WARNING: This server is unstable and will be retired in the next days.
If you want to keep this forum available, please request immediately a migration
on the Nabble Support forum.
Forums that don't receive any migration request will be deleted forever.
'Avoid “this”. Use closures rather than prototypes'
Probably the public was stunned by that one... (technical problems
too, could not hear the video, just saw the slides)
Not really. I expected more resistance than I got. During the 20 minutes of lively Q&A, this came up again. I clarified then something I should have said earlier in the talk. The objects that need to be defensive are those that might be exposed across a trust boundary, such as the counter in the first example. For objects purely inside one trust domain, given that we really are confident they cannot escape, they do not need to be defensive since their clients are all presumably intimately cooperative.
Technically for the purpose of your presentation, it is correct, but
I am coming back again to real life, you are using strict mode and
other means (such as questionnable setTimeout(xxx,0)) to secure Bob.
Then what is the use of Bob if he can not do anything outside of
Please do make an effort to surmount whatever technical difficulties you encountered, so that you can listen to the audio of the presentation. The slides were not constructed to be self explanatory, and the talk was clear on this point.
A much more trivial security leak could be that the calling context
does somewhere unexpectedly (or not) something like
counter.x.y.z=window (Ex : like passing a node to Bob since it seems
that Bob has to do some stuff with the dom to be usefull)
The difficultly of emulating the dom faithfully in JS was also the original impetus for the proxy work. The Domado library above does not rely on proxies, as they are not yet as available as ES5.
It's the same issue as multiple globals (if the concept of globals
still exist in the future) I believe : how to separate completely
several contexts while using objects between each others ? Looks
I might be wrong, but on what today's examples the demonstration
here could apply without Bob being useless or just returning
something like a mathematical calculation or such not touching
anything in the page ?
I'm sorry, I didn't understand these last two paragraphs. Could you clarify?