Eli Grey

本頁 50 篇

• Choosing a browser

  Choosing the right browser is crucial for your security, privacy, and overall experience on the web. This is especially important now that Chrome is dropping support for the popular uBlock Origin adblocker browser extension. I have evaluated the security, privacy, extensibility, and ethical alignment of today’s most popular browsers in order to determine which is […]

  2025/2/18 02:00Eli Greyhttps://eligrey.com/blog/choosing-a-browser/

• Big Tech’s role in enabling link fraud

  Link fraud is increasingly undermining trust in major online platforms, including Google, Bing, and X (Twitter). These platforms allow advertisers to spoof links with unverified ‘vanity URLs’, laundering trust in their systems, while simultaneously deflecting blame onto advertisers when these mechanisms are exploited for fraudulent purposes. I believe that this status quo must be abolished. […]

  2024/1/9 11:20Eli Greyhttps://eligrey.com/blog/link-fraud/

• Favioli

  🤯 Favioli is a productivity extension that makes it easier to recognize tabs within Chrome. Favioli was originally inspired by two things. The first thing that spurred the idea was Eli Grey’s personal site and its use of Emoji Favicon Toolkit to make randomized emoji favicons. The favicon of their site shows different emoji on-load […]

  2018/8/18 09:00Ben Pevsnerhttps://eligrey.com/blog/favioli/

• Zerodrop

  We are announcing Zerodrop, an open-source stealth URL toolkit optimized for bypassing censorship filters and dropping malware. Zerodrop is written in Go and features a powerful web UI that supports geofencing, datacenter IP filtering, blocklist training, manual blocklisting/allowlisting, and advanced payload configuration! Zerodrop can help you elude the detection of the automatic URL scanners used on […]

  2018/5/23 20:00Devin Samarinhttps://eligrey.com/blog/zerodrop/

• Google Inbox spoofing vulnerability

  On May 4th, 2017 I discovered and privately reported a recipient spoofing vulnerability in Google Inbox. I noticed that the composition box always hid the email addresses of named recipients without providing a way to inspect the actual email address, and figured out how to abuse this with mailto: links containing named recipients. The link […]

  2018/4/28 06:55Eli Greyhttps://eligrey.com/blog/google-inbox-spoofing-vulnerability/

• Opera UXSS vulnerability regression

  Opera users were vulnerable to a publicly-disclosed UXSS exploit for most of 2010-2012. I privately disclosed a UXSS vulnerability (complete SOP bypass) to Opera Software in April 2010, and recently discovered that Opera suffered a regression of this issue and continued to be vulnerable for over two years after disclosure. The vulnerability was that data: […]

  2018/1/12 12:06Eli Greyhttps://eligrey.com/blog/opera-uxss-vulnerability-regression/

• Bedford/St. Martin’s data breach

  Some time between Aug 27, 2012 and May 3, 2014, the Macmillan Publishers subsidiary Bedford/St. Martin’s suffered a data breach that leaked the unique email address that I provided to them. I have previously informed them of the breach and it appears that they do not care to investigate. I don’t appreciate large companies getting […]

  2017/5/19 20:01Eli Greyhttps://eligrey.com/blog/bedford-st-martins-data-breach/

• CPU core estimation with JavaScript

  (Update) Standardization I have standardized navigator.cores as navigator.hardwareConcurrency, and it is now supported natively in Chrome, Safari, Firefox, and Opera. Our polyfill has renamed the APIs accordingly. Since the initial blog post, Core Estimator has been updated to estimate much faster and now has instant estimation in Chrome through PNaCl. navigator.cores So you just built some […]

  2013/5/25 01:32Eli Greyhttps://eligrey.com/blog/cpu-core-estimation-with-javascript/

• Saving generated files on the client-side

  • #JavaScript
  • #html5
  • #File API

  Have you ever wanted to add a Save as… button to a webapp? Whether you’re making an advanced WebGL-powered CAD webapp and want to save 3D object files or you just want to save plain text files in a simple Markdown text editor, saving files in the browser has always been a tricky business. Usually […]

