- Your tab freezes due to an infinite loop for a while until your browser notices and asks you if you want to kill the script.
- The script downloads illegal content, and your ISP notifies authorities.
- CSRF attack against a site you're signed into that's not properly secured.
All of these things are things any site you go to can do. There's nothing special about `eval` that makes this site more dangerous.
Most people have no clue what they're running and can't possibly take the time to know enough to really have a clue.
Of course, if you’re running 3rd party ad scripts on your actual page, you’re at their mercy.
https://www.trendmicro.com/vinfo/vn/security/news/cybercrime...
Stack overflow is heavily moderated. I think it'd be a challenge to put something malicious on there which lived for more than an hour or so.
Compare that to your run of the mill PHP shared hosting. I know which side I'd rather take my chances with.
And you've only been here for a few weeks so I'll give you the benefit of the doubt, but calling something "unintentionally...hilarious" is usually taken as just another way of calling someone an idiot. I'd suggest you try to find ways to make your point without deriding those who don't share your view, especially on something so inconsequential.
I do; a random SO answer will be miles better than anything coming out of an average organisation.
To write an SO answer, you need to actually care about answering SO questions. To write code in an average company, you need to... have a pulse, it seems.
The way you would do this is create an answer to one of these questions on stack overflow that includes malicious javascript.
However, it's kind of unlikely there is much you can do with it. Sometimes a site will share cookies with subdomains, but this is not likely for github because you are allowed to publish arbitrary js there, so that would be a huge security hole.
The risk of eval() is giving control of the site data of foo.github.io to the author of a stackoverflow comment.
The warning is part of the fun, though.
http://homakov.blogspot.com/2013/03/hacking-github-with-webk...
I'm curious whether the multiple warnings about running untrusted code in the browser are necessary. I feel like all websites are already untrusted code, and the browser is quite well sandboxed and protected from anything too bad happening. What is the worst case scenario here for the user within the JS ecosystem, under known avenues of attack, not counting an unknown zero day browser exploit?