this reminds me of the 4chan's sleepsort: for each number $n in the array, spin a thread that sleeps $n and then append $n to the result array.
Would the algorithmic runtime of this be O(N)?
Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
41–50 of 86 posts
Re: Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
#42Earlier quoted context omitted.
That’s more or less what all iframed ads are. Plus most popular web sites load libraries for services where the site owners can’t easily see what’s happening under the covers. Google analytics would be an example of this, but there are many , and lots of sites use multiple such services.
I see what you're saying and I agree for the most part, but all that code is written by someone, reviewed (maybe), and put to some form of a production environment. The code in StackOverflow is usually just typed right into the answer box and submitted. I know I've edited answers where there were compilation errors in the accepted solutions! Not strictly relevant to JS of course.
That's exactly why I would rather trust code from random SO answers than from the ad network.
Re: Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
#43Earlier quoted context omitted.
I see what you're saying and I agree for the most part, but all that code is written by someone, reviewed (maybe), and put to some form of a production environment. The code in StackOverflow is usually just typed right into the answer box and submitted. I know I've edited answers where there were compilation errors in the accepted solutions! Not strictly relevant to JS of course.
This is unintentionally fucking hilarious. You already concede that review is a “maybe”... so we have to assume it won’t happen. So basically your argument boils down to web code meeting the high standards of being “written by someone” and put in “some form” of a production environment. Any http server on a routable ip address qualifies as “some form” of production environment.
You don't think there's the slightest bit of difference between production code written at even very dysfunctional organizations with mediocre developers, and random answers on StackOverflow?
And you've only been here for a few weeks so I'll give you the benefit of the doubt, but calling something "unintentionally...hilarious" is usually taken as just another way of calling someone an idiot. I'd suggest you try to find ways to make your point without deriding those who don't share your view, especially on something so inconsequential.
Re: Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
#44this should be tagged [2015]
It was built in 2013! https://github.com/gkoberger/stacksort/commits/master?after=...
Re: Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
#45Click the button and PRAY this thing doesn't load any sketchy code
I don't think "bad" code could do much more than phishing or crashing a browser, but to be safe, the API only loads code snippets posted (and unedited) before I launched this. So, there's no way to target this with an attack via Stack Overflow.
Re: Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
#46Re: Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
#47Earlier quoted context omitted.
The standard attack in this case is that someone could steal your cookies (if they are Js cookies) or execute instructions on gkoberger.github.io without your permission, since that is the context. The way you would do this is create an answer to one of these questions on stack overflow that includes malicious javascript. However, it's kind of unlikely there is much you can do with it. Sometimes a site will share coo…
This is why GitHub uses a separate domain (github.io as opposed to github.com) for user sites.
Github hasn't always used a seperate domain for user sites [0].
They do now to directly address the GP's concerns.
http://homakov.blogspot.com/2013/03/hacking-github-with-webk...
Re: Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
#48Hilariously awesome. I'm curious whether the multiple warnings about running untrusted code in the browser are necessary. I feel like all websites are already untrusted code, and the browser is quite well sandboxed and protected from anything too bad happening. What is the worst case scenario here for the user within the JS ecosystem, under known avenues of attack, not counting an unknown zero day browser exploit?
Reminds me of "security expert" warnings in the mass media where every time something happens they tell people effectively the same thing "don't do things unless you know / trust it".
Most people have no clue what they're running and can't possibly take the time to know enough to really have a clue.
Re: Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
#49Earlier quoted context omitted.
I see what you're saying and I agree for the most part, but all that code is written by someone, reviewed (maybe), and put to some form of a production environment. The code in StackOverflow is usually just typed right into the answer box and submitted. I know I've edited answers where there were compilation errors in the accepted solutions! Not strictly relevant to JS of course.
This is unintentionally fucking hilarious. You already concede that review is a “maybe”... so we have to assume it won’t happen. So basically your argument boils down to web code meeting the high standards of being “written by someone” and put in “some form” of a production environment. Any http server on a routable ip address qualifies as “some form” of production environment.
I'd go further. I'd be much more trusting of running and random JS found on stack overflow than the JS found on your average production environment.
Stack overflow is heavily moderated. I think it'd be a challenge to put something malicious on there which lived for more than an hour or so.
Compare that to your run of the mill PHP shared hosting. I know which side I'd rather take my chances with.
Re: Stacksort – Searches StackOverflow for sorting functions and runs them (2013)
#50Earlier quoted context omitted.
Given that this site is not hosted on a domain where you have important session cookies (or where you’ve granted permissions like camera or location usage) I don’t see much problem with eval-ing untrusted code. Most of the common XSS threats just don’t apply here.
It's all fun and games until the next JavaScript sandbox busting zero day drops.
If I had that kind of exploit I surely wouldn't post it on stackoverflow.