« first day (587 days earlier)      last day (4346 days later) » 

12:04 AM
Is there a up-to-date port of SASS (github.com/nex3/sass) compiler for Node.js ? I really can't find it
 
12:52 AM
whats the best way to check if a position in an array exists :S
i tried:
if (typeof array[key][0] !== 'undefined' && array[key][0] !== null) {
but yet i still get the undefined error
 
1:05 AM
RT @tobie: Finally, the official ECMAScript spec in HTML. HTML!! With. Links. http://ecma-international.org/ecma-262/5.1/
 
1:26 AM
RT @hsivonen: If you'd like to see the Validator.nu HTML Parser in the Maven Central Repository, your expertise could be useful: http:// ...
 
2:01 AM
Quick, I need pictures of banjos.
Lots of them.
No time to explain.
 
2:47 AM
Okay I can explain:
@eventbrite Duel accepted. I announce the launch of EventBanjo. It's like eventbrite... if it had banjos. http://www.eventbanjo.com/
 
2:59 AM
crazy men
 
@DieVarDump bannnjooooooo
This is what I do with my knowledge of the web.
 
I kind of like it
 
My favourite part is going tail -f banjo.access.log, then watching in real-time how frantically people click away.
Let this serve as a warning to the rest of you: mess with the best, die like the rest.
And now I slink back into my unexplained absence from chatroom.
 
@Incognito nice job with that :P
What was the duel exactly?
 
3:17 AM
0
Q: Securing client->database game

wekaOK, I am creating a game using JavaScript and HTML5. The variables such as map, x, y, level, exp, etc are stored in JavaScript to keep track. On my client page, the JavaScript variables are stored to play along with the game. Every 5 seconds, the client page sends a POST AJAX call to the MySQL da...

 
Last time i answered a question like this one i had a downvote
 
 
2 hours later…
4:58 AM
@HarryBeasant yes, use the dom api
 
**2 Hours later.... **
@FlorianMargaine Have you worked on twitter streaming api ?
 
ok
I see you have github account, just curious to know, are you working on some project ?
 
5:29 AM
1
Q: JavaScript Boilerplate - Review comments required

Mohammed ArifI am in between to create JavaScript Boilerplate (collection of best practices around) for low/medium complex project and will host on GitHub in sometime once finalized it. Have divided the JavaScript modules in 3 parts project.config.js - Would have all the required configuration project.main...

 
5:44 AM
sups
 
6:15 AM
@RakeshJuyal right now, not specifically, I'm having my last exam today. Then, I have a django project that won't be a github coming, and diablo3...
hi @Anfurny :)
 
6:28 AM
how's it going
 
fine, what about you?
 
6:47 AM
@FlorianMargaine Seems like d3 is the biggest enemy of github :P, everyone stops coding and plays d3...
 
Might be.
D3 is the biggest enemy of any productivity btw.
 
7:01 AM
D3 ?
My bad Diablo 3
 
No, I'm sure Florian is talking about D3js
 
nope, I meant diablo 3 :p
 
Ah.
 
but d3js looks nice
 
It doesn't use vml.
So IE = no-no.
So, pretty useless to me.
 
7:11 AM
oh :/
yeah, raphaeljs is better then
 
Raphael is good. But I'm worried about performance...
I've got many charts to be displayed and updated in real time. Already for ten graphs there's a noticeable slow-down (especially in IE).
 
oh
for charts I'd rather use something like highchart.js
 
Paid stuff.
 
hi guys i have a query related to dropdown in html
 
@VaibhavVajani Are you going to ask the question or not? :)
 
7:24 AM
ya i have one edit information page in which values are coming from database using php... howto set the value in dropdown which was ago selected by uesr.?
 
there is the "selected" attribute you can set
 
in dropdown?
 
on the "option" you want
 
ok i got it
 
 
2 hours later…
9:10 AM
How does jQuery handle margins when using $el.position()?
 
Yeah.
 
for once, the code is quite clear
 
I guess I'm gonna make a fiddle.
Okay, scratch that.
I was using a workaround where it wasn't needed.
 
9:19 AM
Hi guys :D
I want to know if we cant disable the open of editing a page using firebug / chrome inspect element option
option*
like disabling a person to do this
Normal Code :
<div>Normal Text</div>
Changed Code:
<div> <script> mycode </script> </div>
 
You don't need a firebug or chrome console to edit a page.
You can run any script from the url bar :)
Are you worried about script injection by user?
 
yes :)
 
Don't worry.
You can do nothing about that on client side.
 
