simonbrown

Someone trying to find an exploit is a bigger problem than giving them one?

They do.

http://www.joelonsoftware.com/items/2006/08/01.html

http://skilldrick.co.uk/2010/09/why-javascript-is-awesome/

What do you use now?

I know. My point was that this isn't a good justification to remove the public folder, as people could always put HTML files there and it was safe to do so.

You can put HTML files in public folders. Files in public folders are loaded on a separate domain.

The options dialog changed to a page at some point, and the page has now been redesigned. I would class both of those as pretty big, though most users probably don't use it.

Is there a good free/paid webmail service that can be used with a custom domain and has good security? As far as I know, GMail can only be used with a custom domain if you convert your account to Google Apps, which prevents you from using some Google services.

Or a hash attribute to file and script tags. Of course, either case would mean redment wouldn't be able to update it.

Using Google CDN places no more trust in Google than using Google Analytics or AdSense. Unless your site handled sensitive data or is mission critical, I believe it's reasonable to trust Google not to do anything malicious.

It's worth noting that the same issue exists with Chrome extensions. I wonder how strong a Google password the authors of popular Chrome extensions have.

How many webapps are installed by non-technical users? I guess for scripts (Wordpress, phpbb, etc.), PHP is the best option for this reason, as they have thousands of installations, but most webapps only have a few.

Good until they change.

Does the "embed options" button ever give more than a link? It seems a bit pointless as it is, as you can just copy that from the address bar.

Also, is there any approval process? If not, I think people should have to register to submit, have a "vouch" button, or something, so we know who we're trusting.

Finally, when all the fields in the submit form have validation errors, the submit button disappears.

While we're suggesting games, Go could be interesting.

https://en.wikipedia.org/wiki/Go_(game)

As far as you know.

You could use the page visibility API to wait until the page is visible before loading the analytics code.

https://developers.google.com/chrome/whitepapers/pagevisibil...

This is only for prerendering. I think joshuahedlund is right about prefetching.

Surely it takes away any incentive of the original producers to innovate if the product is quickly cloned (even under a different name) and sold at close to break even point, leading consumers to buy the cheaper one (and perhaps even wait for it to arrive), preventing the producer from even recouping their R&D costs?

Europe doesn't care about IP laws to the same extent as the US?

That doesn't tell me how much money Google makes from it, if any.

> Imagine how disconcerting it would be if medical or law school graduates couldn't get jobs as doctors or lawyers, respectively.

The latter happens.

http://www.huffingtonpost.com/grace-nasri/law-schools-feel-t...

I'm not sure about the US but the former happens in the UK:

http://www.telegraph.co.uk/health/healthnews/9274753/Up-to-1...

Perhaps not to the same extent, though.

Source?

I can't reproduce it (perhaps because I don't have a Facebook account).

He ruled that out (though not intirely) by the fact that a previous page was appropriated and Facebook notified him. Also, if that were the case it would have probably been redirected/converted to an official page.

I don't see how you can draw the conclusion that companies shouldn't produce TV shows (I assume that's what you mean by industrial production of culture).

Edit: They have now emailed him, but I doubt it was the same kind of email he was sent before, since it doesn't mention a company.

Is it? From my understanding, he only needs to give the full source (with a GPL license) to people he's distributing the binaries to.

> I have no idea how this would translate into the world of Windows though.

Spend an hour downloading Visual C++ Express (assuming it works in express, otherwise buy the professional version). Try to fix any build errors (not an easy task if you're not a programmer). Install NSIS and any installer dependencies. Make sure the binary is in the right place. etc.

Or worse, they bundle it with malware/adware.

Or just tell them to switch tabs. Another sign is that if a dialog was actually showing, the browser window wouldn't look focussed.

e.g. on Windows the browser looks like this:

http://i.imgur.com/nbn9K.png

instead of this:

http://i.imgur.com/7F3FD.png

Well, you can already do that through extended validation. I'm not sure requiring it would be desirable, and doing this would need a better reason than it being better than nothing.

The philosophy of HTML5 seems to be allowing applicants to do a lot of things which don't require much trust to be placed in them (and most applications don't need much), rather than security through asking the user's permission (e.g. most desktop OSs), when they are unlikely to have much idea which developers they should trust, or through accountability/review (e.g. iOS), which adds barriers to entry.

You could get a hosting account (e.g. NearlyFreeSpeech or S3) and hotlink to them. I guess people don't often intentionally click ads when downloading files, unlike viewing images, so setting up a free file host isn't profitable.

But it definitely proves the positive.

Any time you need the user to drag their mouse or double-click and don't want selections getting in the way. e.g. drag and drop