Timeline for Feedback requested: Stack Snippets 2.0
Current License: CC BY-SA 3.0
21 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Mar 20, 2017 at 9:34 | history | edited | CommunityBot |
replaced http://meta.stackoverflow.com/ with https://meta.stackoverflow.com/
|
|
Aug 19, 2016 at 3:45 | comment | added | ridgerunner | +1 But for my purposes, I'd like to be able to selectively hide the (bulky and not terribly interesting) HTML and CSS and just show the relevant JS code - while keeping the RUN button displayed. In other words have three independent hide buttons in the editor: Hide HTML, Hide CSS, and Hide JS. | |
Jan 22, 2016 at 14:55 | comment | added | Tomáš Zato | @canon I'm not sure what the options are and frankly I didn't realize the iframe is actually sandboxed. | |
Jan 22, 2016 at 14:54 | comment | added | canon | @TomášZato are you referring to some cross-domain, sandboxed iframe exploit I'm unaware of? | |
Jan 22, 2016 at 14:49 | comment | added | Tomáš Zato | This is bad idea. I am sure surprises will happen even now. You don't know people man. Many invest a lot of effort to get their account hacked, much more than just clicking a button. | |
Sep 9, 2014 at 21:45 | comment | added | Chris Baker | I agree with the request here. The concerns are valid, too, but in balance I think the community will police this well, especially if there is a flag specific to "has malicious code snippet" | |
Sep 9, 2014 at 15:41 | comment | added | daveloyall | Provide a big hammer for the "oh crap! This snippet is stealing SE cookies and posting copies of itself all over SE" situation. This hammer needs to prevent the snippet content from being sent to browsers, period. When designing this hammer, keep in mind that your real enemy is a specially crafted snippet which can take over the user's browser when they merely view the page, ie, a snippet that contains an unpatched exploit. I recommend a "show content as text anyway" button. We're grownups. | |
Sep 9, 2014 at 15:34 | comment | added | Adam Lear StaffMod | @canon I think I already explained the entirety of my argument. We aren't jsFiddle so we might do some things differently. In the end, it's not me you need to convince, it's Haney. The only thing I have a strong objection to here is making this privilege-based. | |
Sep 9, 2014 at 15:34 | comment | added | daveloyall | I ran the Unicorn example without actually inspecting it. | |
Sep 9, 2014 at 15:26 | comment | added | Adam Lear StaffMod | @canon Sure. We still don't need to be implicitly encouraging people to click before looking. | |
Sep 9, 2014 at 0:05 | comment | added | 700 Software | +1 from me. I'm not going to read the code before running anyway. Especially if they make the code nice and long. (which is the whole point of collapsible snippets) | |
Sep 8, 2014 at 23:07 | comment | added | Adam Lear StaffMod | @MartinSmith Since this has to be based off the privilege of the snippet's author rather than the viewer, that kind of rep-based unlock is unfortunately likely to cause more confusion with the majority than anything. "Why does this snippet have a run button and this one doesn't?" kind of thing. | |
Sep 8, 2014 at 22:52 | comment | added | Martin Smith | @Haney It could be a rep based privilege on the grounds that someone who has invested the time and effort to get to, say, 10k is unlikely to want to risk suspension by abusing this. | |
Sep 8, 2014 at 22:08 | comment | added | Haney Staff | You're right @nhinkle, and unfortunately this is one of the "grey areas" of this project. How do you prevent maliciousness on an open-ended tool? Detecting it is difficult for the exact reason you just stated. So we have to trust the community to downvote bad Snippets. Additionally, HTML 5 iframe sandboxing helps to protect the user. | |
Sep 8, 2014 at 22:04 | comment | added | nhinkle | @Haney if somebody wants to abuse it though, it's trivial to include an external file that looks like some sort of dependency (like a JS library of some sort) but is actually malicious. It wouldn't be too hard to get code running that people haven't looked at. | |
Sep 8, 2014 at 21:38 | comment | added | Haney Staff | As @AnnaLear says, my concern here is I show the "brief" code as a harmless change to your original Snippet, but my hidden code is an infinite loop or some other craziness. I feel like you should have to stare at it before you run it. | |
Sep 8, 2014 at 21:27 | comment | added | Adam Lear StaffMod | Yeah, I don't think we should encourage people to just run code they haven't even looked at. | |
Sep 8, 2014 at 21:26 | history | edited | Andrew | CC BY-SA 3.0 |
clarification, as I understand it.
|
Sep 8, 2014 at 21:11 | comment | added | Ganesh Sittampalam | Doesn't that risk "surprises"? | |
Sep 8, 2014 at 20:49 | history | edited | canon | CC BY-SA 3.0 |
added 113 characters in body
|
Sep 8, 2014 at 20:41 | history | answered | canon | CC BY-SA 3.0 |