News for hackers. Stuff that matters.

A comment on Reading privileged memory with a side-channel. Parent comment

Re:Reading privileged memory with a side-channel by jeremyjh on Thursday January 04, 2018 @01:03AM (#16068377)
It wasn't common practice, but fully Javascript rendered applications were a thing as early as 2001. That was when my company developed the first one that I know of. It was a godawful ugly pig but it worked.

Most sites did nothing like that, but they did use Javascript and would break in various ways without it. At that time, there were a lot of people admonishing web developers to test their applications with Javascript disabled. Sort of like now.

ETA: I had to look it up - XHR was first available in IE 5 as an ActiveX control. The internet at large couldn't really expect it to be available but I believe that is where we first used it.

Initial release: March 18, 1999; 18 years ago

[ Parent | on HN ]
Re:Reading privileged memory with a side-channel by vanviegen on Thursday January 04, 2018 @03:08AM (#16068722)
Before XHR, there was an iframe trick that could be used to the same effect. We were abusing that to do streaming updates (stalling requests until the server had new data) on then likes of IE5 back in 2004. WebSocket eat your heart out! :-)
[ Parent | on HN ]
Re:Reading privileged memory with a side-channel by jerrycruncher on Thursday January 04, 2018 @02:22PM (#16073231)
I'm not denying that the technology was sort of there (especially/only if you were writing a corporate app that targeted one and only one browser, probably as a replacement for an in-house VB/WinForms app). My point, which you mostly reinforced, was that it was not at all common for a user opting not to enable javascript to see a completely broken public-facing site until relatively recently.
[ Parent | on HN ]