Hacker News Reader

Comment by pearjuice | Hacker News Reader

Homakov, I like your posts, audits and the like but I really suggest you ask someone to review them before publishing because for the life of me I cannot comprehend what you are writing most of the time.

View on HN

That's definitely what I'm working on. If you wanna make your eyes bleed check out my old posts ;)

Any corrections are welcome at homakov@gmail.com.

It's simple really if you understand what's going on. iframe code can access `frames[0].document` cross domain. Clicking on the link within Google Translate iframe modifies target page on another domain. curl http://homakov.github.io/guc.html

If that were true it would be a major security vulnerability. ;-)

The Google Translate content is served up from a subdomain of googleusercontent.com. This is a domain designated by Google for user-supplied content so that it can be rendered without affecting the safety of pages on google.com and elsewhere.

The demonstration here is that one page on googleusercontent.com can affect another page on googleusercontent.com. This is perfectly acceptable via the same origin policy.

I think glebm implies the same: "iframe code can access `frames[0].document` cross domain" means through translate.google.com and "modifies target page on another domain" modifies page with same domain but rendered on another domain

I think his posts are just fine considering that English isn't his first language and his relative lack of years in English-speaking countries.

Reply on news.ycombinator.com