Which doesn't run arbitrary JS code, unlike the username.github.com pages, which... | Hacker News

Hacker Timesnew | past | comments | ask | show | jobs | submit

		Groxx on April 5, 2013 \| parent \| context \| favorite \| on: New GitHub Pages domain: github.io Which doesn't run arbitrary JS code, unlike the username.github.com pages, which means gist.github.com is incapable of setting such cookies. Unless there's a way to 'run' gist files? I'm not aware of any, but I haven't tried particularly hard.

LukeShu on April 5, 2013 [–]

He means that if they set cookies to only apply to the root, then you will have to log in to gist.github.com and github.com separately. Taking access away from the un-trusted code also means taking it away from some trusted code.

Groxx on April 5, 2013 | [–]

Aaah, d'oh. Makes sense in retrospect :) thanks!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact