My Node.js app, or, a simple explanation of asynchronicity and non-blocking IO

you stole 2 hours of my life with this site. So much fun.

After discovering that there's no XSS protection what so ever, the fun really started. I'm still sorry about that location.href='http://microsoft.com, but using a browser with JS disabled, we managed to find out how the script posts the message and were able to fix it that way.

Of course, then the "funny" people began crashing browsers using various methods.

That's when my coworker and I came up with the idea of fixing the hole by patching window.updateMessage, so everyone who was on the site when we were doing that was protected against further attempts at crashing browsers.

Now if we could have XSS protection built-in, this could really be so much fun. The "discussions" going on before the exploiting started all around were really funny.

Nice article, and an interesting combination of technologies! Maybe it's a little bit off topic, but I had a look at http://streethoarding.com/ to see the thing in action. I like the idea and execution (it runs pretty fast; very very simple design; would be interesting to see how well it runs with a huge amount of visitors) and as curious as I am (especially regarding security), the first thing I entered was some JavaScript code. Guess what, no input sanitation :)

Checking out your code it looks like you're just polling (not longpolling)? Instead of just holding the connection open and waiting for a new message you pass the latest message and let the client reconnect. I use node like this (really simplified but still): http://blog.dispostable.com/instant-mail-notifications-using...

streethoarding.com now has quite a few people posting lolcats, JS redirects, JS alerts and random words.

this is based heavily on the node_chat app that _ry wrote as a node example. on github, fyi. i know cause ive used it myself to figure out how node does its thing.