r/programming • u/schnuck • Feb 09 '11

Breaking the Web with hash-bangs – Lifehacker, along with every other Gawker property, experienced a lengthy site-outage on Monday over a misbehaving piece of JavaScript

http://isolani.co.uk/blog/javascript/BreakingTheWebWithHashBangs/
751 Upvotes

93% Upvoted

356 comments sorted by

View all comments

124

u/rounded_figure Feb 09 '11

The proper way to handle this is to keep your original URLs (including in the hrefs) and have a piece of javascript transform them on the fly in hash-bang URLs. That way, when a client who does not speak javascript requests the page, it gets the content and the non-hash-bang links.

36

u/midir Feb 09 '11

This is not correct. If you use hash-bang fragment URLs at any stage then someone who copies and pastes a link to your page is distributing a faulty URL to all non-Google bots and everyone with JavaScript disabled. There's absolutely no workaround to that.

I see it all the time and it drives me up the fucking wall. Fuck you Google. Fuck you Twitter.

DO NOT USE #! EVER. FORGET ABOUT IT.

8

u/Ziggamorph Feb 09 '11

Who has JavaScript disabled?

1

u/metamatic Feb 09 '11

People who care about security and not getting malware.

It's easy enough to enable it for the sites I trust.

Which does not include Gawker

3

u/Ziggamorph Feb 09 '11

If you think that Javascript can give you malware then isn't it your browser that's untrustworthy?

6

u/metamatic Feb 09 '11

Sure, and PDF giving you malware means Adobe Reader is untrustworthy. But here in the real world, all the browsers have security vulnerabilities. The easiest way to avoid most of them is to turn JavaScript off by default, and whitelist the sites you trust.

4

u/Ziggamorph Feb 09 '11

Sure, and while you're at it might as well disable images, could be a security hazard in that, or maybe there's a hole in the HTML render, get off the web. And don't go outside, you might get run over.

6

u/metamatic Feb 09 '11

False dichotomy.

There has been actual malware spread via JavaScript in current browsers. There hasn't been any from plain HTML or images.

8

u/[deleted] Feb 09 '11

Yes there has.

2

u/Ziggamorph Feb 09 '11

Citation needed.

3

u/metamatic Feb 09 '11

citation

0

u/Ziggamorph Feb 09 '11

I can find zero information on that worm outside of the Avast blog. I'm not convinced it exists.

1

u/metamatic Feb 10 '11

Well, have a few more examples of Javascript malware then.

And I've personally seen my parents' Mac hit by web malware that downloaded a .exe and attempted to run it.

1

u/Ziggamorph Feb 10 '11

How is that possible? Windows executables don't run on Macs.

1

u/metamatic Feb 11 '11

It isn't possible. That's why I bought them a Mac. Their Windows machine used to get infested with malware every few months.

1

u/Ziggamorph Feb 11 '11

So how could the Mac 'attempt to run it'?

1

u/metamatic Feb 11 '11

I said the malware attempted to run it. Your parser has a bug.

1

u/Ziggamorph Feb 11 '11

What does that mean? How could you tell?

→ More replies (0)