SoylentNews

Help Wanted: Implementing Inline Reply and Moderation

posted by NCommander on Thursday June 04 2015, @10:00AM   
from the lets-do-this-right dept.

So as the post-upgrade dust settles, one of the big things still left on our usability TODO list is implementing inline reply and moderation for the site. A quick survey of our developers is that no one here really is super experienced in writing JavaScript code, so I'm putting a call for help to find someone to help implement and write this. For anyone getting interested in SN development, this appears to be a straightforward task. Here's the official requirements for the feature.

• A user should be able to post and moderate comments without a seperate page load
• If JavaScript is disabled for whatever reason, the site must degrade to the current click-to-post functionality. We don't want to force people to enable JS if they don't wish to. Dynamically rewriting the DOM to change links may be necessary, but this can be discussed
• The rehash API must be extended to add this functionality; this should be relatively easy and straight forward; we have parts of the original AJAX code so this functionality may already be in place.

• Contact me, or paulej72 on IRC, or post a comment below if you're interested in helping.

• Javascript Security Theatre Javascript Security Theatre (Score: 3, Insightful) by kaganar on Thursday June 04 2015, @02:31PM

  by kaganar (605) on Thursday June 04 2015, @02:31PM (#192072)

  Yes, Javascript engines have their fair share of exploits.

  • But so have image decoders, so better not load any images.
  • So has Windows/Linux/PickAnOS, so better not use those, either.
  • And smartphones. Don't use those, either.
  • Come to think of it, phones in general are utterly amenable to wiretapping in almost every country, so... you know.
  • Also, banks are known to fail.
  • Cars are susceptible to numerous fatal issues.
  • I've heard bad things about those vaccines, too, not to mention all medical care.

  The answer to "this can be a dangerous tool" shouldn't necessarily be "let's not use it ever," but there's a certain contingency of people on the web who treat Javascript with that mentality. You don't have to loan your chainsaw to everyone who visits your house or even put gas in it when you do.

  Parent

  Starting Score:	1		point
  Moderation		+1
  Insightful=1, Total=1
  Extra 'Insightful' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		3

• Re:Javascript Security Theatre Re:Javascript Security Theatre (Score: 2) by Immerman on Thursday June 04 2015, @03:12PM

  by Immerman (3985) on Thursday June 04 2015, @03:12PM (#192092)

  The problem with Javascript, is that there's (currently) no convenient way to enable it just for the "good uses". If I enable Javascript for the limited-risk functionality on /., Soylent, etc. the floodgates are pretty much opened for any malicious exploits on any other site I visit.

  It would be nice if you could set your browser to "disable Javascript for all non-whitelisted sites" (presumably with an "enable Javascript for this site" button somewhere convenient), and/or a "Disable unsafe/invasive Javascript" option that would disallow all functions that potentially expose personal information or allow tampering with the PC. If the major browsers all agreed on a "safe function set" we could hope that honest javascript writers would tend to avoid the unsafe functions so that their scripts would run on secured browsers.

  Parent

  • Re:Javascript Security Theatre (Score: 5, Insightful) by maxwell demon on Thursday June 04 2015, @03:50PM

    by maxwell demon (1608) on Thursday June 04 2015, @03:50PM (#192129) Journal

    It would be nice if you could set your browser to "disable Javascript for all non-whitelisted sites" (presumably with an "enable Javascript for this site" button somewhere convenient),

    That's what NoScript does.

    --
    The Tao of math: The numbers you can count are not the real numbers.

    Parent

• Re:Javascript Security Theatre (Score: 2) by maxwell demon on Thursday June 04 2015, @03:23PM

  by maxwell demon (1608) on Thursday June 04 2015, @03:23PM (#192106) Journal

  Yes, Javascript engines have their fair share of exploits.

  The main problem with JavaScript is that you can do bad things using a 100% bug free implementation. That's basically because it's a Turing complete language with internet access.

  I think it would be nice if besides the options of "allow JavaScript" and "deny JavaScript" there would be a third option, "allow a reasonably safe subset of JavaScript".

  But so have image decoders, so better not load any images.

  Only buggy image decoders.

  So has Windows/Linux/PickAnOS, so better not use those, either.

  I wouldn't run an OS that I downloaded from a random web site on the net.

  And smartphones. Don't use those, either.

  Would you rely on the security of a smartphone that a stranger gives you?

  Come to think of it, phones in general are utterly amenable to wiretapping in almost every country, so... you know.

  I think most phones are reasonably secure against wiretapping by random people. The three letter agencies, that's of course another matter. If I wanted to hide something from those agencies, I surely wouldn't talk on the phone about it.

  Also, banks are known to fail.

  Sure. And how is that related to the topic? You don't accidentally transfer your money to a bank by just walking by, do you?

  As the rest gets even more unrelated, I stop here.

  The answer to "this can be a dangerous tool" shouldn't necessarily be "let's not use it ever," but there's a certain contingency of people on the web who treat Javascript with that mentality. You don't have to loan your chainsaw to everyone who visits your house or even put gas in it when you do.

  With JavaScript, the analogy is not that you are using a chainsaw, the analogy is that someone enters your house with a chainsaw. While there are some cases where it makes sense to enter a house with a chainsaw, it is certainly a bad idea to let any random stranger enter your house with a chainsaw.

  --
  The Tao of math: The numbers you can count are not the real numbers.

  Parent