Skip to main content
21 events
when toggle format what by license comment
Mar 20, 2017 at 9:34 history edited CommunityBot
replaced http://meta.stackoverflow.com/ with https://meta.stackoverflow.com/
Aug 19, 2016 at 3:45 comment added ridgerunner +1 But for my purposes, I'd like to be able to selectively hide the (bulky and not terribly interesting) HTML and CSS and just show the relevant JS code - while keeping the RUN button displayed. In other words have three independent hide buttons in the editor: Hide HTML, Hide CSS, and Hide JS.
Jan 22, 2016 at 14:55 comment added Tomáš Zato @canon I'm not sure what the options are and frankly I didn't realize the iframe is actually sandboxed.
Jan 22, 2016 at 14:54 comment added canon @TomášZato are you referring to some cross-domain, sandboxed iframe exploit I'm unaware of?
Jan 22, 2016 at 14:49 comment added Tomáš Zato This is bad idea. I am sure surprises will happen even now. You don't know people man. Many invest a lot of effort to get their account hacked, much more than just clicking a button.
Sep 9, 2014 at 21:45 comment added Chris Baker I agree with the request here. The concerns are valid, too, but in balance I think the community will police this well, especially if there is a flag specific to "has malicious code snippet"
Sep 9, 2014 at 15:41 comment added daveloyall Provide a big hammer for the "oh crap! This snippet is stealing SE cookies and posting copies of itself all over SE" situation. This hammer needs to prevent the snippet content from being sent to browsers, period. When designing this hammer, keep in mind that your real enemy is a specially crafted snippet which can take over the user's browser when they merely view the page, ie, a snippet that contains an unpatched exploit. I recommend a "show content as text anyway" button. We're grownups.
Sep 9, 2014 at 15:34 comment added Adam Lear StaffMod @canon I think I already explained the entirety of my argument. We aren't jsFiddle so we might do some things differently. In the end, it's not me you need to convince, it's Haney. The only thing I have a strong objection to here is making this privilege-based.
Sep 9, 2014 at 15:34 comment added daveloyall I ran the Unicorn example without actually inspecting it.
Sep 9, 2014 at 15:26 comment added Adam Lear StaffMod @canon Sure. We still don't need to be implicitly encouraging people to click before looking.
Sep 9, 2014 at 0:05 comment added 700 Software +1 from me. I'm not going to read the code before running anyway. Especially if they make the code nice and long. (which is the whole point of collapsible snippets)
Sep 8, 2014 at 23:07 comment added Adam Lear StaffMod @MartinSmith Since this has to be based off the privilege of the snippet's author rather than the viewer, that kind of rep-based unlock is unfortunately likely to cause more confusion with the majority than anything. "Why does this snippet have a run button and this one doesn't?" kind of thing.
Sep 8, 2014 at 22:52 comment added Martin Smith @Haney It could be a rep based privilege on the grounds that someone who has invested the time and effort to get to, say, 10k is unlikely to want to risk suspension by abusing this.
Sep 8, 2014 at 22:08 comment added Haney Staff You're right @nhinkle, and unfortunately this is one of the "grey areas" of this project. How do you prevent maliciousness on an open-ended tool? Detecting it is difficult for the exact reason you just stated. So we have to trust the community to downvote bad Snippets. Additionally, HTML 5 iframe sandboxing helps to protect the user.
Sep 8, 2014 at 22:04 comment added nhinkle @Haney if somebody wants to abuse it though, it's trivial to include an external file that looks like some sort of dependency (like a JS library of some sort) but is actually malicious. It wouldn't be too hard to get code running that people haven't looked at.
Sep 8, 2014 at 21:38 comment added Haney Staff As @AnnaLear says, my concern here is I show the "brief" code as a harmless change to your original Snippet, but my hidden code is an infinite loop or some other craziness. I feel like you should have to stare at it before you run it.
Sep 8, 2014 at 21:27 comment added Adam Lear StaffMod Yeah, I don't think we should encourage people to just run code they haven't even looked at.
Sep 8, 2014 at 21:26 history edited Andrew CC BY-SA 3.0
clarification, as I understand it.
Sep 8, 2014 at 21:11 comment added Ganesh Sittampalam Doesn't that risk "surprises"?
Sep 8, 2014 at 20:49 history edited canon CC BY-SA 3.0
added 113 characters in body
Sep 8, 2014 at 20:41 history answered canon CC BY-SA 3.0