Skip to main content
fixed typo
Source Link
Robert Longson
  • 123.6k
  • 13
  • 152
  • 213

I would definitely disable:

  • Posting Stack Snippets for users with < X rep (tresholdthreshold at staff's discretion)
  • Running Stack Snippets for anonymous users
  • Running Stack Snippets for users that did not previously opt-in for them

Alternate to 1: enabling a Stack Snippet only after peer review by users with review privileges (e.g. I can review on SO, but not on SU)

Preventing run for anonymous users is simply a way to protect the most inexperienced.

Finally no matter the sandbox I would pay great attention to user-posted code. After tons of articles about do not trust user input ([1] [2] and a lot more) how dare you allow people to run Javascript on another person's computer with the press of a button? Kidding...

I don't think that working on a heuristic Javascript scanner (eval is first candidate to evilness) to block script is a good idea. We don't need a Javascript antivirus :-)

I would definitely disable:

  • Posting Stack Snippets for users with < X rep (treshold at staff's discretion)
  • Running Stack Snippets for anonymous users
  • Running Stack Snippets for users that did not previously opt-in for them

Alternate to 1: enabling a Stack Snippet only after peer review by users with review privileges (e.g. I can review on SO, but not on SU)

Preventing run for anonymous users is simply a way to protect the most inexperienced.

Finally no matter the sandbox I would pay great attention to user-posted code. After tons of articles about do not trust user input ([1] [2] and a lot more) how dare you allow people to run Javascript on another person's computer with the press of a button? Kidding...

I don't think that working on a heuristic Javascript scanner (eval is first candidate to evilness) to block script is a good idea. We don't need a Javascript antivirus :-)

I would definitely disable:

  • Posting Stack Snippets for users with < X rep (threshold at staff's discretion)
  • Running Stack Snippets for anonymous users
  • Running Stack Snippets for users that did not previously opt-in for them

Alternate to 1: enabling a Stack Snippet only after peer review by users with review privileges (e.g. I can review on SO, but not on SU)

Preventing run for anonymous users is simply a way to protect the most inexperienced.

Finally no matter the sandbox I would pay great attention to user-posted code. After tons of articles about do not trust user input ([1] [2] and a lot more) how dare you allow people to run Javascript on another person's computer with the press of a button? Kidding...

I don't think that working on a heuristic Javascript scanner (eval is first candidate to evilness) to block script is a good idea. We don't need a Javascript antivirus :-)

Source Link

I would definitely disable:

  • Posting Stack Snippets for users with < X rep (treshold at staff's discretion)
  • Running Stack Snippets for anonymous users
  • Running Stack Snippets for users that did not previously opt-in for them

Alternate to 1: enabling a Stack Snippet only after peer review by users with review privileges (e.g. I can review on SO, but not on SU)

Preventing run for anonymous users is simply a way to protect the most inexperienced.

Finally no matter the sandbox I would pay great attention to user-posted code. After tons of articles about do not trust user input ([1] [2] and a lot more) how dare you allow people to run Javascript on another person's computer with the press of a button? Kidding...

I don't think that working on a heuristic Javascript scanner (eval is first candidate to evilness) to block script is a good idea. We don't need a Javascript antivirus :-)