« first day (949 days earlier)      last day (4015 days later) » 

12:00 AM
Out of curiosity, how do people make reddit bots, are they userscripts?
 
Probably python
 
reddit bot which means? @XCritics
 
0
Q: Making a Same Domain iFrame Secure

Benjamin Gruenbaumtl;dr Can I execute un-trusted scripts on an iframe safely? Back story: I'm trying to make secure JSONP requests. A lot of older browsers do not support Web Workers which means that the current solution I came up with is not optimal. I figured I could create an <iframe> and load a script insid...

Answers much appreciated, even if they're convincing 'no's
 
now from me, ¡no! XD
 
user1125394
I thought also that jsonp request must be 'sanitized' along with putting the callback.. but on server-side, why would it matter on client?
 
12:19 AM
I'm letting someone run code on my site
I'd like to stop that someone from doing malicious stuff
In modern browsers, I've found a way around this with WebWorkers
I'd like to find a workaround for older browsers, or know for sure one is not possible
 
user1125394
ah ok, but sry, I'm noob with iframe trick methods
 
Intereting points. For all I care the external JSONP service can freeze the browser, they can navigate the iframe away, they can move stuff in it. It's an invisible iframe, they can easily run while(true){} which would hang the browser since an iframe runs on the same thread. The only thing I really care about is security. I don't want to let the iframe to execute the DOM, or the JavaScript variables in my main window in any way. As long as I keep users' data safe, that's a win for me. — Benjamin Gruenbaum 10 secs ago
He isn't teaching me anything :/
 
you can always reference dom no matter what
because document is read only
 
@Esailija but can you always reference the parent's dom?
 
well yes if the iframe is attached to the parent
 
12:31 AM
is it possible to get all elements of a given type in the document such as a 'div' or 'canvas'
 
@Dave yes
document.getElementsByTagName
 
what is the function name ?
ok thanks :)
 
if it's disconnected I don't think so
 
Can I make it disconnected?
 
(8 minutes behind deadline. not too shabby)
 
12:32 AM
@rlemon wrong account
 
nvm , the .ownerDocument is always there
 
can't I do window.ownerDocument = null ?
 
actually that's just a property of the iframe element
but you can always get that in window.frameElement I think
 
jsfiddle.net/C8YNc well doesn't work cos the jsfiddle iframe is in different domain
but this.frameElement.ownerDocument always works
 
12:34 AM
What's stopping me from this.frameElement = null? Is it read only?
 
I would think so
it doesn't make sense not to have it read-only
because there is only one valid value for it
frameElement
null
frameElement = 3
3
frameElement
null
 
What about in IE9?
In practice, I only need this to work in IE7-9, maybe even IE8-9
 
@Alex Welcome to the JavaScript chat! Please review the room pseudo-rules. Please don't ask if you can ask or if anyone's around; just ask your question, and if anyone's free and interested they'll help.
 
    @BenjaminGruenbaum may i ask how do i access the info for the element once i got them ?I did this:

    var d = document.getElementsByTagName('canvas');
    for (var i=0, max=d.length; i < max; i++) {
    		console.log(d[i].style.width);
    	}

But i get a blank line in my console.
 
"Object doesn't support this property or method"
in IE
 
12:39 AM
!!/choose beef chicken
 
@SomeKittens chicken
 
if you try to change it
 
So it's impossible to change in IE?
 
yes
 
@Esailija there isn't by any chance hope that IE supports whatwg.org/specs/web-apps/current-work/… right?
What about
Yeah, I'm pretty sure you can. Well, you can change the value in the parent page as well to something random/unique too, then it would be pretty hard for the iframe script to guess and match it. I think I should've thought through the whole scenario before commenting, but it may be something you could toy with. I forget the point of setting it and what it actually changes, I just remember seeing it being synced so that a window and iframe could talk (by what means, I can't remember) — Ian 1 min ago
Would that work? (changing .domain)
 
12:43 AM
well if it did work, then it's in different domain
 
Yeah, if it did work we win
 
don't you need it in the same domain though
 
All I care is that I create the iframe with a script
I want the interface to the user to be seamless, without having to create an external file for the iframe on another domain
 
user1125394
@Dave IE? jquery then
 
?
 
user1125394
12:45 AM
what browser?
 
im using chrome why?
 
user1125394
bah just check d var
 
thers 3 canvas's in d
 
@Dave What's 'the info' ?
 
it turns out for canvas' its d[i].width ... rather than d[i].style.width
 
user1125394
12:47 AM
indeed
 
@BenjaminGruenbaum but how do you use the results of the jsonp if you cannot pass them to main page
 
> The object-oriented model makes it easy to build up programs by accretion. What this often means, in practice, is that it provides a structured way to write spaghetti code. [Paul Graham]
 
@Esailija closure scope
var cb = (function(){var p = parent;
    return function cb(data){
       p.postMessage(data);
    }
})()
Before deleting parent
 
can you delete parent? and postMessage, does that even work in ie7 and 8?
 
