HN user

whyonearth

53 karma
Posts0
Comments18
View on HN
No posts found.

You have to get clever when searching CL. Plenty of places that allow cats don't click the "Cats OK" box. Instead of using that search filter, include the terms -"no cats" -"no pets". In your case, -"no couples". My CL searches to filter the fake 1BRs get pretty crazy (-roommate -"room for rent" -jr -junior -studio, etc...) but their search engine handles complex queries well.

The cornerstone of JavaScript is the function.

JavaScript is specified in terms of objects, has richer facilities for dealing with objects than functions, functions are objects but not vice-versa. So, objects are the cornerstone. Callers are free to ignore a function's arity even.

I think it's a bit contradictory to choose an insecure OS because a more secure one doesn't support a nice-to-have piece of security hardware. That aside, I'd be interested in the specifics of the "too many problems" that you anticipate on supported hardware (which includes most configurations of the XPS and Precision).

Turtletoy 8 years ago

I certainly hope that isn't the intent, because there are other ways to generate network requests (new Image() and fetch(), for example). Sandboxing JS eval is a very hard problem and even Angular 1's "bulletproof" sandboxed template engine was repeatedly owned. I'd be wary of XSS on any site like this one.

The thread makes me want to quit the industry. One person disagrees and gets "I vote for this statement to be nominated for Worst Sentiment of 2018", while the gist-er is congratulated with "instant classic" and "you're my hero." The JS cargo-culting insanity is becoming unbearable and dissenters are mocked as noobs.

I think you're being somewhat defensive of what appears to be a prototype, just offering the feedback you requested.

1. What I mean is that <span>@code</span> becomes <span>data-af-click</span>.

2. Where? Not seeing them.

3. You're mistaken about event handler cleanup: https://dom.spec.whatwg.org/#dom-childnode-remove

6. My point here is that relying on strings is brittle. HTML builders, declarative APIs like JSX/React.createElement, and template-based approaches (where the template is a DOM node) are more robust.

Feedback:

1. Parser prohibits literal "@click", there is no escape mechanism.

2. Only click, what about other DOM events?

3. Leaking: Event listeners not removed in destructor (your clean() function?)

4. No XSS protection, ow.

5. No tests, might want some.

6. Based on innerHTML assignment with nothing to guarantee valid HTML.

7. No error handling.