Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Get your GitHub badge now

githubbadge.appspot.com

Post reply on HN
Print view View original

1–10 of 26 posts

Re: Get your GitHub badge now

#3

Post by ryanpetrich »

javery wrote: post #2

Why use an iframe? Async javascript would be better all around. Also - when you click you name in the badge it opens the link inside the small iframe.

iframes don't block the outer page from loading or expose the page's security context (cookies, etc) to the external domain.

Re: Get your GitHub badge now

#5

Post by javery »

ryanpetrich wrote: post #3
javery wrote: post #2

Why use an iframe? Async javascript would be better all around. Also - when you click you name in the badge it opens the link inside the small iframe.

iframes don't block the outer page from loading or expose the page's security context (cookies, etc) to the external domain.

Async JS doesn't block either - and cross-domain scripting rules are strict enough that it is pretty safe. The iframe code has an async Google Analytics script in it - perhaps that is the reason for the iframe (to use google analytics for tracking usage).

Re: Get your GitHub badge now

#8

Post by BYK »

javery wrote: post #5
ryanpetrich wrote: post #3

Earlier quoted context omitted.

iframes don't block the outer page from loading or expose the page's security context (cookies, etc) to the external domain.

Async JS doesn't block either - and cross-domain scripting rules are strict enough that it is pretty safe. The iframe code has an async Google Analytics script in it - perhaps that is the reason for the iframe (to use google analytics for tracking usage).

Javascript version is on the horizon. We used iframe because it was quick&dirty and "good enough" to start with =)

Re: Get your GitHub badge now

#9

Post by JoshTriplett »

javery wrote: post #5
ryanpetrich wrote: post #3

Earlier quoted context omitted.

iframes don't block the outer page from loading or expose the page's security context (cookies, etc) to the external domain.

Async JS doesn't block either - and cross-domain scripting rules are strict enough that it is pretty safe. The iframe code has an async Google Analytics script in it - perhaps that is the reason for the iframe (to use google analytics for tracking usage).

Curious what you mean about cross-domain scripting rules and safety. Normally, loading a third-party script via a script tag lets that script do anything the page can do, which makes it decidedly unsafe.

Personally, I greatly prefer the iframe.

Post reply on HN