Good question, lemme check
If only I had my test stack from work :/
 
1:03 AM
how about data: jsfiddle.net/C8YNc/3
 
browser support?
 
firefox don't function...
for me,,,
 
should work in ie8 with base64 encoding
 
"unknown runtime error" - IE8
Would that make them crossdomain?
 
NS_ERROR_DOM_BAD_DOCUMENT_DOMAIN: Illegal document.domain value
error on Firebug
browser firefox
8885.js?380329 (línea 1)
 
1:07 AM
@BenjaminGruenbaum yes it is cross-domain
cross-scheme too
:P
 
@Esailija so that's be safe and work in IE8?
(What about IE7? Sorry to be a pain)
 
meh it only works for images in ie8
and no ie7 at all
damn
> Additionally, data URIs can only be used for a handful of HTML elements in IE8: <object>, <img>, <input type="image"> & <link>. But this only concerns markup, and when it comes to CSS, IE8 allows data URIs on any element. Finally, IE8 data URIs can only be used in CSS declarations that accept a url() parameter, however since data URIs are rarely used differently, this is basically a non-issue.
 
So it's impossible to use a data url as a .src?
 
not for a image element
but for a iframe yes
and this is ie8, data uri works for anything in modern browsers
 
Maybe I'm approaching this the wrong may
 
1:11 AM
good night @BenjaminGruenbaum and for all
 
Maybe there's a way to make secure JSONP that works only on IE
 
you mean with some activex magic?
 
Naa, IE has a bunch of "security" stuff built in, maybe I'm missing something
Great tip Microsoft, telling me to "alert" if the user is using browsers older than IE10 telling them to upgrade
this looks deprecated
"security attribute"
wait, nope, my bad "This attribute is not supported for Windows Store apps using JavaScript."
security="restricted"
 
lol
 
Maybe this is what I'm looking for?
 
1:17 AM
I dunno the docs aren't saying anything useful
just that links cannot contain javascript:
:I
 
@Esailija what? The Microsoft documentation is lacking and makes no sense? Surely you jest!
If I can get IE.old voodoo for IE8-9 (and hopefully 7) and use html5 sandbox for other browsers, that'd be soooo swell
 
btw I never understood this: var iframedoc = iframe.contentDocument || iframe.contentWindow.document;
why not just directly iframe.contentWindow.document since contentWindow is always supported
 
Me neither XD
Just for show, "we know 'x' should work, but we're also supporting 'y' for old browsers, if you don't need to support them, just use 'x'"
 
wow SO recently hit 5 million questions
 
Yeah, I noticed :) Cool stuff
@Esailija if you feel like answering that question with "No, ownerDocument is always available, and trying to change it throws an exception. IE8 has no notion of getters so it's impossible to override. A data-url might work but IE8 doesn't support those for iframe sources, and changing the domain will have side effects and won't provide full protection" I think it's solid
 
1:28 AM
sure
though IE8 has getters for dom objects
 
Oh?
Apparently so
 
Does js support border-top-left-radius for div.style ?
 
@Esailija can't I define a getter for ownerDocument which returns null then?
@Dave yes "borderTopLeftRadius"
 
ah ok thanks
 
@BenjaminGruenbaum doesn't work on frameElement
 
1:31 AM
> The IHTMLDOMConstructor::DefineGetter method can be used to override DOM properties, DOM functions, and expandos.
Why doesn't it work on frame element?
 
well I just tried defineProperty
 
In their example they do document.__defineGetter__
 
that's undefined for me
 
Use the delete operator to delete custom properties or functions created using IHTMLDOMConstructor::DefineGetter and to restore overridden properties or functions to their original functionality.
 
1:34 AM
crap, good catch
 
@BenjaminGruenbaum "scroll down to line 40x" nope!
isolate your problems bitches ;)
 
@Esailija Just wondering, would the data-url trick work in IE9? That's still better than only supporting IE10 because IE9 has no web workers
IE9 does run in windows xp which is good
Wait, no it doesn't -_-
 
somehow the script doesn't run in ie9 jsfiddle.net/C8YNc/5
 
I think it's ridiculous we are expected to support browsers / operating systems that are older than cars we would consider owning.
just think, in less than two years people born after windows XP was released will be legally allowed to talk in here.
 
@Esailija assume base64 encoding, that's ok
@rlemon mindblown
 
1:41 AM
I cannot test it, data: is broken in ie10 lol
 
Microsofts are jerks for not making their browsers auto-update like all other vendors
 
lost a coral today... it was a bad day
 
How do you lose a coral?
 
was all but dead, so I gave it away to a guy who works at the fish store I goto
he's going to try and revive it and i told him he can keep it if he does
purple goniopora
was fairly large, cost me ~70 bucks.
gf thought it was "pretty" so demanded I get it. I knew it was going to be very hard to keep.
^ four days ago. today almost dead. they are very touch and go
tank parameters have not changed. kinda sad. mostly because it was pretty and a waste of money now.
 
Javascript isn't a real language
 
1:54 AM
javascript is a lie :O ?
 
2:04 AM
Math.PI === "lie";
 
2:17 AM
1
Q: History API and domain-level urls

RyanJMcGowanI have two pages on MyDomain.com. The index view which is visible from MyDomain.com/ and MyDomain.com/Foo/Bar. Each view has an ajax call to the other and each one pushes the state using the HTML5 History API. There are the steps that create the problem: Start at MyDomain.com/ (Works as expect...

or answer! better yet
 
1 message moved to Trash can
Next time I'm moving to the C++ room.
 
!!game or netflix
 
@rlemon game
 
2:51 AM
IE ARE YOU FUCKING KIDDING ME???
console.log.call and console.log.apply are undefined.
but console.log('blah') works.
 
> OOP is to writing a program, what going through airport security is to flying. — Richard Mansfield
 
3:08 AM
One of the branches in our current sprint is called rural-juror
 
3:27 AM
wish me luck guys
am going for the exam :D
 
Good Luck.
Hello everyone!
 
@Darkyen before you go...
 
People are silly
Which makes more sense: var a = somethingExists ? something : ''; or var a = something; if (a === undefined) { a = ''; }
 
@stroebele Welcome to the JavaScript chat! Please review the room pseudo-rules. Please don't ask if you can ask or if anyone's around; just ask your question, and if anyone's free and interested they'll help.
 
@phenomnomnominal I like the first way better
 
3:34 AM
@phenomnomnominal ?= geez
Wait, why are you even doing that?
a = if something? then something else ''
something if something? else ''
 
requirejs question (the IRC there is dead):
If I use a config module to set default values for some things that will be used by multiple methods, does the config file definition create a new scope for each subsequent definition that lists config as a dependency?
 
@Jason That depends on how config is built, but probably, yeah
Doesn't have to
RequireJS caches scripts
 
What is the preferred method for storing local tokens and similar metadata? localStorage or the module definitions or something else?
 
You can define objects too iirc, not just functions returning objects
@Jason What sort of tokens?
 
Right now it's just a token returned by the server if a user is authenticated
 
3:40 AM
How could you store them in module definitions if you expect them to persist?
Also, probably an HTTP only cookie
 
good point. I guess I was framing the problem incorrectly in my mind.
 
1 message moved to Java
@XCritics un-onebox gifs after a few seconds
 
What?
 
> Animated gifs are fun, and often entertaining and we all (mostly) enjoy them... at first. There is a timeout on editing posts, please take note of how long said timeout is and "un-onebox" the gif before it is too late. People like to enjoy the gif once, maybe twice, but over and over until the conversation pushes it off screen is annoying.
 
@BenjaminGruenbaum, that wasn't actual code haha
 
3:44 AM
@phenomnomnominal In that case that's a question of API and highly depends on what's happening
 
We have a wrapper for localStorage with a get function and an exists function, that returns the value for a key, or checks if it exists respective. My argument is that we should check it exists first, then get it, rather than getting it and checking if it's not defined
 
@phenomnomnominal Not very 'JavaScript'y
The weak typing way is getting it and checking if it is able to do what you want it to do.
Having a 'contains' method makes sense to
 
What do you see contains doing?
 
