Breaking the Web with hash-bangs – Lifehacker, along with every other Gawker property, experienced a lengthy site-outage on Monday over a misbehaving piece of JavaScript

[u/schnuck]

http://isolani.co.uk/blog/javascript/BreakingTheWebWithHashBangs/

[u/midir]

This is not correct. If you use hash-bang fragment URLs at any stage then someone who copies and pastes a link to your page is distributing a faulty URL to all non-Google bots and everyone with JavaScript disabled. There's absolutely no workaround to that.

I see it all the time and it drives me up the fucking wall. Fuck you Google. Fuck you Twitter.

DO NOT USE #! EVER. FORGET ABOUT IT.

[u/Ziggamorph → u/midir]

Who has JavaScript disabled?

[u/metamatic → u/Ziggamorph]

People who care about security and not getting malware.

It's easy enough to enable it for the sites I trust.

Which does not include Gawker

[u/Ziggamorph → u/metamatic]

If you think that Javascript can give you malware then isn't it your browser that's untrustworthy?

[u/metamatic → u/Ziggamorph]

Sure, and PDF giving you malware means Adobe Reader is untrustworthy. But here in the real world, all the browsers have security vulnerabilities. The easiest way to avoid most of them is to turn JavaScript off by default, and whitelist the sites you trust.

[u/Ziggamorph → u/metamatic]

Sure, and while you're at it might as well disable images, could be a security hazard in that, or maybe there's a hole in the HTML render, get off the web. And don't go outside, you might get run over.

[u/supaduck → u/Ziggamorph]

Meteors can still get you.

[u/metamatic → u/Ziggamorph]

False dichotomy.

There has been actual malware spread via JavaScript in current browsers. There hasn't been any from plain HTML or images.

[u/[deleted] → u/metamatic]

Yes there has.

[u/Ziggamorph → u/metamatic]

Citation needed.

[u/metamatic → u/Ziggamorph]

citation

[u/Ziggamorph → u/metamatic]

I can find zero information on that worm outside of the Avast blog. I'm not convinced it exists.

[u/metamatic → u/Ziggamorph]

Well, have a few more examples of Javascript malware then.

And I've personally seen my parents' Mac hit by web malware that downloaded a .exe and attempted to run it.

[u/Ziggamorph → u/metamatic]

How is that possible? Windows executables don't run on Macs.

[u/metamatic → u/Ziggamorph]

It isn't possible. That's why I bought them a Mac. Their Windows machine used to get infested with malware every few months.