What JavaScript is Not Allowed to Do in the Browser

JavaScript in the browser is not normally allowed to do too much for security reasons.  

Stuff it cannot do includes anything OS related - specifically:

• Cannot read/write arbitrary files
• Cannot access hardware directly
• Cannot control processes

JavaScript can do certain things through Web APIs:

• DOM manipulation (HTML/CSS)
• Local/session storage
  
• IndexedDB (database built into the browser)
• Cookies (with same origin)
• Clipboard (with user permission)
• Geolocation, camera, microphone (with user consent)

The Same Origin Policy (SOP) on Modern Web Browsers

The Same Origin Policy (SOP) is a browser-enforced security rule that prevents scripts from one "origin" (PDP -> protocol + domain + port) from accessing resources from another origin.

The SOP prevents cookies, DOM and local storage from being read by malicious cross-site scripts.

The SOP does not just apply to web browsers. For example, Electron apps (desktop apps built with web tech) enforce SOP because they embed Chromium.

The Same Origin Policy is an "isolation model" designed to ensure "secure workflow".

Technology designed to integrate into browsers (e.g. WebAssembly) generally respect the existing SOP.

What's New in IE11

IE11 includes the so-called "F12 Developer Tools". It includes the DOM Explorer which includes expand and contract functionality on HTML nodes. It also includes a Debugger and Profiler.

JavaScript, CSS3 and HTML5 Could be the New Silverlight Slash De-Facto RIA Replacement

Critics say HTML5 will destroy Silverlight but this is only a half-truth.

Many Silverlight aficionados will not change the good habits they have learned writing MVVM applications for the web, and may instead adapt their skills to new JavaScript/HTML5 frameworks that borrow style and structure from the Silverlight world. So Silverlight will still live, even when all the Silverlight applications are gone.

Now the web developer must face the necessity to be familiar with at least one JavaScript framework such as Angular or Knockout. JavaScript graphics libraries such as Raphael and Bonsai, too, will become useful.

As an example of "Silverlight-similarity" amongst these frameworks, read about how data binding is done in Angular, to transform HTML and make it more XAML-istic.

IE7 is already in the History Books

Many modern websites (e.g. force.com) have no support for IE7. IE8 is built from the ground up. It passes the Acid2 browser test (documented on the Web Standards Project website), IE7 fails. This shows IE7 has poor web standards compliance! Acid2 tests support for so-called "data URLs" (RFC 2397).

IE8 also introduces some web security-oriented features. Some of these are MS-specific (e.g. restrictions on ActiveX controls) whilst others are more wide-ranging (e.g. relating to cross-site scripting (XSS)).

To understand web security, a good resource is OWASP (Open Web Application Security Project) whose mission is to "make software security visible".

A Serverless Wiki on Windows

I began looking into serverless wikis when my server-based wiki at work crashed. I figured a server-less wiki would be a more robust, controllable way to store my information. Thus I discovered TiddlyWiki, a serverless JavaScript wiki implementation. TiddlyWiki is amazing because it's a single HTML file. Stick it into Visual Web Developer (or Visual Interdev - the keyboard shortcuts are the same), hit Cntrl-Alt-T and navigate the Document Outline. Here's a quick run-down of the TiddlyWiki source code. The head of the document contains a hashtable of title and version data, followed by copyright and content-type META tags. Next comes a CSS STYLE tag. The second last SCRIPT tag defines the config hash-of-hashes detailing configuration information for the wiki page.