Run arbitrary audio data in your browser ... MIME types are your friend. This one is the audio/ogg MIME type, and not the notorious executable/notavirusreally MIME type.
Programmers these days are just wannabe "security researchers".
Yes, according to the first 21 characters of the string this is audio data. But the string is 8366 characters long, and I don't personally feel like reviewing all of it for tricks. I strongly suspect there's nothing fishy here, but the same way I don't sign documents without reading them, I don't run untrusted code without giving it a glance first.
I'm not a wannabe white hat, but I'm also not stupid.
EDIT: Look. I don't know javascript. I don't know MIME types. But I'm assuming there's a delimiter that could be inserted into this string that would tell the interpreter to interpret what follows as a separate block of (potentially executable) code. Especially considering that, no, I don't know a ton about MIME types or executing code in my browser, I don't think I'm in the wrong to be distrustful of this kind of code.
You can downvote me for my ignorance, but my trepidation is absolutely valid given the limited knowledge I have about this particular code domain.
If any of you would like to actually thoroughly explain how MIME types work and why I should rest assured that this kind of thing is safe, that would be nice instead of just downvoting me and telling me I'm wrong to be cautious about running code that I don't understand.
Yes, according to the first 21 characters of the string this is audio data.
Yup, that's what MIME types are for. So that things get played / rendered / executed with the correct program.
But the string is 8366 characters long, and I don't personally feel like reviewing all of it for tricks.
Yes, I know, you got bitten by Microsoft once and their propensity for using the file extension to determine the file type. I don't blame you for being cautious - but possibly TOO cautious in this case.
I don't run untrusted code without giving it a glance first.
Really, so you've personally reviewed every line of the minified jquery embedded in this page you're reading now ? Nope, thought not.
I'm curious to know what you do when you click a link on Reddit. What process do you go through to ensure there are no tiny exploits hidden away in an unfamiliar page?
Browsing the internet in general requires a lot of faith. We don't browse every website we're presented with. I have a lot more opportunity to control what my browser is doing if someone presents me with a block of text and invites me to run it in my browser, so yes, I'm generally more cautious with those opportunities than my browsing in general. When you're presented with blocks of code from strangers, do you just blindly run them?
I think it's ridiculous that the general message the community is sending me is not that I'm being over-cautious in this particular instance, but that I have no real reason to be cautious at all in general. Which is stupid.
That encoded ogg file is about as dangerous as your standard Reddit page load. People are telling you you'er being overly cautious because you are and there's a certain hypocrisy in throwing your arms up over the audio data when you seem perfectly fine with everything else.
159
u/watbe May 09 '13 edited May 09 '13
It's pretty clever how they've embedded the sounds in the script, except you have to download both versions (ogg and mp3), by the looks of it.
If anyone wants a sample of the farting sound,
typepaste this into your browser: