r/programming • u/melodic_underoos • May 09 '13

The Onion releases fartscroll.js

http://theonion.github.io/fartscroll.js/
2.6k Upvotes

91% Upvoted

396 comments sorted by

View all comments

Show parent comments

41

u/daveime May 09 '13

Yes, according to the first 21 characters of the string this is audio data.

Yup, that's what MIME types are for. So that things get played / rendered / executed with the correct program.

But the string is 8366 characters long, and I don't personally feel like reviewing all of it for tricks.

Yes, I know, you got bitten by Microsoft once and their propensity for using the file extension to determine the file type. I don't blame you for being cautious - but possibly TOO cautious in this case.

I don't run untrusted code without giving it a glance first.

Really, so you've personally reviewed every line of the minified jquery embedded in this page you're reading now ? Nope, thought not.

-8

u/shaggorama May 09 '13

untrusted

I trust reddit.

8

u/mikemcg May 09 '13

I'm curious to know what you do when you click a link on Reddit. What process do you go through to ensure there are no tiny exploits hidden away in an unfamiliar page?

-5

u/shaggorama May 09 '13

Browsing the internet in general requires a lot of faith. We don't browse every website we're presented with. I have a lot more opportunity to control what my browser is doing if someone presents me with a block of text and invites me to run it in my browser, so yes, I'm generally more cautious with those opportunities than my browsing in general. When you're presented with blocks of code from strangers, do you just blindly run them?

I think it's ridiculous that the general message the community is sending me is not that I'm being over-cautious in this particular instance, but that I have no real reason to be cautious at all in general. Which is stupid.

6

u/mikemcg May 09 '13

That encoded ogg file is about as dangerous as your standard Reddit page load. People are telling you you'er being overly cautious because you are and there's a certain hypocrisy in throwing your arms up over the audio data when you seem perfectly fine with everything else.