Hacker News Reader

HN sets one cookie and that is "httpOnly" and "secure", so it can't be read from JavaScript. You can test this yourself by typing document.cookie into your console, it should return an empty string.

Given that it takes about 20seconds to read through the snippet, not easily ;-)

I'm trying to do this in Firefox 98.0 and I'm not able to. I see this in the console:

> Scam Warning: Take care when pasting things you don’t understand. This could allow attackers to steal your identity or take control of your computer. Please type ‘allow pasting’ below (no need to press enter) to allow pasting.

Oh now that I'm reading it carefully, I see there's a way to enable it!

UTF-encode the maliscious snippet and disguise it as the regex pattern haha

Doesn't UTF-8 just give you the exact same letters, since it's already ASCII?

I think it was meant to be UTF-8 escape codes, as in \u0000 etc.

Ahh that makes sense, thanks.

Pedantry: These are really Unicode escape codes not UTF-8 escape codes, since they're codes for Unicode code points. You can write invalid UTF-16 with these escapes (because unlike UTF-8 the UTF-16 encoding actually borrows Unicode code points that are not scalar values, called the "surrogates") but I don't know what the standard says should happen if you do that.