I was thinking if we can save the entire web document ( web page ) into an object and check every 5-10 secs if the user has changed the code
 
Don't do that.
 
9:23 AM
And if the code is changed, then reload the page
thats my idea :D
 
Script injection is dealt with on server side.
Your approach will not work by the way.
 
why ?
 
the page will be only fucked for that user, why do you care
 
What about AdBlock that removes elements from the page?
 
I saw this happen in a website i encountered recently
 
9:25 AM
You're going to run some timer on my page? So what prevents me from disabling that timer?
 
I tried changing an element wih style as display: none; using chrome inspect element
 
yes, so what
it will only display: none; for you
 
and it reloaded as soon as i added that
 
not for anyone else
 
it dint work
thats the problem
 
9:26 AM
did it have flash inside
 
thats how i want it to be on my page too
Nope
 
flash reloads when you change display to/from none
can you show the page
 
I dint know that
I dont remember the url exactly
 
Why do you want to reload the page?
 
but i understood what it was doing
i saw it a few days back
 
9:27 AM
just one question: why?
 
From the server side they is a group to make sure its protected. but i need to make sure no one can fiddle at the browser level too
 
@VivekSampara You cannot.
 
you know, if it really had a reload script (which I REALLY, REALLY doubt), it can be easily prevented
 
It's impossible.
But even if it were possible... you wouldn't want to do it anyway.
 
@VivekSampara why?
btw, to disable your "bad behavior", I can just disable javascript.
 
9:29 AM
the browser is program running on MY computer, you can't do shit about it
you can only choose to not take my data at server side
 
o/
 
\\o
 
There are other elements which are validated using js
so i cant completely disable javascript
 
you can't disable javascript anyway
 
9:33 AM
@VivekSampara The user can disable js.
So your "other elements" won't be validated.
 
The user can disable your scripts and run his own
he can do whatever the fuck he wants
 
that's why we're telling you it's a bad idea
 
and you can do what you want, on the server
 
cant have have something like use my javascript on this page or dont use any javascript ?
 
9:35 AM
since you "own" your server
 
crazy question i know ^^
 
and I own my computer
it's only fair
 
@VivekSampara what?
ah
 
cant we*
 
no
but, once again: why???
 
9:35 AM
why do you worry about that?
 
Damm !
 
Why damn?
 
try to understand that you don't have any REAL control here, that would be serious security breach
 
how do these bank login pages handle stuff like these ?
 
@VivekSampara Server side.
And https.
 
9:36 AM
We can atleast disable source code view ?
 
No.
 
nope
 
NO, jesus chrsit :D
 
what are you actually trying to do?
 
Hahaha.
 
9:37 AM
do you understand ANYTHING we are trying to say
 
Dont hate me :P
 
why do you want to do that anyway?
 
It's NOT your computer, you do not control it in any way
 
Yes i can
 
it's the client's computer
 
9:37 AM
We don't hate you. But you aren't listening.
 
and if you disable right-click, i'll come and burn your server
 
What if I request your page through command line?
Are you going to... disable source view?
 
lol
 
I am asking these questions because i was just counting my options of making sure stuff at the browser level are a "little" secureed
secure *
 
Use encryption.
That's the only valid suggestion.
 
9:39 AM
Encryption as in ?
 
It will make sure (more or less) that the data between the client and the server is passed without being looked at.
 
don't do things that are important for security on the client-side
 
https
 
don't see how encryption is relevant to real security
 
be aware of XSS (DOM-based especially)
 
9:40 AM
this is an internal server , Not available for everyone to use
 
but the rest should be handled on the server
 
@Esailija what do you mean?
 
only a certian group of guys are accessible to these pages
 
@Oleg in this case he is worried about client hacking stuff
which can be handled with server side data validation
it doesn't come down to encryption but it comes down to not trusting client in server side code
 
I'm incompetent. But I do understand that much.
 
9:41 AM
https is more for preventing 3rd party to see the traffic
 
Encryption => encryption of data between the client and the server.
 
yes , Ecryption the form post values?
 
@Esailija that's why i pointed out DOM-based XSS, you can't do much about this on the server-side
 
@GNi33 what do you mean you can't do anything about it?
 
@VivekSampara No, the entire page. Use secure https connection for that.
 
