On a related note, I got a pleasent surprise when I opened the Developer Console on Facebook.com: they present you with a giant red warningp[1] and block any code execution in it until you explicitly 'allow [your] account to be hijacked if I paste malicious Javascript'[2]
When you consider Facebook's target audience, it's probably okay to make people like us jump through a hoop in order to stop Grandma from being completely p0wned by typing in some JavaScript.
Yes, maybe people should know that running arbitrary JavaScript is dangerous, but they don't.
Comments
On a related note, I got a pleasent surprise when I opened the Developer Console on Facebook.com: they present you with a giant red warningp[1] and block any code execution in it until you explicitly 'allow [your] account to be hijacked if I paste malicious Javascript'[2]
[1]: http://i.imgur.com/6UVaTen.png
[2]: https://www.facebook.com/selfxss
Facebook blocks the console as it is supposedly used for " exploitation by people to post spam and even used to "hack" accounts"
http://stackoverflow.com/questions/21692646/how-does-faceboo...
When you consider Facebook's target audience, it's probably okay to make people like us jump through a hoop in order to stop Grandma from being completely p0wned by typing in some JavaScript.
Yes, maybe people should know that running arbitrary JavaScript is dangerous, but they don't.
I like what MDN does: https://dl.dropboxusercontent.com/u/9161524/Capture2.PNG
BTW, that warning is starting to drive me nuts.
I did a post about it recently:
http://blog.notfoss.com/posts/mozilla-tabzillajs-easter-egg/