Hacker News Reader

I make no comment on the purpose of this tool, but I strongly recommend serving your Javascript, if not the whole site, under httpS. If you are going to tell everyone to run arbitrary Javascript in the context of their Facebook sessions, at least take precautions that this code will not be modified in-flight.

View on HN

I considered SSL. However, Facebook already serves all of their own pages over plain HTTP, so serving the bookmarklet on HTTPS won't add any security AFAIK.

Please reconsider. Also reconsider serving data from olark.com and, generally, try to reduce your attack surface. There are too many "javascript viruses" running around already.

facebook serves its JS over http already...as does most of the internet. An attacker would just change that js if they had that type of access.

most of the internet doesn't use HTTPS, they use plain HTTP. HTTPS prevents man in the middle attacks...

Reply on news.ycombinator.com