9:43 AM
DOM-based XSS has to be handled on the client
 
if you link me to stackoverflow.com/question=<script></script>, then that's a problem on server side code
 
also, prevent your forms against CSRF.
 
because it never really reaches the server
 
CSRF is big deal.
 
yup
 
9:44 AM
can you describe a scenario how you can xss me without doing anything with server
 
@Esailija that is reflected XSS, of course you can handle this on the server
DOM-based is a way that gets ignored a lot
there have been a lot of successful attacks through this
 
tell me how that's not a server side problem?
the example is literally what I just gave you
> if you link me to stackoverflow.com/question=<script></script>, then that's a problem on server side code
 
because this is handled by the server
it's reflected XSS
 
This code,
document.write("<OPTION value=1>"+document.location.href.substring(document.location.href.indexOf("default=")+8)+"</OPTION>");

document.write("<OPTION value=2>English</OPTION>");
is from some server
 
DOM-based XSS attacks are attacks over input that is purely handled by JavaScript (a stupid thing anyway if you ask me)
 
9:48 AM
if I go to that page, the server sends me that javascript code
so, the server needs to send me javascript code that does not suck
 
imagine a script put in a hashtag
 
yes, there is an exploit with that
also handled by server not sending vulnerable javascript code
 
the content of the hashtag gets handled with js, and there you go
 
specifically it was $( document.location.hash )
 
@Esailija haha, yes, i guess you can put it that way
 
9:50 AM
that has everything to do with server, because that piece of shit code was sent from some server in the first place
 
that's what i meant with it should be handled on the client - side -> in the js code
but you can't handle these things on the server, that's all I mean
 
but server is the source of the vulnerable js code
go to the source
it gets sent from server
it's the same as outputting someone's profile without escaping html
 
you know what i mean, right?
 
so they can put scripts in their profile
 
has anyone used citibank website ?
 
9:52 AM
I know the code that makes this pure client side code
 
that's stored XSS is JUST a server-issue
 
but the server is still at fault
for sending that code
 
of course
but that's not the case with dom-based XSS
hashtags never reach the server
 
there's login page opened when you click on the login button. if you close the actual page and have only the login page opened then you will be asked to restart the process of login with the main page opened .
 
if you see it like this, any attack is clientside...
 
9:53 AM
sure but the vulnerable hash handling code was sent from a server in the first place
 
I mean, http is server/client
 
oh come on
 
I cannot use this exploit without access to someone's server and make them send shitty code
 
that's my point
 
9:53 AM
@VivekSampara so?
 
@Esailija no, you can just change an existing URL and send it to someone
 
@GNi33 not if the exploit doesn't exist :p that's what he means I guess
 
yes, IF their code is already vulnerable, either from server side hacks or incompetence
 
if stuff that comes from the URL and is handled by JS incorrectly, you'll be in trouble
 
how can i do something like that ?
 
9:55 AM
this has nothing to do with the server, it's the fault of shitty JS code then
 
btw, to protect from xss, just filter your output.
 
What if I have a browser extension that modifies content on the page and masquerades as youtube downloader? :)
 
checking if another page is opened or not
 
talk about eval and stuff
 
nope, the server has to filter output
 
9:55 AM
@VivekSampara why you want to do "something like that"?
 
and if its not then restart login process\
 
@FlorianMargaine yes, but the exploit exists in the JS-code, not on the server side
 
I dont know. there must be a reason citibank does it :D
 
if you modify the js code on the server side not to suck, the exploit can't happen
 
so why not i give it a try too
 
9:56 AM
Lol wut.
 
the client can even override the js with his modified js not to have that exploit
say I know some site does $( document.location.hash ) with old jQuery
 
@VivekSampara It's probably not related to security. How do you know?
 
@Esailija yes, but who does that?
 
Just a gues
 
well the point is that the exploit can only happen because the server sends bad js, which can be fixed on the server by sending good js
 
9:57 AM
guess*
 
@VivekSampara You don't guess in security.
Your boss will ask: "what is the reason behind this?"
 
where as you said it cannot be fixed on server side..
 
And you'll answer what? "CitiBank does it."??
 
@Esailija i know what you mean, but for me, this is "client-side - code"
of course there's a server that sends that code to the client
 
Lol... good point
 
9:59 AM
yes but originally the argument started because you said that server cannot do anything about this
where as I'm saying that the server can simply not send vulnerable js in the first place, therefore fixing the problem on the server
 
the code that's executed on the server-side
better? ;)
 
Sam
Hey guys, anyone mind taking a look at this jsfiddle?

http://jsfiddle.net/m2VyK/

The important part is the javascript function getNextPod(). Why does the setTimeout not wait for 10 seconds?
 

« first day (587 days earlier)      last day (4346 days later) »