Path: csiph.com!feeder.erje.net!2.eu.feeder.erje.net!news.mb-net.net!open-news-network.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: JavaScript code security
Date: Fri, 23 Jun 2017 10:53:16 +0200
Organization: PointedEars Software (PES)
Lines: 54
Message-ID: <11797668.dW097sEU6C@PointedEars.de>
References: <58a53166-53fb-4974-9264-d73f26a0a549@googlegroups.com> <9817aa91-22fd-4064-980c-c872fe530dd3@googlegroups.com> <cb7fe530-be69-4666-a229-2bfb420d4855@googlegroups.com> <87poezuiyc.fsf@bsb.me.uk> <ac0124ee-ead4-4bc9-91a8-c0d8cb16d673@googlegroups.com> <XnsA77F5D895B25Aeejj99@194.109.6.166> <5d5b9191-f328-48c2-906b-2cc714dbb2d9@googlegroups.com> <q9roic5gnv0duoub6t91an6cjrccktns7g@4ax.com>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
NNTP-Posting-Host: 177.225.197.178.dynamic.wless.zhbmb00p-cgnat.res.cust.swisscom.ch
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8Bit
X-Trace: gwaiyur.mb-net.net 1498207998 1146 178.197.225.177 (23 Jun 2017 08:53:18 GMT)
X-Complaints-To: abuse@open-news-network.org
NNTP-Posting-Date: Fri, 23 Jun 2017 08:53:18 +0000 (UTC)
User-Agent: KNode/4.14.2
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
Xref: csiph.com comp.lang.javascript:33562

Wally W.  wrote:
^^^^^^^^
Your real name belongs there.

> On Wed, 24 May 2017 05:56:37 -0700 (PDT), justaguy wrote:
>>On Wednesday, May 24, 2017 at 3:11:53 AM UTC-4, Evertjan. wrote:
>>> I can imagine some clever ways clientside code can provide a low level
>>> of such security, but only with the help of serverside code, like
>>> one-time values of hidden <input>s.
>>
>>All right.  I'm going with the best practice of server side data
>>validation now.  Thanks.

JFTR: These approaches are not mutually exclusive.  In fact, the best 
server-side validation framework will also generate adequate client-side 
validation code.
 
> […]
> That is where scripting belongs -- not in my browser, especially for
> navigation.

You are mistaken; at best, you are out of touch.
 
> Does it cost more server machine cycles to:
                    ^^^^^^^^^^^^^^^^^^^^^
> 1) Run a server-side script, or
           ^^^^^^^^^^^^^^^^^^
> 2) Spew all the javascript (including multiple browser detection
> tests, only one of which is applicable per visitor) to each client
> machine?

1).  That was easy :)

Besides, there is no “javascript”.

And although “multiple browser detection tests”, and “browser detection 
tests” in general, do not have to be served by the same server, they are not 
only unnecessary; they are, with few exceptions, *unwise*.

We have discussed this here /ad nauseam/.  You should learn about a topic 
before you comment on it.
 
> How much internet bandwidth is wasted through the inefficient sending
> of scripts to client machines?

Difficult to say.  However, scripts do not *have* to be sent *inefficiently* 
to client machines, and there is also “internet bandwidth […]” and “server 
machine cycles” “wasted” by unnecessary roundtrips to servers.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.