Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dwitter – A social network for short JavaScript demos

dwitter.net

Post reply on HN
Print view View original

61–70 of 74 posts

Re: Dwitter – A social network for short JavaScript demos

#61

Post by qaco »

lionleaf wrote: post #35
rosalinekarr wrote: post #29

This is really cool, but executing other people's javascript in a page makes me nervous. What sort of restrictions are in place to prevent malicious exploits?

Makes me quite nervous too. So far each dweet is run in a sandboxed iframe loaded from a separate subdomain. There are definitely things you can do, and I'm aware of some annoying ones. I'll just manually delete them at this point. Any security conscious person would view it with noscript and just read the javascript ;)

how do you sandbox the iframe/code?

Re: Dwitter – A social network for short JavaScript demos

#62

Post by dorianm »

ohhhwell wrote: post #6

Oh fun, didn't expect to see my side-project here :) A few of my personal favorites: https://www.dwitter.net/d/90 https://www.dwitter.net/d/406 https://www.dwitter.net/d/433 https://www.dwitter.net/d/617

Infinite loops (accidental in my case) should probably be catched in some way.

Re: Dwitter – A social network for short JavaScript demos

#63

Post by lionleaf »

zamalek wrote: post #60
ohhhwell wrote: post #6

Oh fun, didn't expect to see my side-project here :) A few of my personal favorites: https://www.dwitter.net/d/90 https://www.dwitter.net/d/406 https://www.dwitter.net/d/433 https://www.dwitter.net/d/617

A little feedback, the tab got helluva laggy after scrolling down a few pages. I assume that's because you aren't unloading dwitters when they scroll past the top of the viewport - which you probably should. Chrome 56, Windows 10.

The dweets are stopped but not unloaded as you scroll away. You're entirely right though, needs some proper unloading.

Edit: Link to the issue https://github.com/lionleaf/dwitter/issues/66

Re: Dwitter – A social network for short JavaScript demos

#64

Post by lionleaf »

EGreg wrote: post #56
lionleaf wrote: post #35

Earlier quoted context omitted.

Makes me quite nervous too. So far each dweet is run in a sandboxed iframe loaded from a separate subdomain. There are definitely things you can do, and I'm aware of some annoying ones. I'll just manually delete them at this point. Any security conscious person would view it with noscript and just read the javascript ;)

Why not make their javascript run in WebWorkers and provide a DOM-like interface for all the things? That way you can kill infinite loops etc.

That's something I've been thinking about. Webworkers don't have direct access to the Canvas though, but it seems like you can work around that by passing image data. Killing infinite loops would be great

Re: Dwitter – A social network for short JavaScript demos

#65

Post by lionleaf »

qaco wrote: post #61
lionleaf wrote: post #35

Earlier quoted context omitted.

Makes me quite nervous too. So far each dweet is run in a sandboxed iframe loaded from a separate subdomain. There are definitely things you can do, and I'm aware of some annoying ones. I'll just manually delete them at this point. Any security conscious person would view it with noscript and just read the javascript ;)

how do you sandbox the iframe/code?

Using the "sandbox" property. At least stops things like alert('hey') and a full-page redirect

Re: Dwitter – A social network for short JavaScript demos

#67

Post by brian_cloutier »

dorianm wrote: post #62
ohhhwell wrote: post #6

Oh fun, didn't expect to see my side-project here :) A few of my personal favorites: https://www.dwitter.net/d/90 https://www.dwitter.net/d/406 https://www.dwitter.net/d/433 https://www.dwitter.net/d/617

Infinite loops (accidental in my case) should probably be catched in some way.

Yeah, the halting problem has been around since 1936. You'd think someone would have solved it already!

Re: Dwitter – A social network for short JavaScript demos

#68

Post by lauriswtf »

ohhhwell wrote: post #6

Oh fun, didn't expect to see my side-project here :) A few of my personal favorites: https://www.dwitter.net/d/90 https://www.dwitter.net/d/406 https://www.dwitter.net/d/433 https://www.dwitter.net/d/617

Awesome project, love the idea!

It's fun to optimize the code under 140 bytes. https://www.dwitter.net/d/832

Re: Dwitter – A social network for short JavaScript demos

#69

Post by jlebrech »

dorianm wrote: post #62
ohhhwell wrote: post #6

Oh fun, didn't expect to see my side-project here :) A few of my personal favorites: https://www.dwitter.net/d/90 https://www.dwitter.net/d/406 https://www.dwitter.net/d/433 https://www.dwitter.net/d/617

Infinite loops (accidental in my case) should probably be catched in some way.

maybe give the scripts a quota of cycles then can consume.

maybe the script tag should support that one day

Re: Dwitter – A social network for short JavaScript demos

#70

Post by jlebrech »

sigvef wrote: post #25
artursapek wrote: post #20

This is the coolest website I've seen in a long time. Awesome idea. EDIT: one issue I'm running into is it's easy to accidentally write half-finished code that freezes my browser. It would be nice to have an option to only refresh the preview upon clicking some kind of button.

One trick you learn as a dweeter is to write all for-loops as "fr" instead of "for", and then only adding the last "o" when you feel confident that the loop won't accidentally go on forever!

or the source box could replace 'for' with a loop thats designed to run a few seconds.
Post reply on HN