creator here. sorry, i did not expected to be hn'ed. not running js is usually a good idea though!

The results never leave your browser, though, so there's not much to worry about.

The JS code sent to kentonv's browser might be safe, but you can't really meaningfully comment on hobs' situation, since you don't have a copy of the JS code that was sent to hobs' browser.

Actually I can. The author of this code is a friend of mine who works with the EFF, and the idea that she's secretly sending malicious scripts to some people but not others from her MIT web hosting space under her own name is simply not plausible.

Unless, she's already compromised your browser and the two previous comments are in fact placed by her!

In all seriousness, I appreciate the added context your (particularly this last clarifying comment) add to the discussion.

> The JS code sent to kentonv's browser might be safe, but you can't really meaningfully comment on hobs' situation [...]

But if that's the case then you shouldn't click on anything on HN.

I would argue that it is A-OK to post this link directly on hackernews.

It just says "look at what your browser can do! imagine if blackhats took advantage of this."

In any case, I didn't minify or remove comments, so you can just view-source:http://zyan.scripts.mit.edu/sniffly/index.js

That is what I thought about my browser history.

While I probably would have linked HN to the slides instead of the site, I do think calling it an attack site is paranoid and disingenuous.

Does the term "example attack site" not mollify that a bit? I tried to be clear that its not a real attack site (or my comment we be much more alarming) but something that executed malicious behavior, even if it wasnt from a malicious actor.

Wasnt looking to castigate the author, just looking for a title with a warning.

Honest question: what is your concern?

Any link you click could possibly contain a hidden attack, perhaps a malicious one.

If this link had been labeled differently, would you not have clicked?