  2011/7/16 04:53Eli Greyhttps://eligrey.com/blog/saving-generated-files-on-the-client-side/

• Title image files in Opera

  • #CSS
  • #opera
  • #Hacks

  I recently discovered a method to title image files in Opera. I was experimenting with CSS generated content in regards to the element in various browsers, and discovered that as long as the and elements are not display: none, generated content applied before and after the element is added to the […]

  2011/4/27 10:04Eli Greyhttps://eligrey.com/blog/title-image-files-in-opera/

• Voice Search Google Chrome extension

  Voice Search is an open source Google Chrome extension I made that allows you to search by speaking. For example, just click on microphone and say kittens to search for kittens. If you specifically want pictures of kittens, say google images kittens. Want to learn more about World War II? Say wikipedia world war two. The source code for Voice Search […]

  2010/12/20 01:49Eli Greyhttps://eligrey.com/blog/voice-search-chrome-extension/

• Better font smoothing in Google Chrome on Windows

  Screenshots: before and after. Firefox 4 and Internet Explorer 9 already support improved font smoothing offered by the DirectWrite API in Windows 7 and Vista. Google Chrome (WebKit) has yet to support DirectWrite, which may be the deal breaker for you when choosing to use either Google Chrome or Firefox if you are primarily a Windows user. […]

  2010/10/20 03:14Eli Greyhttps://eligrey.com/blog/better-font-smoothing-in-google-chrome-on-windows/

• Encrypted DuckDuckGo with Google Suggest search plugin

  I made a version of Nathan Friedly’s DuckDuckGo + Google Suggest search plugin that only uses encrypted endpoints, and I would like to share it with everyone else. It uses the encrypted versions of DuckDuckGo and Google Suggest so no one can eavesdrop on your searches (except DuckDuckGo and Google, of course). Installation In most browsers, […]

  2010/9/27 04:58Eli Greyhttps://eligrey.com/blog/encrypted-duckduckgo-with-google-suggest-search-plugin/

• Passive localization in JavaScript

  Today, I created a passive localization JavaScript library named l10n.js. l10n.js is a JavaScript library that enables passive localization through native JavaScript methods, gracefully degrading if the library is not present. You can make Ajax applications, JavaScript libraries, etc. that can be localized but not require l10n.js to function. There is already a placeholder method […]

  2010/5/10 10:49Eli Greyhttps://eligrey.com/blog/passive-localization-in-javascript/

• tinylog

  tinylog is a minimalistic logging platform JavaScript library I created which is primarily intended for online IDEs and implementing console.log() for browsers without native consoles. There is also a lite version intended for embedding in other JavaScript libraries. One such library that embeds tinylog lite is Processing.js, which uses it to implement Processing’s println(). There […]

  2010/2/27 11:27Eli Greyhttps://eligrey.com/blog/tinylog/

• Pausing JavaScript with async.js

  async.js is a library that aims to make it so you don’t have to mess with callbacks when making applications in JavaScript 1.7 or higher by using the yield statement to pause function execution. Examples Please note that user interaction with the page is not blocked during the course of any of these examples. A node.next(eventType) method […]

  2010/1/11 05:55Eli Greyhttps://eligrey.com/blog/pausing-javascript-with-async-js/

• Fonts in Processing.js

  I recently implemented fully-featured cross-(HTML5-supporting)-browser loadFont() and text() functions in Processing.js. This implementation does not suffer from the limitation of the old implementation that only supported SVG fonts and writing text from already-installed fonts only worked recent Mozilla-based browsers. I also revamped the entire library, fixing a few hundred errors, changing and optimizing many Processing […]

  2009/11/29 13:38Eli Greyhttps://eligrey.com/blog/fonts-in-processing-js/

• Another E4X DOM library

  I just made another E4X DOM library, but this one is intended to implement the optional features in the ECMA-357 standard that are not implemented by Mozilla in JavaScript. The library is named e4x.js due to, for the most part, it only implementing stuff already specified in E4X. The only difference between the standard and […]

  2009/11/23 00:10Eli Greyhttps://eligrey.com/blog/another-e4x-dom-library/

• E4X DOM toolkit

  I have created a small JavaScript toolkit named e4x-dom.js for making it easy to manipulate the DOM with E4X. The following methods are implemented on XML objects by e4x-dom.js: node() Returns the HTML node representation of the XML. over(element or selector) Either overwrites element or every element matched by the CSS selector with node(). overId(id) […]

  2009/9/28 03:36Eli Greyhttps://eligrey.com/blog/e4x-dom-toolkit/

• JSandbox 0.2

  I have recently released JSandbox version 0.2. JSandbox is a JavaScript sandboxing library. Version 0.2 is, for the most part, a complete re-write. It introduces many new features, such as load (for loading external scripts) and exec (faster than eval but no return value). There is now an additional fixed-position arguments API along with the […]

  2009/8/27 02:01Eli Greyhttps://eligrey.com/blog/jsandbox-0-2/

• mumbl

  mumbl is a JavaScript library that makes it easy to play music and create playlists on web pages. Demo A demo is included with mumbl but if you dont want to download it, there is also an online demo. Please note that mumbl is not the player in the demo. mumbl is the back-end and the demo […]

  2009/8/23 01:59Eli Greyhttps://eligrey.com/blog/mumbl/

• RetargetMouseScroll

  Yesterday I made a simple JavaScript micro-library named RetargetMouseScroll that provides a simple API to retarget/redirect mouse scroll events. I named it this because RedirectMouseScroll sounded weird. At first glance it seems pretty useless but there are some cool things you can do with the library which are listed in the examples section of this […]

  2009/8/1 04:45Eli Greyhttps://eligrey.com/blog/retargetmousescroll/

• Moving projects to GitHub

  I’m moving every significant project on code.eligrey.com to git repositories on my GitHub account. I may or may not delete projects moved to GitHub from code.eligrey.com in the future.

  2009/7/21 10:46Eli Greyhttps://eligrey.com/blog/moving-projects-to-github/

• jsandbox JavaScript library

  Recently, I created a JavaScript library named jsandbox. jsandbox is used for evaluating JavaScript code safely in a sandbox. jsandbox uses web worker threads to do this. The API for using the jsandbox library is described in detail and with an example on the project page.

  2009/7/3 05:55Eli Greyhttps://eligrey.com/blog/jsandbox-javascript-library/

• GTranslatifier

  I have created a very simple Jetpack feature called GTranslatifier that adds a icon to Firefox’s status bar for easy access to Google Translate services. Upon clicking the icon, one of the following things happen. If no text is selected in the tab currently being viewed, the page in the browser tab currently being viewed […]

  2009/5/31 12:18Eli Greyhttps://eligrey.com/blog/gtranslatifier/

• Array methods for XML lists

  I have created an open source library that implements every array method for E4X XML lists in JavaScript named e4x-array-methods.js. The methods output XML as opposed to arrays to make the output directly usable with other XML. To get the array representation of an XML list, use slice. This returns XML when used to slice […]

  2009/5/28 10:46Eli Greyhttps://eligrey.com/blog/array-methods-for-xml/

• Edit Page Jetpack Feature

  I have created a Jetpack feature called Edit Page to see what developing a Jetpack feature would be like. As the name implies, it lets you edit any web page in one click. Right clicking on the Edit Page button added to the status bar toggles spellcheck. To change the default spellcheck preference for the […]

  2009/5/23 13:56Eli Greyhttps://eligrey.com/blog/edit-page-jetpack-feature/

• Jetpack API

  Mozilla Labs’ latest creation, Jetpack, is a great way to extend Firefox. It currently has a poorly documented API that doesn’t mention all of the public methods and fields. Due to Mozilla Labs’ decision of not putting the API documentation on MDC or the MozillaWiki, I cannot update the documentation myself. Therefore, I will list […]

  2009/5/22 11:32Eli Greyhttps://eligrey.com/blog/jetpack-api/

• ECMAScript 5 accessors

  A while ago, I created a JavaScript library named Xccessors, which implemented the legacy non-standard accessor (getter and setter) methods in IE8. I initially created two different libraries and decided that the library that implemented the legacy methods would be more useful at the time due to no changes needed in a JavaScript program’s code […]

  2009/5/9 10:14Eli Greyhttps://eligrey.com/blog/ecmascript-accessors/

• Object.getPrototypeOf

  The addition of Object.getPrototypeOf in JavaScript 1.8.1 reminded me of John Resig’s Object.getPrototypeOf implementation that uses constructor property even if it has been modified. If the constructor property has been modified, it can be reset by deleting the property. An easy way to detect if a property like constructor has been modified is check if […]

  2009/5/5 07:51Eli Greyhttps://eligrey.com/blog/object-getprototypeof/

• Namespacing properties in JavaScript

  Namespacing properties is a great way to make a JavaScript library produce extendible objects. Namespacing in JavaScript can be done by prefixing namespace:: before object and property names. Unfortunately, namespacing is only supported in JavaScript 1.6 and higher, which is currently only implemented in SpiderMonkey (Firefox’s JavaScript engine) and Rhino with E4X enabled. Namespaces should […]

  2009/5/5 06:50Eli Greyhttps://eligrey.com/blog/namespacing-properties-in-javascript/

• CiteDrag WordPress plugin and UserScript

  Due to Ajaxian recently featuring my CiteDrag JavaScript library and a suggestion in the comments, I went ahead and made a CiteDrag UserScript that applies CiteDrag to every website and a WordPress plugin that includes CiteDrag on every page of a WordPress-powered website. If you’re using Firefox, you can install the UserScript with Greasemonkey. You […]

  2009/4/28 06:16Eli Greyhttps://eligrey.com/blog/citedrag-wordpress-plugin-userscript/

• textContent in IE8

  I was creating a testcase for a bug that is present in every browser and I noticed IE still doesn’t support textContent as of IE8. I don’t like having to make code that supports both innerText and textContent so I implemented the standard myself using IE8’s support for ECMAScript 3.1 accessors. The following is all […]

  2009/4/26 06:10Eli Greyhttps://eligrey.com/blog/textcontent-in-ie8/

• Extending Object.prototype.toString

  Object.prototype.toString is a great way to find the “class” of an object, but it only works for the native constructors like String, Function, ect. Due to this limitation, I have created an open source JavaScript library named toStringX which adds support for non-native constructors so things like the string representation of new Foo are [object […]

  2009/4/20 06:28Eli Greyhttps://eligrey.com/blog/extending-object-prototype-tostring/

• Why you shouldn’t use XDomainRequest

  I just recently installed Windows and downloaded IE8 again and it seems that pmxdr works fine with the exception of one small MessageEvent.source bug in the host library that I fixed in version 0.0.5. I went to check out if the XDomainRequest examples I created worked, and to my astonisment, they ALL failed except for […]

  2009/4/11 23:47Eli Greyhttps://eligrey.com/blog/why-you-shouldnt-use-xdomainrequest/

• XDomainRequest is no longer IE-only

  XDomainRequest is Internet Explorer 8’s cross-domain request function. It would be easy to add support for it in Firefox 3.5 using native cross-domain XMLHttpRequests, but that wouldn’t work in Firefox 3, Opera 9.6-10, and Safari 4. I have created a library named XXDomainRequest (means “Cross-browser XDomainRequest”) that builds on the pmxdr client library to create […]

  2009/4/7 08:15Eli Greyhttps://eligrey.com/blog/xdomainrequest-is-no-longer-ie-only/

• Reusable pmxdr instances

  I just released version 0.0.4 of the pmxdr client code to support reusable instances where the same iframe can be used for mutiple pmxdr requests to a domain. It’s still the same interface, but you need to call pmxdr.request() instead of pmxdr() to do a normal request. Instances are created with new pmxdr(host) where host […]

  2009/3/29 14:43Eli Greyhttps://eligrey.com/blog/pmxdr-reusable-instances/

• Custom error constructors

  Most of the time, the standard six native error constructors and the one generic error constructor are not specific enough for an error. What if you want your library to throw a custom SecurityError if it detects an XSS vector on a website? I made a function to create such constructors that behave the exact […]

