Comment by tlrobinson | Hacker News Reader

Comment by tlrobinson | Hacker News Reader

Not to nitpick, but I feel the need to point out that the "REST interface to memcache server" isn't really REST, since it's issuing non-idempotent commands using GET requests, with the command type and resource specified in the query string.

Also, "Native support for cross-site scripting (XSS) in an nginx" (http://github.com/agentzh/xss-nginx-module)... I don't think XSS means what they think it means. Hint: it's not a feature. http://en.wikipedia.org/wiki/Cross-site_scripting

Still pretty cool though :)

Yeah, that statement in my slides is incorrect :) But the ngx_memc module itself does support true REST interface setup. Please take a look at the samples in its documentation: http://wiki.nginx.org/NginxHttpMemcModule

    GET /foo?key=dog
    
    POST /foo?key=cat
    Cat's value...
    
    PUT /foo?key=bird
    Bird's value...
    
    DELETE /foo?key=Tiger

XSS seems as good a definition as any - everyone's calling it lots of things, JSONP or AJAST or whatever - but setting up data feeds inside javascript function calls specifically to do ajax-Y stuff but getting around the cross-site security model built into xmlhttprequest.

But XSS already has a different specific meaning. Granted it's a confusing definition for exactly this reason, but it's well established to mean a security vulnerability where an attacker can inject JavaScript into users pages thereby stealing their session cookies, etc. It has nothing to do with cross-domain requests.

Reply on news.ycombinator.com