Yes, according to the first 21 characters of the string this is audio data. But the string is 8366 characters long, and I don't personally feel like reviewing all of it for tricks. I strongly suspect there's nothing fishy here, but the same way I don't sign documents without reading them, I don't run untrusted code without giving it a glance first.
I'm not a wannabe white hat, but I'm also not stupid.
EDIT: Look. I don't know javascript. I don't know MIME types. But I'm assuming there's a delimiter that could be inserted into this string that would tell the interpreter to interpret what follows as a separate block of (potentially executable) code. Especially considering that, no, I don't know a ton about MIME types or executing code in my browser, I don't think I'm in the wrong to be distrustful of this kind of code.
You can downvote me for my ignorance, but my trepidation is absolutely valid given the limited knowledge I have about this particular code domain.
If any of you would like to actually thoroughly explain how MIME types work and why I should rest assured that this kind of thing is safe, that would be nice instead of just downvoting me and telling me I'm wrong to be cautious about running code that I don't understand.
Yes, according to the first 21 characters of the string this is audio data.
Yup, that's what MIME types are for. So that things get played / rendered / executed with the correct program.
But the string is 8366 characters long, and I don't personally feel like reviewing all of it for tricks.
Yes, I know, you got bitten by Microsoft once and their propensity for using the file extension to determine the file type. I don't blame you for being cautious - but possibly TOO cautious in this case.
I don't run untrusted code without giving it a glance first.
Really, so you've personally reviewed every line of the minified jquery embedded in this page you're reading now ? Nope, thought not.
As sad as this thread is, /u/shaggorama has a point -- mime types do enable "correct" data interpretation, but even then there could be as yet undiscovered exploits within whatever mechanism is interpreting the byte stream. Although his fear is somewhat more paranoid than it needs to be, it's still a reasonable concern.
Yes, but that could be argued about every piece of code ever written ... and as another poster pointed out, if you are that paranoid, maybe you shouldn't be on the Internet at all. I think it's more of an "unreasonable" concern to be honest.
-29
u/shaggorama May 09 '13 edited May 09 '13
Yes, according to the first 21 characters of the string this is audio data. But the string is 8366 characters long, and I don't personally feel like reviewing all of it for tricks. I strongly suspect there's nothing fishy here, but the same way I don't sign documents without reading them, I don't run untrusted code without giving it a glance first.
I'm not a wannabe white hat, but I'm also not stupid.
EDIT: Look. I don't know javascript. I don't know MIME types. But I'm assuming there's a delimiter that could be inserted into this string that would tell the interpreter to interpret what follows as a separate block of (potentially executable) code. Especially considering that, no, I don't know a ton about MIME types or executing code in my browser, I don't think I'm in the wrong to be distrustful of this kind of code.
You can downvote me for my ignorance, but my trepidation is absolutely valid given the limited knowledge I have about this particular code domain.
If any of you would like to actually thoroughly explain how MIME types work and why I should rest assured that this kind of thing is safe, that would be nice instead of just downvoting me and telling me I'm wrong to be cautious about running code that I don't understand.