11–20 of 90 posts
How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
That is the original exploit mentioned in the accepted answer; however, Firefox and IE have disabled execution of javascript from the address bar, and I assume that Chrome is also moving to do the same thing.
How is this exploit not possible by just telling someone to paste javascript:alert(document.cookie) etc into their address bar?
Because pasting doesn't work. Most browsers (like Chrome, IE) just remove the javascript: prefix from your pasted text, and some browsers (like Firefox) don't allow you to execute standard javascript from the address bar.
Earlier quoted context omitted.
Why not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.
Because the "hackability" of the web is important. The ability to view source, play in the console, modify the dom, etc is amazing. Locking it down or providing a larger barrier to entry (eg, download this extra thing) provides dubious benefit and hides what makes the web great. I speak from someone who teaches ruby and javascript. Javascript is in every browser and the console is a wonderful place to start. When I t…
And "when I teach ruby", "well ok, now download xcode"... ok, Xcode is a 2.5GB download, but it is a one click download and install via App Store. And really? Xcode for Ruby? Are you really doing that?
Earlier quoted context omitted.
That is the original exploit mentioned in the accepted answer; however, Firefox and IE have disabled execution of javascript from the address bar, and I assume that Chrome is also moving to do the same thing.
And after that Hackers will start telling people do open their Concole in Developer Tools and paste the code there. I believe many people will do.
Object.defineProperty(console, '_commandLineAPI',
{ get : function() { throw 'Nooo!' } })
Earlier quoted context omitted.
Because the "hackability" of the web is important. The ability to view source, play in the console, modify the dom, etc is amazing. Locking it down or providing a larger barrier to entry (eg, download this extra thing) provides dubious benefit and hides what makes the web great. I speak from someone who teaches ruby and javascript. Javascript is in every browser and the console is a wonderful place to start. When I t…
So downloading a 100KB extension for a browser which you use for downloading stuff all the time is a "huge barrier"? Wow, talk about a 1st world problem. And "when I teach ruby", "well ok, now download xcode"... ok, Xcode is a 2.5GB download, but it is a one click download and install via App Store. And really? Xcode for Ruby? Are you really doing that?
Earlier quoted context omitted.
That is the original exploit mentioned in the accepted answer; however, Firefox and IE have disabled execution of javascript from the address bar, and I assume that Chrome is also moving to do the same thing.
And after that Hackers will start telling people do open their Concole in Developer Tools and paste the code there. I believe many people will do.
Earlier quoted context omitted.
Because the "hackability" of the web is important. The ability to view source, play in the console, modify the dom, etc is amazing. Locking it down or providing a larger barrier to entry (eg, download this extra thing) provides dubious benefit and hides what makes the web great. I speak from someone who teaches ruby and javascript. Javascript is in every browser and the console is a wonderful place to start. When I t…
So downloading a 100KB extension for a browser which you use for downloading stuff all the time is a "huge barrier"? Wow, talk about a 1st world problem. And "when I teach ruby", "well ok, now download xcode"... ok, Xcode is a 2.5GB download, but it is a one click download and install via App Store. And really? Xcode for Ruby? Are you really doing that?