HN Explorer

17 comments

[ 3.1 ms ] story [ 52.3 ms ] thread
gitgud
This looks very useful, but it does concern me that this is even possible. Simply starting chrome with a `--remote-debug` flag allows you to run JavaScript in any tab? seems like it could easily be exploited somehow; read passwords, copy userinfo etc.
parhamn
> Simply starting chrome with a `--remote-debug`

I wouldn't call that "simple". Sounds like fine behavior given non-devs generally don't even know how to run Chrome with custom flags and developers know that remote debugging generally means remote execution with data/memory access. Would you prefer a better flag name or lock remote debugging to a subset of tabs?

gitgud
That's true, I suppose as long as there's indication that the mode is enabled, a warning or something (haven't tested it myself yet).

If the desktop launcher was modified to include that flag, then you would never know while browsing right? Maybe I'm just paranoid...

nerdponx
I'm not a security expert, but if you are at that point that I suspect you have bigger problems than start up flags being modified
snorrah
Yeah this is a non issue. It’s like any dev environment letting you overrule things by supplying an environment variable or similar.
vortico
Remember that if you have access to run a shell command, you have access to rm -rf /*.
gitgud
Yes true, the chrome flags are the least of your problems then!
ivan4th
I wrote a somewhat similar tool for use with Emacs many years ago, SwankJS: https://github.com/swank-js/swank-js See this demo, for example: http://emacsrocks.com/e11.html It was not dependent on Chrome features and even did work with IE6 at some point. Too bad REPL-based programming is not very useful for modern JavaScript. There's a successor, though: https://github.com/skeeto/skewer-mode
drhodes
have you seen indium?

https://github.com/NicolasPetton/Indium

It can connect to both chrome and node, it has REPL and a step debugger like cider/clojure, with quick (good ui) for object introspection. (also supports company mode!)

adriancooney
This looks pretty slick, looking forward to giving it a shot. It’s nice to see Sublime get a bit of love too in the age of Atom and VS Code. The Snippets tab under the Sources section of the Dev Tools has worked well for me in the past too.
donquichotte
While this looks awesome, it runs really slow for me. From sending a command in Sublime to the actual execution, it takes me > 1s. This is on Windows 10, Sublime Text 3, Chrome 66.

EDIT: if I install chromeREPL, it takes ages to open the command palette (CTL+Shift+P). If I uninstall it, the problem disappears.

joelthelion
Is there something similar for Firefox?
shabble
There used to be MozREPL: https://github.com/bard/mozrepl but it never made it over the webextension/quantum changeover.

I haven't yet found a replacement, although I haven't been looking very hard recently.

skratlo
ClojureScript has this for ages (see Figwheel + Emacs + CIDER)