Earlier quoted context omitted.
Wait does this mean bookmarklets will fail in those browsers from now on?
My bookmarklets run just fine, JS in the URL-bar doesn't.
Do the bookmarklets execute in the context of the page?
How does Facebook disable Developer Tools?
81–90 of 90 posts
Re: How does Facebook disable Developer Tools?
#82Earlier quoted context omitted.
Xcode is necessary because Apple distributes an operating system without a C compiler, and standard Ruby development requires a C compiler. Why Apple distributes an incomplete operating system by default, and why they distribute their development environment as one monolithic chunk as opposed to a set of packages, is anyone's guess.
Last I checked, Windows also doesn't ship with a C compiler by default. Even some Linux distros don't have it in the default install.
Windows is also an incomplete operating system as sold, as are those Linux distros. For a long time Windows was outright defective because there was no compiler available without paying hundreds of additional dollars to Microsoft, but they do have a free toolchain now.
Re: How does Facebook disable Developer Tools?
#83Earlier quoted context omitted.
Xcode is necessary because Apple distributes an operating system without a C compiler, and standard Ruby development requires a C compiler. Why Apple distributes an incomplete operating system by default, and why they distribute their development environment as one monolithic chunk as opposed to a set of packages, is anyone's guess.
standard Ruby development requires a C compiler Mac OS X comes with Ruby already installed, and afaik you don't need a C compiler to learn standard ruby, you'd only need it for certain gems (which want to build native extensions).
OS X comes with an obsolete version of Ruby which almost nobody uses.
Standard Ruby development generally involves both a Ruby version manager (rvm, rbenv, etc.) and the ability to install gems with native extensions.
Re: How does Facebook disable Developer Tools?
#84Earlier quoted context omitted.
I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset. I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings. or hide it behind a turing-test-for-engineers ... 'solve t…
Web browsers had had the capability to execute javascript through the URL bar since as long as I can remember. Social engineers should be able to just bypass this by telling users to copy paste the following code, Control+L, type "javascript:" (chrome strips it when copy-pasting), Control+V, Enter. javascript:alert('hi ' + document.body.innerHTML); If people can be tricked into executing code in the dev console, then…
I think (Chrome & Firefox) you can use a content security policy to prevent JavaScript running from the address bar:
Re: How does Facebook disable Developer Tools?
#85Earlier quoted context omitted.
standard Ruby development requires a C compiler Mac OS X comes with Ruby already installed, and afaik you don't need a C compiler to learn standard ruby, you'd only need it for certain gems (which want to build native extensions).
OS X comes with an obsolete version of Ruby which almost nobody uses. Standard Ruby development generally involves both a Ruby version manager (rvm, rbenv, etc.) and the ability to install gems with native extensions.
OS X comes with an obsolete version of Ruby which almost nobody uses.
The latest version of OS X comes with Ruby 2.0, which is hardly obsolete, and that or Ruby 1.8.7 (from earlier OS X) is totally fine for learning to use Ruby, which is how this thread started.
Claiming you need to start to learn by installing xCode or the tools is false - there is lots more to ruby than installing rvm, rails and sql gems etc. Beginners could go a long way without requiring non-native gems, and by the time they get to that stage, installing Ruby 2.0 should be a breeze, whatever route you choose.
Probably over 95% of mac users would never use the compiler, so I see why they left it out. Installing it is really very easy anyway, command line or with xcode.
Re: How does Facebook disable Developer Tools?
#86Re: How does Facebook disable Developer Tools?
#87Earlier quoted context omitted.
I don't think it's as simple as that - there's a lot more damage you can do by copy-pasting arbitrary code obtained via a social engineering vector into the dev console, than right-clicking to save an asset. I'd consider this a genuine security issue, and wouldn't be surprised if the dev console at least got moved behind a lot more 'here be dragons' warnings. or hide it behind a turing-test-for-engineers ... 'solve t…
Oh, I don't mean for the purposes of security, but sites thinking that they're protecting their content in some way by dropping in a future jquery plugin or whatever that disables the console, and suddenly the hackability and usability of the web becomes much less. Another place where you see this sort of thing: banks that try to prevent password managers from filling in your credentials (also I've seen a few recentl…
If you are using FF or Chrome you can just make your browser run a js script after loading a certain page.
It's neat for small changes as you don't have to write a whole extension just a simple script.
Re: How does Facebook disable Developer Tools?
#88The accepted answer teases that this is not enough: Object.defineProperty(console, '_commandLineAPI', { get : function() { throw 'Nooo!' } }) But why isn't it enough?
I spent a while looking at it last night and came up with a solution, I'll walk you through it. For reference, here's the code: function escape(s) { // Bonus level! Object.defineProperty(console, 'foo', { get : function() { throw 'nooo!' } }); var code = 'with(window.console && console.foo || {}) {\n\t'+s+'\n}'; console.log(code); try { console.log(eval(code)); } catch (e) { console.log(e); } } The idea is, you need…
Ah, cool. That's a little shorter than the solution that I came up with:
function window(){alert(1)}window()
Re: How does Facebook disable Developer Tools?
#89Facebook is violating the user's right to their own software.
http://Facebook.com/selfxss is all it really takes.