It would be nice if people could lay off the script injections. It's clearly insecure, but that's not really the point. It makes the experience worse for everyone if you alert(), etc.
back
3 comments
> It's clearly insecure, but that's not really the point.
No, that is the point. I even pointed it out hours ago: https://news.ycombinator.com/item?id=6727448
The failure is the lesson. The previous version was a clever hack written by a clever person. This is ignorance, and the lesson is that allowing users to run arbitrary code on other user's computers is bad idea.
I'm pretty sure that OP knew the issue, not just you, so it's not ignorance. And it's not the moment to cite The Good Parts either.
There is no failure here to be seen. There is a clever hack to make a spreadsheet shared quick and dirty.
Just a reminder that all the JS code you run, in particular on jsFiddle, is untrusted and is part of the security model of the JS engine in your browser that evil JS code must not be able to do any harm. If it did, report it to the browser vendor and earn a bounty.
yup. I guess some couldn't resist the urge. I hope there aren't more malicious minds, trying to steal cookies or stuff.
Almost certainly someone is stealing cookies and this should be taken down soon. However, I actually enjoyed this post and was really informative all around.
Fiddles run unsecure code by design, so they do in a separate domain.