertising (Chrome and Mozilla) and Microsoft is moving that way.

Only Apple has backed off advertising as a revenue source, so it basically comes down to Apple being willing to cause massive breakage (the way it did with Flash) in pursuit of a principle. The fact that they enabled ad blockers in mobile safari says they are at least sympathetic to the idea.

Re: Why does Google prepend while(1); to their JSON responses?

#78

Post by fooyc »

Lxr wrote: post #14
frik wrote: post #11

FB prepends a "for(;;);" which is 1 char shorter than "while(1);", has been the case since 2012/13. Firebug v2 and ChromeTools know how to parse such JSON and ignore that first part. (IE11 and Firefox newer DevTools can't "handle" it aka show just a plain text string)

Why does it have to be a loop, couldn't you make a reliable syntax error in less than 8 characters?

The browser may disclose part of the JSON content in a "parse error" error message. A window.onerror handler could catch this message.

I believe that some browsers used to do that some times ago.

Re: Why does Google prepend while(1); to their JSON responses?

#79

Post by sargun »

oblio wrote: post #72
amelius wrote: post #64

Earlier quoted context omitted.

I can also see it happen that browsers will one day shut down plain JavaScript, only allowing WASM. Certainly if the security burden becomes too big.

That's awfully optimistic of you. First of all browsers are committed to backwards compatibility. Secondly, there's huge amounts of Javascript written right now, nobody's going to throw away billions of dollars worth of investments. People complain about Cobol written in the 60's, when the programmers counted in the thousands. Javacript today is written by millions of programmers. And thirdly, Javascript evolves, as…

I can certainly see a world where WASM and JS execution pipelines in browsers converge -- where the form used for executing WASM and JS is the same.

Re: Why does Google prepend while(1); to their JSON responses?

#80

Post by krapp »

oblio wrote: post #73
vesinisa wrote: post #59

Earlier quoted context omitted.

I was commenting to the GP about technologies to replace JavaScript. On the long term WASM is the best candidate, though it's indeed not one of the intended goals of the project. JS will be with us eternally, rest assured. But if DOM-enabled WASM would one day gain wide adoption, developers targeting contemporary browsers of the future would at least have a wider selection of runtimes to choose form in addition to JS…

On the other hand, if you thought modern browsers are bloated, just wait for everyone to compile their runtimes on top of WASM. It's not very hard to imagine, especially in an enteprise environment, running a browser 15-20 years from now and that browser loading the equivalent of the JVM, .NET CLR, Ruby VM, etc., on top of WASM :)

15-20 years from now, it's likely that "browser" will just be the operating system.
Post reply on HN