41–50 of 90 posts
The accepted answer teases that this is not enough: Object.defineProperty(console, '_commandLineAPI', { get : function() { throw 'Nooo!' } }) But why isn't it enough?
Because it is possible to get around with just code: http://escape.alf.nu/20 (which I have done, under another username)
I'm sort of surprised that the developer tools have only recently become an attack vector (via social engineering). I'm not sure what can even really be done about it without seriously inconveniencing developers. Maybe making them disabled by default with an extra option to enable them would be enough to deter all but the most gullible of users?
Why not a separate package altogether? That way the Chrome team can focus on Chrome, and the Developer Tools team can focus on producing a high-quality website debugger.
Here, to be honest, I vote for natural selection. Fight the scammers, and let the gullible be scammed until the society develops an immune response. It happens all the times, and I think that at least a part of the solution for Internet scam is to accelerate immune response development as much as possible.
This is a pretty good reason to never trust Chrome again.
I wouldn't trust any computer, then. It's the same as taking a bunch of code you have no idea how works, and paste it into CMD, then wondering why you just deleted C:/
Earlier quoted context omitted.
Because it is possible to get around with just code: http://escape.alf.nu/20 (which I have done, under another username)
So how do you get around it? Or, I suppose more importantly, what else do you have to do to prevent people from getting around it?
Earlier quoted context omitted.
So downloading a 100KB extension for a browser which you use for downloading stuff all the time is a "huge barrier"? Wow, talk about a 1st world problem. And "when I teach ruby", "well ok, now download xcode"... ok, Xcode is a 2.5GB download, but it is a one click download and install via App Store. And really? Xcode for Ruby? Are you really doing that?
Xcode is necessary because Apple distributes an operating system without a C compiler, and standard Ruby development requires a C compiler. Why Apple distributes an incomplete operating system by default, and why they distribute their development environment as one monolithic chunk as opposed to a set of packages, is anyone's guess.
xcode-select --install
Earlier quoted context omitted.
So how do you get around it? Or, I suppose more importantly, what else do you have to do to prevent people from getting around it?
It seems he's routing calls to print the code into console.log and eval-ing that string, which is quite interesting.
Earlier quoted context omitted.
It seems he's routing calls to print the code into console.log and eval-ing that string, which is quite interesting.
Eh? Who is "he"? What do you mean routing calls?
Edit: I'm wrong. Need some sleep.
This is an analysis of the code that facebook is trying to prevent from being pasted into the console http://pastebin.com/0JXCVxXg
I thought it was obfuscated variable names, but it's a turkish word https://en.wiktionary.org/wiki/arkada%C5%9Flar (follower)
Earlier quoted context omitted.
Eh? Who is "he"? What do you mean routing calls?
In the snippet posted by tshadwell. The code outputs a string into the console via console.log(), then executes the snippet from the console via eval(). Presumably to avoid to avoid Facebook's protections against console copy\paste execution. Edit: I'm wrong. Need some sleep.