News for hackers. Stuff that matters.

A comment on Why does Google prepend while(1); to their JSON responses?. Parent comment

Re:Why does Google prepend while(1); to their JSON responses? by amenghra on Saturday May 06, 2017 @06:13PM (#14282544)
If you are browsing the web with a 10 year old browser you are opening yourself up to a ton of security bugs. Whether json responses contain a while loop or not isn't going to make a difference.

The reason Google and Facebook keep this kind of stuff around is because it's there and doesn't hurt to keep it. There's a slight chance it will provide some protection if a similar attack vector is discovered.

[ Parent | on HN ]
Re:Why does Google prepend while(1); to their JSON responses? by Roodgorf on Sunday May 07, 2017 @12:10AM (#14283799)
But aren't you saying this is an already existing attack vector then?? Why try to find a similar one if you knew you could just get an older browser version and use this one? Is that not a good enough reason to be prepared for it?
[ Parent | on HN ]
Re:Why does Google prepend while(1); to their JSON responses? by hcs on Sunday May 07, 2017 @12:38AM (#14283891)
As sagethesagesage said [1], you're protecting the user from having their browser pass the user's data from your site to a malicious site. The attacker shouldn't be able to make the user run an old, vulnerable browser.

[1] https://news.ycombinator.com/item?id=14282532

[ Parent | on HN ]