Hacker News Reader

The difference is, I can put custom JS on my Github page and send you a link, when you open it you run code I authored. Developer console is just me running code, and is also on any arbitrary domain on any site.

My understanding of this article was that he pulled off the hack entirely by himself, without having to get someone to visit his page. Maybe I misunderstood.

no difference. but running XSS in console is shooting your leg

What you're referring to is a self-XSS. They were a lot more common back when you could run JavaScript from the address bar.

These days if you try and paste JavaScript to your address bar (try it with: javascript:alert(1);) then the browsers try and stop you. Firefox just won't execute any JavaScript, even if you've manually typed it. IE and Chrome strip the "javascript:" prefix (but Chrome is vunerable if you type "j" and paste the remainder).

More info here: https://www.facebook.com/photo.php?v=956977232793