Show HN: Writebin, an inline markdown editor • Hacker News Board

Re: Show HN: Writebin, an inline markdown editor

#21

Post by julianlam » Sat, Feb 15, 2014, 5:26 AM UTC

sigsergv wrote: post #20

ryanlbrown wrote: post #4

Earlier quoted context omitted.

You're right. We chose not to allow hand-wrapped paragraphs because the newlines have no effect on the resulting rendered HTML. In some cases, it will allow newlines (lists, blockquotes).

It would be great to autoindent next line when writing code blocks (that start with 4 space, for example).

Sounds like you're looking for tabIndent.js

Re: Show HN: Writebin, an inline markdown editor

#22

Post by evv » Sat, Feb 15, 2014, 6:07 AM UTC

chrismorgan wrote: post #13

You might want to be careful about security. Here's a harmless (at the time of writing!) XSS vulnerability: http://writebin.io/d/GTFx9CxV ← that there is an example of the sort of security hole (XSS) this has. Remember: Markdown is by default a *horribly* insecure format.

Gruber's decision to include html in the markdown "spec" has always perplexed me.

Re: Show HN: Writebin, an inline markdown editor

#23

Post by kordless » Sat, Feb 15, 2014, 6:22 AM UTC

chrismorgan wrote: post #13

You might want to be careful about security. Here's a harmless (at the time of writing!) XSS vulnerability: http://writebin.io/d/GTFx9CxV ← that there is an example of the sort of security hole (XSS) this has. Remember: Markdown is by default a *horribly* insecure format.

You have to be pretty careful with it, but you can use Bleach to white list the tags.

Re: Show HN: Writebin, an inline markdown editor

#24

Post by __david__ » Sat, Feb 15, 2014, 6:49 AM UTC

Firefox 28 beta: I end up with an all white screen and this in the javascript console:

    ReferenceError: _Logger is not defined toolbar.js:1
    TypeError: ToolbarView is not a function app.js:1

Re: Show HN: Writebin, an inline markdown editor

#25

Post by thauburger » Sat, Feb 15, 2014, 7:02 AM UTC

Thanks for the awesome feedback.

Re: Show HN: Writebin, an inline markdown editor

#26

Post by McGlockenshire » Sat, Feb 15, 2014, 7:18 AM UTC

ryanlbrown wrote: post #4

yukinon wrote: post #3

This looks really great, and I had fun playing around with it. One small thing that stuck out: there isn't any way to make a newline. You have to make an entirely new comment. Or is there some shortcut key I'm missing? On a lot of text editors, it's Shift + Enter.

You're right. We chose not to allow hand-wrapped paragraphs because the newlines have no effect on the resulting rendered HTML. In some cases, it will allow newlines (lists, blockquotes).

This breaks simple things, like trying to do multiple lines of four-space indented code formatting, for example.

It also breaks trying to type out quotes and nested quotes.

Re: Show HN: Writebin, an inline markdown editor

#27

Post by jkrems » Sat, Feb 15, 2014, 7:45 AM UTC

ryanlbrown wrote: post #4

yukinon wrote: post #3

This looks really great, and I had fun playing around with it. One small thing that stuck out: there isn't any way to make a newline. You have to make an entirely new comment. Or is there some shortcut key I'm missing? On a lot of text editors, it's Shift + Enter.

You're right. We chose not to allow hand-wrapped paragraphs because the newlines have no effect on the resulting rendered HTML. In some cases, it will allow newlines (lists, blockquotes).

It was one of the first things I tried and it immediately disturbed the normal flow. Markdown normally allows for a "one line per sentence"-style. If you are used to that, the current behavior quickly becomes annoying.

Re: Show HN: Writebin, an inline markdown editor

#28

Post by chrismorgan » Sat, Feb 15, 2014, 8:46 AM UTC

ryanlbrown wrote: post #18

chrismorgan wrote: post #13

You might want to be careful about security. Here's a harmless (at the time of writing!) XSS vulnerability: http://writebin.io/d/GTFx9CxV ← that there is an example of the sort of security hole (XSS) this has. Remember: Markdown is by default a *horribly* insecure format.

Thanks for pointing this out. Haven't had much time to consider things like this yet.

I have this request: could you please make security your first priority when you design things? If you leave it until later, it'll keep on being left until later, and it's far too likely never to happen. At the very least, it is likely to be significantly more expensive to implement later and is more likely to have holes.

Re: Show HN: Writebin, an inline markdown editor

#29

Post by jraedisch » Sat, Feb 15, 2014, 8:49 AM UTC

Support for selecting your inline position per touch on mobile browsers is missing. I often start a list by writing a sentence and adding the "-" afterwards.

Otherwise it is very useful. I would love to use something like it for my own projects.

Re: Show HN: Writebin, an inline markdown editor

#30

Post by chipotle_coyote » Sat, Feb 15, 2014, 9:08 AM UTC

evv wrote: post #22

chrismorgan wrote: post #13

You might want to be careful about security. Here's a harmless (at the time of writing!) XSS vulnerability: http://writebin.io/d/GTFx9CxV ← that there is an example of the sort of security hole (XSS) this has. Remember: Markdown is by default a *horribly* insecure format.

Gruber's decision to include html in the markdown "spec" has always perplexed me.

I'm pretty sure that's because Markdown was written specifically for pre-processing HTML blog posts. It was never meant to be a full-on replacement for HTML, but simply a way to make the HTML that you're most likely to use when writing such a post easier to write. If I'm the only person who can post to my blog, there are no security issues introduced by using Markdown. (Or at least, no more security issues than would be introduced if I could use pure HTML for posting on my blog.)