Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Node.js used to mirror DOM across browsers

screentoaster.com

Post reply on HN
Print view View original

11–20 of 53 posts

Re: Node.js used to mirror DOM across browsers

#11

Post by _urga »

Kliment wrote: post #7
tlrobinson wrote: post #3

Earlier quoted context omitted.

Security risk in what? Users not paying attention to the URL bar?

Suppose I send you a link to a page I own. I start this thing on said page and track what you do with the rest of the session on the off-chance that you do something sensitive with it. It's like a single-tab key/screenlogger. Combine this with traditional phishing methods (which already work) and you might get valuable data. It's going to be at least as effective as current phishing methods, with the added advantage…

Re: "sounds plenty dangerous to me"

Often, it's the "sounds plenty dangerous" innovations (fire, automobile, chainsaw, theory of relativity), that provide the most utility.

Re: Node.js used to mirror DOM across browsers

#12

Post by InclinedPlane »

peteforde wrote: post #10

I am not prone to melodramatic statements, but seeing this I had the same feeling I had the first time I started using GMail. It's not necessarily the DOM sharing, which is cool enough. I just think that the emergence of sockets in new browsers is going to bring in the "next level", whatever that ends up being. Seriously incredible, especially considering the development timeframe.

Websockets, local storage, canvas, css3, fast and standards-compliant Javascript engines, and any other delicious candy that gets piled on top. It's like Christmas for web-devs, this is a good time to be building web apps, we're going to see some amazing stuff.

Re: Node.js used to mirror DOM across browsers

#13

Post by CrabDude »

Kliment wrote: post #2

Sounds like a security risk to me. If someone tricks you into starting this they could follow you to other websites and collect data.

There's nothing here that a simple XSS attack couldn't do in terms of security risk which at least doesn't declare to the world "The owners of this URL are hax0rs!" As a company, all we have to do is throw a loud red banner across the top of the page, etc...

Re: Node.js used to mirror DOM across browsers

#14

Post by CrabDude »

_urga wrote: post #8

I was thinking through something like this just last night, after reading up on Smalltalk and system images. Are you loading each domain in an iframe? How did you manage to overcome Twitter's clickjacking protection? Using the new sandboxed iframe attribute? High five!

It's done via proxy, node.js, and websockets =) No iFraming. Since we're proxying, we can dynamically hijack the links and insert JS.

Re: Node.js used to mirror DOM across browsers

#15

Post by InclinedPlane »

_urga wrote: post #11
Kliment wrote: post #7

Earlier quoted context omitted.

Suppose I send you a link to a page I own. I start this thing on said page and track what you do with the rest of the session on the off-chance that you do something sensitive with it. It's like a single-tab key/screenlogger. Combine this with traditional phishing methods (which already work) and you might get valuable data. It's going to be at least as effective as current phishing methods, with the added advantage…

Re: "sounds plenty dangerous to me" Often, it's the "sounds plenty dangerous" innovations (fire, automobile, chainsaw, theory of relativity), that provide the most utility.

Flight, gunpowder, surgery, sailing, heliocentrism.

Re: Node.js used to mirror DOM across browsers

#17

Post by jbr »

CrabDude wrote: post #14
_urga wrote: post #8

I was thinking through something like this just last night, after reading up on Smalltalk and system images. Are you loading each domain in an iframe? How did you manage to overcome Twitter's clickjacking protection? Using the new sandboxed iframe attribute? High five!

It's done via proxy, node.js, and websockets =) No iFraming. Since we're proxying, we can dynamically hijack the links and insert JS.

What are you using for server side dom manipulation? jsdom? apricot? node-xml? libxmljs? I spent a lot of the weekend working on a webcrawler, but couldn't find a xml parser that didn't choke on the internet-at-large.

Any chance you'd consider open-sourcing?

Re: Node.js used to mirror DOM across browsers

#18

Post by mcmc »

This is a cool demo; props to the guys who made it.

I have done a few demos like this, and it turns out to be surprisingly hard to turn it into a product. For instance, just because you can send over changes to the DOM, you can't necessarily reproduce the javascript side-effects, exactly. You can't just poll the state of the DOM because it doesn't reflect all of the state that lives in javascript closures that you can't even see.

One easier method, and probably what they did in this demo, is simply catch any user-generated event in browser A and re-emit it in browser B, thus letting the existing javascript code / browser logic do any actual DOM/state modification.

But what happens when each user triggers an DOM event at the same time? They end up getting applied in reverse order on the two browsers. In many cases this can cause the two browsers to fall out of sync.

Anyway, I love seeing WebSocket demos, and this is pretty fun. Just be sure you realize what a rabbit hole this is if you want to make a product.

Re: Node.js used to mirror DOM across browsers

#19

Post by points »

peteforde wrote: post #10

I am not prone to melodramatic statements, but seeing this I had the same feeling I had the first time I started using GMail. It's not necessarily the DOM sharing, which is cool enough. I just think that the emergence of sockets in new browsers is going to bring in the "next level", whatever that ends up being. Seriously incredible, especially considering the development timeframe.

It's fun, yes, but at the same time, it's nostalgic.

We've had such technology for decades. There have been desktop sharing apps for years, in Java applets etc.

So whilst it's cool that the browser wars are generating a ton of improvements, none of them so far are really things that will blow users minds. HTML5 is just catching up to where other platforms were 10 years ago.

Re: Node.js used to mirror DOM across browsers

#20

Post by endlessvoid94 »

points wrote: post #19
peteforde wrote: post #10

I am not prone to melodramatic statements, but seeing this I had the same feeling I had the first time I started using GMail. It's not necessarily the DOM sharing, which is cool enough. I just think that the emergence of sockets in new browsers is going to bring in the "next level", whatever that ends up being. Seriously incredible, especially considering the development timeframe.

It's fun, yes, but at the same time, it's nostalgic. We've had such technology for decades. There have been desktop sharing apps for years, in Java applets etc. So whilst it's cool that the browser wars are generating a ton of improvements, none of them so far are really things that will blow users minds. HTML5 is just catching up to where other platforms were 10 years ago.

>none of them so far are really things that will blow users minds

It's not the actual feature that will be new, but the simplicity is what will make it from a 'technical tool' in their eyes to some far more common.

Post reply on HN