Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Include this JS library to enable cross-origin requests

github.com

Post reply on HN
Print view View original

21–30 of 33 posts

Re: Show HN: Include this JS library to enable cross-origin requests

#21

Post by buzzedword »

odedgolan wrote: post #12
buzzedword wrote: post #4

How is this remotely trending? Yes, HN, let's vote a MITM attack to the frontpage. This is a terrible idea.

Yes it allows you to do back stuff. But it also allows great things as mashups, retrieving external content easily etc.

Tell you what. Since I'm not a big fan of the lynchmob, here's the only positive critique I'll give you: proxying isn't an altogether terrible idea. It's not my first go to, but it does have it's place. HOWEVER. Allowing a third party to manage it, is. If you genuinely want to create some buzz and interest, source the serverside of this, and write some docs up how to deploy it to AWS, Heroku, etc. Bundle the JS with that. That'll be infinitely more useful than this service.

You're asking that I trust you will not modify the response in any way shape or form. The very nature of software dev mandates that I do not trust data that is not my own; and even then, verify it. You're asking quite a lot here. This is by all points and purposes, a man-in-the-middle attack vector.

Re: Show HN: Include this JS library to enable cross-origin requests

#22

Post by Couto »

odedgolan wrote: post #13
Couto wrote: post #5

Seems a cool idea to use with mockups and prototypes, but an awful idea to use in a serious product.

Why? remember your product will function exactly the same. It just makes more thing possible.

I don't doubt that your service works with the best intentions, but why should I open a security hole in my application, when I can easily avoid it by writing my own proxy and keep it private?

What happens to my application, if your service goes through a DDoS? What happens to my application, if you suddenly decide to close your service?

I'm pretty sure you can use these arguments about other services, but this service exactly, is not worth the risk.

Re: Show HN: Include this JS library to enable cross-origin requests

#23

Post by Couto »

odedgolan wrote: post #13
Couto wrote: post #5

Seems a cool idea to use with mockups and prototypes, but an awful idea to use in a serious product.

Why? remember your product will function exactly the same. It just makes more thing possible.

Don't take me wrong… I would use your service in any proof-of-concept/mockup/prototype… It really helps a lot in those use cases, since is one less thing for me to worry about.

I just don't trust it enough to use in production.

Re: Show HN: Include this JS library to enable cross-origin requests

#25

Post by odedgolan »

buzzedword wrote: post #21
odedgolan wrote: post #12

Earlier quoted context omitted.

Yes it allows you to do back stuff. But it also allows great things as mashups, retrieving external content easily etc.

Tell you what. Since I'm not a big fan of the lynchmob, here's the only positive critique I'll give you: proxying isn't an altogether terrible idea. It's not my first go to, but it does have it's place. HOWEVER. Allowing a third party to manage it, is. If you genuinely want to create some buzz and interest, source the serverside of this, and write some docs up how to deploy it to AWS, Heroku, etc. Bundle the JS with…

OK, it is a trust issue. However you can use this library and change the proxy url to your own server and still get the benefit of the fact that you don't need to rewrite external requests and just use jQuery.

Re: Show HN: Include this JS library to enable cross-origin requests

#26

Post by odedgolan »

mkohlmyr wrote: post #20
odedgolan wrote: post #16

Earlier quoted context omitted.

You can only use JSOP and CROS with sites you have control over or are designed to behave and support external requests. It makes it very very limited!

"You can only use JSOP and CROS with sites you have control over or are designed to behave and support external requests." That's kind of the point.

It limits the thing you can do. This library allows you to easily get and display content from any external source.

Re: Show HN: Include this JS library to enable cross-origin requests

#27

Post by odedgolan »

Couto wrote: post #23
odedgolan wrote: post #13

Earlier quoted context omitted.

Why? remember your product will function exactly the same. It just makes more thing possible.

Don't take me wrong… I would use your service in any proof-of-concept/mockup/prototype… It really helps a lot in those use cases, since is one less thing for me to worry about. I just don't trust it enough to use in production.

There is a level of trust needed. However, you can use this library, change the proxy url and implement the server side yourself.

Re: Show HN: Include this JS library to enable cross-origin requests

#28

Post by odedgolan »

Rami114 wrote: post #24

If you need to ask why it is bad to route traffic through an untrusted third party over HTTP, for the love of god stop building web applications. This is not the right tool for the problem it's trying to solve.

"untrusted" is the issue here, and trust is built over time. In the meanwhile you can use the library and implement the server side.
Post reply on HN