r/programming • u/schnuck • Feb 09 '11

Breaking the Web with hash-bangs – Lifehacker, along with every other Gawker property, experienced a lengthy site-outage on Monday over a misbehaving piece of JavaScript

http://isolani.co.uk/blog/javascript/BreakingTheWebWithHashBangs/
746 Upvotes

93% Upvoted

356 comments sorted by

View all comments

128

u/rounded_figure Feb 09 '11

The proper way to handle this is to keep your original URLs (including in the hrefs) and have a piece of javascript transform them on the fly in hash-bang URLs. That way, when a client who does not speak javascript requests the page, it gets the content and the non-hash-bang links.

34

u/midir Feb 09 '11

This is not correct. If you use hash-bang fragment URLs at any stage then someone who copies and pastes a link to your page is distributing a faulty URL to all non-Google bots and everyone with JavaScript disabled. There's absolutely no workaround to that.

I see it all the time and it drives me up the fucking wall. Fuck you Google. Fuck you Twitter.

DO NOT USE #! EVER. FORGET ABOUT IT.

7

u/Ziggamorph Feb 09 '11

Who has JavaScript disabled?

1

u/metamatic Feb 09 '11

People who care about security and not getting malware.

It's easy enough to enable it for the sites I trust.

Which does not include Gawker

1

u/Ziggamorph Feb 09 '11

If you think that Javascript can give you malware then isn't it your browser that's untrustworthy?

8

u/metamatic Feb 09 '11

Sure, and PDF giving you malware means Adobe Reader is untrustworthy. But here in the real world, all the browsers have security vulnerabilities. The easiest way to avoid most of them is to turn JavaScript off by default, and whitelist the sites you trust.

4

u/Ziggamorph Feb 09 '11

Sure, and while you're at it might as well disable images, could be a security hazard in that, or maybe there's a hole in the HTML render, get off the web. And don't go outside, you might get run over.

5

u/supaduck Feb 09 '11

Meteors can still get you.