Feed Sign in with OpenID OpenID

Simon Willison’s Weblog

Module Pattern Provides No Privacy... at least not in JavaScript(TM) (via) JavaScript variables hidden inside a closure aren’t as hidden as I thought—it turns out you can pass a closure as the second argument to eval (at least in Firefox) and “steal” private variables back out of it.

Tagged , , , ,

2 comments

  1. Maybe the important thing in any programming language is to discourage bad practices, rather than going out of your way to forbid them absolutely. To quote from "Programming Perl",

    "A Perl module would prefer that you stay out of its living room because you weren't invited, not because it has a shotgun."

    Angus M - 28th June 2008 02:21 - #

  2. Trying to prevent people from frobbing your code seems like a rather Sisyphean task. Are folks actually trying to secure data using the Module pattern?

    If not, it seems like this is one place where I would agree with GvR. We're all adults here, please don't come crying when your code breaks because it calls implementation APIs.

    Adam Keys - 29th June 2008 23:21 - #

Comments are closed.
A django site