Hacker News Reader

Comment by knieveltech | Hacker News Reader

So is proper namespacing.

Having thought about what you meant... Even with namespacing you still have a global object that can be maliciously overridden or modified

If an attacker is in a position to make malicious modifications 1) You've got a larger problem than optional language features on your hand and 2) locking down a few properties (or the entire object) isn't going to save you.

From your example below: think of one of those ad network scripts (or any other 3rd party script you include on your page) you have no control over what that code is doing. It could override any of your global objects

This is accurate regardless of language features. You can't control 3rd party code. Using generic object names greatly increases the odds that at some point you're going to run into a namespace collision and something important will be overwritten. Proper object namespacing your objects vastly decreases the odds of this happening with benign 3rd party scripts, no additional language features required.

I'm not sure what you mean by that?

Back when I was working for the newspaper industry 3rd party scripts where a constant headache. Due to some severe limitations of the CMS the company used, we where relying on a devil's brew of vendor-supplied js to drive forums, commenting, mail-a-friend and blogging.

This was in addition to all of the script pulled in from ad networks, inline crap that was shoehorned in by a newspapers' own developers, all of our in-house stuff, various frameworks with the usual add-on libraries, analytics, maps....imagine if you will 16 meg page weights on a site with minimal graphics.

Needless to say this rolling clusterfuck of 3rd party javascript meant that at least twice a week a site would go haywire when some random code snippet from an ad network stomped all over one or more critical variables for the commenting system, or analytics would run off into the bushes for no readily discernable reason, you get the idea.

The Solution: aggressively namespace all of the mission-critical scripts we controlled and go heavy on encapsulation. Sure, this lead to god object code smells, but it cut way down on javascript-related site outages.

Reply on news.ycombinator.com