Returns true if the storage contains an element, false otherwise?
 
thats what exists does
Are you saying contains is a better name?
 
3:50 AM
contains is probably the standard name
 
yeah it does make more sense
 
Hmm, though has is probably better
That's what "map" does, if you're building an API I'd be consistent with ti
*it
myMap.get(key), myMap.set(key, value),myMap.has(key),myMap.delete(key),myMap.clear()
 
ObjectStore.has('key') or ObjectStore.contains('key')
I'd rather be clear than standard, and I think contains is clearer?
 
var store = ObjectStore.create("SomeIdentifier");
store.set('a',12);
store.set('b',{a:123});
store.get('a');//12
store.has('c');//false
store.get('d');//undefined
@phenomnomnominal I also think contains is clearer, but that's not likely to be the case in 2 years when the map api is part of the JavaScript langauge. I'm just used to 'contains' because that's how other languages do it
 
Hmm yeah
 
3:55 AM
Anybody here own a raspberrypi?
 
@Octavian I think?
 
> When there is no type hierarchy you don’t have to manage the type hierarchy. — Rob Pike
 
Just wondering what they're like to develop on, wanna bring one to work so I can do some work on it, just toggle display inputs
So what the hell, I have node installed to
So what the hell, I have node installed to /opt/node, in /opt/node/bin I have

.
├── node
└── npm -> ../lib/node_modules/npm/bin/npm-cli.js


which I then did ln -s node /usr/bin/node && ln -s npm /usr/bin/npm
but when I $: node, I just get you can install node by doing blah
 
The only good reason to use ctrl-C ctrl-V while programing is that your keyboard misses some greek letters
 
4:15 AM
Can you use this for javascript when using onclicks like so <element onclick="doSomething()"> or does it only work for event listeners?
 
4:30 AM
Try it out !
 
doesnt seem to work either way for me
this.style in console log every property was empty
 
when a coder and a programmer do an epic rap battle, who do you think going to win?
 
 
DOUBLE FUCK
 
4:44 AM
@phenomnomnominal ?
 
@BenjaminGruenbaum when our site was first build, we made an architectural decision to store all our JS in local storage, so the user doesn't have to make big requests with their phone
Because we have some large data sets (that are constant thankfully)
So just the first time you visit you get one big download, then only little ones for updates
But because localStorage in IE8/9 is quite small, and our codebase keeps growing, we're starting to run out of room
 
@phenomnomnominal Ah, if only the protocol supported some sort of magic mechanism that would allow that sort of behavior.
@phenomnomnominal I mean, that would be amazing, if that sort of desired 'download once, use many' behavior was easily available without having to explicitly store the data on something like cookies or localStorage...
Almost like, a cache
I mean, this 'hypertext transfer protocol' is typically used for distributed systems right? Performance could really be improved by the use of response caches.
You're expect the protocol to include at least a number of elements intended to make caching work as well as possible.
You'd expect such elements be even be inextricable from other aspects of that protocl.
 
When I saw 'we' made the decision, it was 18 months before I started
 
:)
I'm sitting here trying to work out why the fuck are we doing it
 
Yeah it looks nice and speccy :P
 
bah. Long day. Who wants to bring me booze?
 
Why would they implement something that is built into the protocol .
 
The only advantage i can think of is that clearing cache doesn't clear localStorage
 
Usually it does XD
Also, when you explicitly clear the cache you want to umm... explicitly clear the cache, that's the point
 
4:55 AM
when does clearing cache clear localStorage?
Every time i've tried it doesn't
 
Usually, you 'clear all data'
Which clears cache, passwords, history, etc
 
sure, but how often do you do that on your phone?
 
How often do you clear your cache on your phone?
 
I do not understand why they do it like this
 
I probably never have
@phenomnomnominal I understand, a lot of people don't know the HTTP protocol very well
 
4:57 AM
But this wasn't some dumb guy
Maybe it was just a case of OOOH look HTML5, we're so hipster
 
Not saying dumb
 
that's what it feels like
 
A lot of clever people do HTTP wrong
Mixing verbs, not knowing what the protocol can or can't do
 
No, but if CACHING is pretty damn straightforward
We fight with cached JS files all day, surely most people think about it
 
You'd expect that, wouldn't you
 

« first day (949 days earlier)      last day (4015 days later) »