Facebook monitors your alert() usage

cschneid · on July 16, 2009

I don't know if this is why they have that, but that would make a pretty decent approach to restricting and slowing down XSS type attacks, if you can override and protect all the native built-in functions.

It should be easy using log analysis to then notice spikes in usage of something, and investigate.

I'm sure there are flaws in my idea, but I think it might work as part of a defense in depth approach.

mustpax · on July 16, 2009

The fact that they're passing the data back with an image tag instead of an XHR request also suggests the same to me.

If this was some leftover debug code, I wouldn't expect it to be that sneaky.

ashleyw · on July 16, 2009

Speaking of which, I wonder how much time developers worldwide waste by having to manually click OK on alert windows to continue execution? I much prefer console.log();

litewulf · on July 16, 2009

(You don't necessarily always have access to console.log though...)

ahoyhere · on July 16, 2009

There's no reason not to - Safari / WebKit's Inspector is API-compatible with Firebug's console object, and there's always Firebug Lite for other browsers.

jacquesm · on July 16, 2009

For plenty of things GUIs are not the way to go. I know I'm showing my age with this, but the command line / batch environment is so much more productive for many tasks than a GUI based environment.

teej · on July 16, 2009

When ashleyw mentions console.log(), I believe they are talking about Firebug's javascript based logging system.

jacquesm · on July 16, 2009

hehe, yes, I see that now :)