Hacker News new | ask | show | jobs
by arcbyte 1883 days ago
That's very crazy. The fact that you don't think it's crazy is a sign of hoe ludicrous front end development has gotten.
1 comments
jeswin 1883 days ago
If I'm writing say a code editor on example.com, is it "crazy" that I'd want to fetch a list of projects from GitHub.com?

What are you saying?

link
cyphar 1882 days ago
Why do you need to run that on the client? And even if you do need to run it on the client for some reason, GitHub has APIs that you could use which have an allow-all CORS policy (as all APIs do).

CORS is defending against a particular class of attack, which is indistinguishable from the scenario you outlined: evilexample.com wants to get access to your private repos on GitHub (which can be reached purely through GET requests).

link
jeswin 1882 days ago
The post I was replying to seemed to be saying that invoking multiple services from the client is "a sign of how ludicrous front end development has gotten."

> Why do you need to run that on the client?

Because it's a good idea (less wasteful) to do that on the client. Rather than wasting bandwidth rerouting it via my own server.

link