Rendered at 16:15:07 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
giancarlostoro 2 hours ago [-]
Pretty sure it always autosaved so this makes sense to me? I always assume it would send my data over to their backend, its code that ends up there regardless?
maxim-fin 2 hours ago [-]
Yes, that is for autosave and for rendering
Edit: The point is that any secrets typed/pasted in there should be considered compromized
giancarlostoro 52 minutes ago [-]
I don't know why anyone would paste or type secrets into codepen which is public by default... But it always seemed like it auto-saved / sent your code over to the back-end, going back ten years roughly?
traviswingo 47 minutes ago [-]
Copy -> paste -> redact secrets
That flow would be considered unsafe, and probably common.
giancarlostoro 11 minutes ago [-]
If you are pasting secrets into codepen you are probably really terrible at all other basic security practices.
maxim-fin 43 minutes ago [-]
This is exactly the scenario I pictured
1 hours ago [-]
tvink 4 hours ago [-]
You're gonna be shocked how many input fields do this for various UX features :)
nusl 3 hours ago [-]
Shopify does this. If you ever go to purchase a product on a Shopify 'site, and enter eg your e-mail address, it'll save it even if you decide to cancel and close the tab. Sometimes you receive spam from companies along the lines of marketing or "we noticed you didn't complete your purchase" type crap. Shit is rly invasive.
davidmurdoch 2 hours ago [-]
They can only send the marketing emails if you have the "send me marketing emails" checkbox checked when you type in your email address. Dark pattern, yeah.
weezing 3 hours ago [-]
Simplelogin is a godsend for this cancer
Boss0565 3 hours ago [-]
Have you checked to see if it’s stored in localstorage
masfuerte 3 hours ago [-]
If they are sending you emails the address is not just in localstorage.
embedding-shape 4 hours ago [-]
HotJar and similar services are (were?) popular as well, and those record your mouse pointer movements and clicks as well, then displays that as an overlay over the application, so it's essentially a "screen recording" of your session of the application.
maxim-fin 2 hours ago [-]
Not sure if they are still popular but in the past they may have really slowed down the site
glub 2 hours ago [-]
Now it's an entire industry. They call it "bot protection"
maxim-fin 3 hours ago [-]
Yes, but codepen is for frontend devs. And devs are more likely to accidentally leak secrets because, well, they have them
Edit: accidantlay -> accidentally
maxim-fin 2 hours ago [-]
CodePen does not disclose this in neither ToS nor in Privacy Policy, only in Builds documentation they say: “As you work on CodePen, your Pens are constantly running through the CodePen Compiler”
Indeed, it looks like CodePen v1 was sending data to codepen.io, cpwebassets.codepen.io, and cdpn.io. Now v2 sends to codepen.dev
midnitewarrior 3 hours ago [-]
Look into https://www.fullstory.com/ , many major websites use this, it's basically a real-time video view of the user's browser screen. You can see where they move their mouse, how quickly they are typing, each character one at a time.
I worked for a company that would have phone support for users, and we'd be watching their screens giving gentle suggestions to them as they were using our app for how to do what they needed to do. We never offered up what we were doing, but given users' poor descriptions of what they were doing, FullStory was an amazing customer service tool.
VoidWhisperer 3 hours ago [-]
Something like this would've been incredibly useful at my previous job - we often had to put together how a user triggered an issue using a combination of logs and analytics to track what actions they took..
giancarlostoro 2 hours ago [-]
Elastic has something like this too, as does Splunk iirc. Idk how all three compare I just know they can track DOM events type of stuff and recreate a flow video.
2 hours ago [-]
maxim-fin 2 hours ago [-]
interesting!
cph123 4 hours ago [-]
For basic previewing I like to use https://htmledit.squarefree.com which has been online for years and does it all client side.
pdyc 4 hours ago [-]
i made my own html playground that is browser only and shares preview via url hash because of these useless shenanigans of codepen, its not as featureful but i mostly use it for sharing single page html files
Sent to them to render the preview pane. Same as pasting secrets anywhere on a browser.
Wait until you find out copying content on a computer might sent it over Wi-Fi/Bluetooth for sharing on other devices.
maxim-fin 4 hours ago [-]
Yes, that is for rendering
Edit: and as "kypro" pointed out also for saving the current work but if you you quit (or crash) without saving the pen there is no way to recover unsaved work regardless
keepo404 4 hours ago [-]
because this is how autocomplete logic works i guess? Frontend cannot guess language and completions for you
giancarlostoro 2 hours ago [-]
Yeah I remember CodePen refreshing for me plenty of times.
embedding-shape 4 hours ago [-]
Well, except for the cases when you happen to have the entire VM for your language running in the same tab where you program lives, and they both are all JS.
Probably harder, and wouldn't work equally well for everyone, but it would be possible to have "guess language and autocomplete" entirely client-side, especially when it comes to JavaScript of all languages.
odo1242 3 hours ago [-]
It seems like the main disadvantage would be that you have to load all the autocomplete data / model weights on the client-side and your webpage might be CPU/memory limited
embedding-shape 3 hours ago [-]
> main disadvantage would be that you have to load all the autocomplete data / model weights on the client-side
Not sure what "model weights" you're talking about, but yes, that is the trade-off. Although complete autocomplete data for the entirely of the JavaScript APIs would be what, in an efficient format, easily below 1MB at least.
maxim-fin 4 hours ago [-]
No autocomplete involved there.
kypro 2 hours ago [-]
This is so it can restore any unsaved changes.
I take no opinion on whether this is good or bad, but I can see how from a UX perspective it's nice not to lose 10 minutes of work because your browser crashes or something.
maxim-fin 2 hours ago [-]
Yes, absolutely, there are good reasons for that. The point is that any secrets typed/pasted in there should be considered compromized
Edit: but then if you you quit (or crash) without saving the pen first there is no way to recover unsaved work regardless. That is, the pen must be saved manually at least once for the user to benefit from the autosave.
4 hours ago [-]
qsbuilder 45 minutes ago [-]
[dead]
tmpsvc2695f5 3 hours ago [-]
[dead]
alfredo359 1 hours ago [-]
[dead]
cetinsert 4 hours ago [-]
[flagged]
sejje 4 hours ago [-]
It's obviously very fun; look at all the exclamation points.
dakolli 4 hours ago [-]
Did you make this post under a sock acct just to promote this?
Edit: The point is that any secrets typed/pasted in there should be considered compromized
That flow would be considered unsafe, and probably common.
Edit: accidantlay -> accidentally
I worked for a company that would have phone support for users, and we'd be watching their screens giving gentle suggestions to them as they were using our app for how to do what they needed to do. We never offered up what we were doing, but given users' poor descriptions of what they were doing, FullStory was an amazing customer service tool.
https://easyanalytica.com/tools/html-playground/
Wait until you find out copying content on a computer might sent it over Wi-Fi/Bluetooth for sharing on other devices.
Probably harder, and wouldn't work equally well for everyone, but it would be possible to have "guess language and autocomplete" entirely client-side, especially when it comes to JavaScript of all languages.
Not sure what "model weights" you're talking about, but yes, that is the trade-off. Although complete autocomplete data for the entirely of the JavaScript APIs would be what, in an efficient format, easily below 1MB at least.
I take no opinion on whether this is good or bad, but I can see how from a UX perspective it's nice not to lose 10 minutes of work because your browser crashes or something.
Edit: but then if you you quit (or crash) without saving the pen first there is no way to recover unsaved work regardless. That is, the pen must be saved manually at least once for the user to benefit from the autosave.