AcrossTabs
Languages and libraries
javascript library
SHOW HN2017
How HN took it
3 positive, 8 neutral or asking, 1 mixed, 5 critical, out of 17 comments about the project. Thread score -0.03.
Privacy: 0 for, 4 againstIdea: 3 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for iframe and tab communication patterns
From 1 comment
This is great. I found this pattern very useful when communicating with iframes. I wrote a similar library a while back. https://github.com/taylorhakes/postmessage-plus
ggaahh on HN
Saves time versus building a similar library
From 1 comment
I had something very similar to this in my backlog, as a weekend project. Glad to see someone else beat me to it - saves me time in both implementation and maintenance! I look…
ssalka on HN
Objections
Default origin of * is unsafe and invites security mistakes
From 3 comments
Looks like a nice library, though using a default of `*` for Origin seems like an invitation for people to shoot themselves in the foot.
mnarayan01 on HNThen don't have a default that works without doing so. Really, defaults like this lead to "works, ship it" and totally unnecessary cases of vulnerable software.
detaro on HNDon't use unsafe defaults ffs, that's how things get exploited.
deadbunny on HN
Cross-tab communication is a security risk if receivers do not check origin
From 2 comments
I was puzzled when I first saw cross tab communication in impress.js for their slide control tab (slid.es) and I am still wondering about the proper use case of this feature…
tiplus on HNIt maps back to window.postMessage. There's a security concerns section on Mozilla's docs: https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage All boils down the…
tyingq on HN
Requests
Make origin a required parameter instead of defaulting to *
From 2 comments
Yes, a required argument. It's not uncommon. Think API keys.
tokenizerrr on HNSecond this. A lot of developers will just drop it in without reading the caveats. Just make the origin a mandatory parameter.
Karupan on HN
Put wildcard origin behind a long-named setter or default to current domain
From 2 comments
Put the wildcard functionality behind a setter with a long name and make the default the current domain?
cryptarch on HNPut it behind a setter with "doNotUseOrYouWillBeFired" in the function name.…
Bartkusa on HN
Questions
What real-world use cases does this solve?
From 1 comment
I think I understand what this does, but I don't think I understand the use case. Does anyone have any real-world examples of where this helps?
martin-adams on HN
Alternatives named
BroadcastChannel API (same origin only)
From 2 comments
Chrome and Firefox support BroadcastChannel https://developers.google.com/web/updates/2016/09/broadcastchannel https://developer.mozilla.org/en-US/docs/Web/API/BroadcastChannel
zspitzer on HNthis works for same origin only.
gauravmuk on HN
window.postMessage
From 1 comment
It maps back to window.postMessage. There's a security concerns section on Mozilla's docs: https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage All boils down the…
tyingq on HN
postmessage-plus
From 1 comment
This is great. I found this pattern very useful when communicating with iframes. I wrote a similar library a while back. https://github.com/taylorhakes/postmessage-plus
ggaahh on HN