Security Hole via functions in the now pocket? about now HOT 2 CLOSED

Hi skilesare, I'm glad you have been observant but nowjs is NOT vulnerable to the attack described.

Functions are always run on the machine that they are created. So if you change fullname = function(){app = '} and sync that with the server, when the server tries to call it, it'll pass a message through the socket and actually execute the function on the client side where you created it. So your browser javascript would throw an error, not the server.

There is never a situation where the server executes code created on the client or vice versa. We simply pass messages down the socket, execute on that side, and then handle any callbacks that may have been created.

In terms of overwriting things in general, the now scope exists between you and the server. So anything you change on the client side is only changed for your particular scope.

Thanks,
Eric

from now.

Great news! Thanks for clear in this up.

from now.