HN user

stephenhalter

29 karma
Posts0
Comments11
View on HN
No posts found.

NaCl does not allow direct manipulation of the DOM or provide other JavaScript APIs like canvas. NaCl provides alternative ways of getting things done like pp::Graphics2D, but it is not meant for DHTML. Dash, on the other hand, provides access to JavaScript APIs.

I think that browser "assembly" code, like Dash, would have to support this, particularly if it is meant to be an alternative to compiling to JavaScript.

This is not CSRF. It uses an iframe containing a pre-filled hacker news submission form effectively causing the user to upvote the already existing story.

It could be argued that hacker news should implement frame busting for additional security, but I don't think it is a huge concern for this site.