Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Githtml - View Html Files from Github Repos On The Fly

github.com

Post reply on HN
Print view View original

11–20 of 22 posts

Re: Githtml - View Html Files from Github Repos On The Fly

#11

Post by samwillis »

redment wrote: post #9
samwillis wrote: post #5

This has a really big security flaw, if the creator wanted to be mischievous he could change his js file to do things to your logged in github account, for example set your privet repositories public. If you want to use it you should fork it and change to bookmarklet to use your fork of the js file.

Though I'd never do such a thing, your point is completely valid.

And I would always lean to the side of trust in people, I wouldn't expect you or most people here to abuse it.

Its a little bit of a pet hate, the suggested linking to JavaScript files in another persons repository. The worst was the HTML5 Shim, for a long time they suggested linking directly to their svn repo, fortunately they don't now. It was about the same time people started thinking about using the google cdn for javascript libraries and so people just did it thinking they were helping their page load times when in fact they were compromising the security of their users and themselves.

Re: Githtml - View Html Files from Github Repos On The Fly

#12

Post by samwillis »

samwillis wrote: post #11
redment wrote: post #9

Earlier quoted context omitted.

Though I'd never do such a thing, your point is completely valid.

And I would always lean to the side of trust in people, I wouldn't expect you or most people here to abuse it. Its a little bit of a pet hate, the suggested linking to JavaScript files in another persons repository. The worst was the HTML5 Shim, for a long time they suggested linking directly to their svn repo, fortunately they don't now. It was about the same time people started thinking about using the google cdn f…

Just thinking about this, what's needed is some kind of trusted public cdn that you can send files to but cannot change so that library writers can point towards a cdn hosted version of the library without running one themselves and removing security vulnerability.

Re: Githtml - View Html Files from Github Repos On The Fly

#13

Post by redment »

rcfox wrote: post #10
redment wrote: post #7

Earlier quoted context omitted.

Most of the code is for mapping css and js files to the relative raw pages. Try your code on this page: https://raw.github.com/mrdoob/three.js/46c0a8434d3f269741a88... And compare it with githtml on the /blob/ version of the same page: https://github.com/mrdoob/three.js/blob/master/examples/canv...

CSS works fine. (Try this one: https://raw.github.com/twitter/bootstrap/master/docs/index.h... ) I suspect that JS that didn't depend on the page-load to trigger it would work too. I had never considered looking at JS-enabled pages though. When I wrote my bookmarklet, I just needed to view static documentation. Edit: I found a page with only on-click JS events, and they didn't work. Oh well...

Fixed now.

Re: Githtml - View Html Files from Github Repos On The Fly

#16

Post by simonbrown »

samwillis wrote: post #11
redment wrote: post #9

Earlier quoted context omitted.

Though I'd never do such a thing, your point is completely valid.

And I would always lean to the side of trust in people, I wouldn't expect you or most people here to abuse it. Its a little bit of a pet hate, the suggested linking to JavaScript files in another persons repository. The worst was the HTML5 Shim, for a long time they suggested linking directly to their svn repo, fortunately they don't now. It was about the same time people started thinking about using the google cdn f…

Using Google CDN places no more trust in Google than using Google Analytics or AdSense. Unless your site handled sensitive data or is mission critical, I believe it's reasonable to trust Google not to do anything malicious.

It's worth noting that the same issue exists with Chrome extensions. I wonder how strong a Google password the authors of popular Chrome extensions have.

Re: Githtml - View Html Files from Github Repos On The Fly

#17

Post by simonbrown »

samwillis wrote: post #12
samwillis wrote: post #11

Earlier quoted context omitted.

And I would always lean to the side of trust in people, I wouldn't expect you or most people here to abuse it. Its a little bit of a pet hate, the suggested linking to JavaScript files in another persons repository. The worst was the HTML5 Shim, for a long time they suggested linking directly to their svn repo, fortunately they don't now. It was about the same time people started thinking about using the google cdn f…

Just thinking about this, what's needed is some kind of trusted public cdn that you can send files to but cannot change so that library writers can point towards a cdn hosted version of the library without running one themselves and removing security vulnerability.

Or a hash attribute to file and script tags. Of course, either case would mean redment wouldn't be able to update it.

Re: Githtml - View Html Files from Github Repos On The Fly

#19

Post by _jb »

grimtrigger wrote: post #18

This would be awesome as a webapp. I have to demo pages to non technical people, so the bookmarklet/snippet is a non-starter.

I have been working on this and I decided to finish / publish it today.

Here it is : http://news.ycombinator.com/item?id=4200790 https://github.com/jbourassa/mirrorin

Post reply on HN