31–40 of 86 posts
Earlier quoted context omitted.
I'm sure at the very least some of the sorts are incorrect and will brick your browser tab from an infinite loop or something.
Thats crazy talk everything on Stack Overflow is correct because it has the most upvotes.
Earlier quoted context omitted.
That’s more or less what all iframed ads are. Plus most popular web sites load libraries for services where the site owners can’t easily see what’s happening under the covers. Google analytics would be an example of this, but there are many , and lots of sites use multiple such services.
I see what you're saying and I agree for the most part, but all that code is written by someone, reviewed (maybe), and put to some form of a production environment. The code in StackOverflow is usually just typed right into the answer box and submitted. I know I've edited answers where there were compilation errors in the accepted solutions! Not strictly relevant to JS of course.
Is it just me, or do none of them sort this array correctly? ["zebra","apple","banana","5","bapple","banana","banana"] Correction, the page finally found this algorithm that sorts my array[1]. So I am disappointed with the verifier function on this web page and may need to submit a PR 1 - http://stackoverflow.com/questions/3730510/#3730579
That conversation about for..in - any JS experts that can say whether modules or other new advances will help with this? Not being able to use the standard functions on primitives because random other code messes with them sounds like pogo sticking in a minefield.
for (let x of xs)
See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
this reminds me of the 4chan's sleepsort: for each number $n in the array, spin a thread that sleeps $n and then append $n to the result array.
Of course, the first thing that I did was to try it in a safe environment. It worked!!! :)
Earlier quoted context omitted.
The standard attack in this case is that someone could steal your cookies (if they are Js cookies) or execute instructions on gkoberger.github.io without your permission, since that is the context. The way you would do this is create an answer to one of these questions on stack overflow that includes malicious javascript. However, it's kind of unlikely there is much you can do with it. Sometimes a site will share coo…
This is why GitHub uses a separate domain (github.io as opposed to github.com) for user sites.
The risk of eval() is giving control of the site data of foo.github.io to the author of a stackoverflow comment.
The warning is part of the fun, though.
Hilariously awesome. I'm curious whether the multiple warnings about running untrusted code in the browser are necessary. I feel like all websites are already untrusted code, and the browser is quite well sandboxed and protected from anything too bad happening. What is the worst case scenario here for the user within the JS ecosystem, under known avenues of attack, not counting an unknown zero day browser exploit?
Hilariously awesome. I'm curious whether the multiple warnings about running untrusted code in the browser are necessary. I feel like all websites are already untrusted code, and the browser is quite well sandboxed and protected from anything too bad happening. What is the worst case scenario here for the user within the JS ecosystem, under known avenues of attack, not counting an unknown zero day browser exploit?
Given that this site is not hosted on a domain where you have important session cookies (or where you’ve granted permissions like camera or location usage) I don’t see much problem with eval-ing untrusted code. Most of the common XSS threats just don’t apply here.
Earlier quoted context omitted.
Thats crazy talk everything on Stack Overflow is correct because it has the most upvotes.
To be fair, I'd imagine the code in SO answers is less likely to be malicious than the code in adverts on most news websites...
A Red-Tailed hawk cries in the distance.
(Psst, if you're an engineer and like dev tools, I'm hiring! https://readme.io/careers)