links page 2 - Dave's Blog

Search
My timeline on Mastodon

Subtleties of postMessage

2013 Jul 15, 1:00

In IE10 and other new browsers one may create MessageChannel objects that have two MessagePorts each connected (w3c spec calls it entangled) to one another such that postMessage on one port results in the message event firing on the other. You can pass an array of ports as the last parameter to postMessage and they show up in the ports property of the message event arg.

Origin

The postMessage here is like the worker postMessage and unlike the window and iframe postMessage in that it applies no origin checking:

  1. No origin postMessage in workers and MessagePorts: postMessage(messageData, ports)
  2. Origin postMessage in windows and iframes: postMessage(messageData, targetOrigin, ports)

Unfortunately the origin isn't an optional parameter at the end to make the two postMessages have the same signature.

On the event handler side, the event arg always has an origin property. But in the no origin case it is always the empty string.

Source

There is also a source property on the message event arg which if set is an object that has a postMessage property allowing you to post back to your caller. It is set for the origin case, however, in the no origin case this property is null. This is somewhat reasonable because in the case of MessagePort and Workers there are only two endpoints so you always know the source of a message implicitly. Unlike the origin case in which any iframe or window can be calling postMessage on any other iframe or window and the caller is unknown. So not unreasonable but it would be nice if the source property was always set for consistency.

MessageChannel start

When a MessageChannel is created it has two MessagePorts, but until those ports are started they will queue up any messages they receive. Once started they will dispatch all queued messages. Ports don't have to be started to send messages.

A port may be started in two ways, either by explicitly calling the start method on the port, or by setting the onmessage callback property on the port. However, adding an event listener via addEventListener("message", does not start the port. It works this way in IE and Chrome and the spec states this as well.

The justification is that since you can have only one callback via onmessage that once set you must implicitly be ready to receive messages and its fine to start the port. As opposed to the addEventListener in which case the user agent cannot start implicitly because it doesn't know how many event listeners will be added.  I found Hixie stating this justification in geoloc meeting notes.

Links

W3C Spec

Opera introduction

PermalinkCommentsDOM html javascript postMessage technical web-worker worker

laughingsquid: Testing People’s Reaction Times With a Ruler in...

2013 Jul 5, 3:05


laughingsquid:

Testing People’s Reaction Times With a Ruler in Super Slow Motion

PermalinkCommentsbrain science video speed time humor

laughingsquid: How Common Is Your Birthday, A Chart of Birth...

2013 Jun 10, 2:49


laughingsquid:

How Common Is Your Birthday, A Chart of Birth Date Frequencies

PermalinkCommentsbirth-day chart

laughingsquid: The Ultimate Spaceship Face-off, Interactive...

2013 May 22, 3:10


laughingsquid:

The Ultimate Spaceship Face-off, Interactive Guide For Comparing the Speeds of Famed Sci-Fi Ships

PermalinkCommentssci-fi scifi tardis doctor-who star-trek star-wars nerd

laughingsquid: Arrested Development Season 4 Trailer Brings...

2013 May 13, 2:47


laughingsquid:

Arrested Development Season 4 Trailer Brings Back the Dysfunctional Bluth Family

Come on!

PermalinkCommentshumor trailer arrested-development awesome

laughingsquid: Time Travel in Movies Flowchart

2013 Apr 15, 3:41


laughingsquid:

Time Travel in Movies Flowchart

PermalinkCommentstime-travel movies chart movie bttf

laughingsquid: Tetris Stackable LED Desk Lamp

2013 Apr 13, 12:57


laughingsquid:

Tetris Stackable LED Desk Lamp

PermalinkCommentstetris lamp game humor

laughingsquid: An ‘American Psycho’ Parody Starring Huey Lewis...

2013 Apr 4, 5:33


laughingsquid:

An ‘American Psycho’ Parody Starring Huey Lewis & Weird Al

Hey its the high school band audition judge from Back to the Future.

PermalinkCommentshumor weird-al huey-lewis american-psycho video

laughingsquid: Two-Year-Old Picks the Lock to His Sister’s Room...

2013 Mar 28, 3:30


laughingsquid:

Two-Year-Old Picks the Lock to His Sister’s Room and Steals Her Toys

PermalinkCommentshumor child video

laughingsquid: Everybody Wants to Kill Bruce Willis, An Action...

2013 Mar 26, 7:47


laughingsquid:

Everybody Wants to Kill Bruce Willis, An Action Movie Mashup

PermalinkCommentshumor video bruce-willis

laughingsquid: ‘Veronica Mars’ TV Show Attempts to Make a Film...

2013 Mar 13, 11:38


laughingsquid:

‘Veronica Mars’ TV Show Attempts to Make a Film Via Crowdfunding

PermalinkCommentsveronica-mars movie kickstarter

laughingsquid: New & Necessary Punctuation Marks

2013 Feb 25, 9:01


laughingsquid:

New & Necessary Punctuation Marks

PermalinkCommentshumor punctuation internet

laughingsquid: The Truth About Phones on Airplanes

2013 Jan 7, 11:57


laughingsquid:

The Truth About Phones on Airplanes

PermalinkComments

laughingsquid: Stick-N-Find, Tiny Bluetooth Stickers Help You...

2013 Jan 4, 5:35


laughingsquid:

Stick-N-Find, Tiny Bluetooth Stickers Help You Keep Track of Things

PermalinkComments

laughingsquid: Blind Man Shows How Blind People Use Instagram

2013 Jan 4, 5:34


laughingsquid:

Blind Man Shows How Blind People Use Instagram

PermalinkComments

Windows Remote Desktop via Internet

2012 Dec 7, 2:04
To setup my home Windows dev box to be accessible from outside I followed two main steps:
Last time I had to do this there was a service named dynamicdns.org which seems to still exist but no longer appears to be free. Instead I used dnsdynamic.org which is free and has a web API as well as links to and instructions for setting up native tools to dynamically update my IP address.
PermalinkComments

laughingsquid: Solitaire.exe, A Real Deck of Cards Inspired by...

2012 Nov 19, 4:56


laughingsquid:

Solitaire.exe, A Real Deck of Cards Inspired by the Windows 98 Solitaire PC Game

PermalinkCommentshumor solitare game cards windows

laughingsquid: Windows 95 Tips, Tricks, and Tweaks Some very...

2012 Nov 14, 5:39


laughingsquid:

Windows 95 Tips, Tricks, and Tweaks

Some very H. P. Lovecraft style redesigns of some classic Win95 UI.

PermalinkCommentshorror humor windows windows-95

DSL modem hack used to infect millions with banking fraud malware | Ars Technica

2012 Oct 1, 6:33

According to the links within this article, although the root URI of the router requires authentication, the /password.cgi URI doesn’t and the resulting returned HTML contains (but does not display) the plaintext of the password, as well as an HTML FORM to modify the password that is exploitable by CSRF.

The attack… infected more than 4.5 million DSL modems… The CSRF (cross-site request forgery) vulnerability allowed attackers to use a simple script to steal passwords required to remotely log in to and control the devices. The attackers then configured the modems to use malicious domain name system servers that caused users trying to visit popular websites to instead connect to booby-trapped imposter sites.

PermalinkCommentstechnical security html router web dns csrf

laughingsquid: hi-Call, A Bluetooth Handset Glove

2012 Sep 26, 6:24


laughingsquid:

hi-Call, A Bluetooth Handset Glove

PermalinkCommentshumor phone cell-phone blue-tooth video
Older EntriesNewer Entries Creative Commons License Some rights reserved.