  2009/3/29 12:20Eli Greyhttps://eligrey.com/blog/custom-error-constructors/

• pmxdr standard documented

  I decided to make some detailed documentation on the pmxdr standard used for pmxdr client and host interaction. You may use the standard to implement your own pmxdr client and host libraries. This is particularly useful for websites that don’t want to follow any HTTP access control headers and want to make their own host […]

  2009/3/28 08:16Eli Greyhttps://eligrey.com/blog/pmxdr-standard-documented/

• pmxdr: postMessage cross-domain request library

  pmxdr is a cross-domain HTTP request JavaScript library. pmxdr stands for postMessage cross-domain requester. As the name implies, it makes use of the HTML5 postMessage API to make HTTP requests. It requires that a pmxdr host be on the target domain and it respects all HTTP access control headers, even on browsers that don’t support […]

  2009/3/23 05:54Eli Greyhttps://eligrey.com/blog/pmxdr-postmessage-cross-domain-request-library/

• APNG feature detection

  I have made a simple script that utilizes the HTML5 API in only 9 functional lines of JavaScript to detect if a browser supports APNG images. It can be useful for deciding when to serve a client browser APNG images instead of GIF images. This will set the variable, apng_supported to true if the […]

  2009/3/4 11:10Eli Greyhttps://eligrey.com/blog/apng-feature-detection/

• JavaScript Shell 1.4 Extended

  Whenever I open up the JavaScript Shell 1.4 to test some JavaScript out, I don’t like that I have to use the default JavaScript version while testing out code. Generators, let expressions, and various other improvements to JavaScript can be pretty useful but they require an explicit JavaScript version to be declared, so I modified […]

  2009/2/19 13:49Eli Greyhttps://eligrey.com/blog/javascript-shell-14-extended/

• JIL 0.0.4

  At this time I would be introducing Noteboard 2.1 but since the source files to that are on my corrupted hard drive, I began working on a updated version of JIL. One new great feature is chainable method calls. Changelog for JIL 0.0.4: JIL is now a function with properties, not just an object. Usage: […]

  2009/2/15 00:05Eli Greyhttps://eligrey.com/blog/jil-004/

• Cross-browser accessors

  Xccessors is a script I made which implements the legacy methods for defining and looking up object accessors (getters and setters) of objects in JavaScript using ECMAScript 3.1’s accessors standard. This is aimed at adding support for the legacy method in IE8 RC1. Read more on the Xccessors project page. There is also a demo […]

  2009/1/25 07:09Eli Greyhttps://eligrey.com/blog/cross-browser-accessors/

• jData now supports IE8 beta 2

  I just now added support for IE8 beta 2 in jData 0.0.3. IE8 beta 2 has always had (for the most part), correct implementations of localStorage and postMessage, the two things that jData is built around. It was relatively easy to add support for IE as all I had to do was use attachEvent (window.onmessage […]

  2009/1/16 06:40Eli Greyhttps://eligrey.com/blog/jdata-now-supports-ie8-beta-2/

• jData completely redone

  I have recently completely redid all of jData to make a much securer version. I have also dropped the HTTP query parameter support due to most new advanced browsers support postMessage & localStorage (except Opera, which seems to currently only support postMessage). The old version wasn’t practical due to having no security system that asked […]

  2009/1/14 13:17Eli Greyhttps://eligrey.com/blog/jdata-completely-redone/

• jData’s major flaw (fixed)

  jData is a great concept and all, but where it fails is that ANYONE can add/modify/delete item values. An example of when this works out good could be a when a legitimate website sets public.website to the website a user specifies and other websites auto-fill form fields with this data. An example of when it […]

  2009/1/13 12:33Eli Greyhttps://eligrey.com/blog/jdatas-major-flaw/

• New jData API

  Update: Please note that this information is obsolete and does not work with the new completely-rewritten jData host library. When not using the postMessage API but using the HTTP query parameters API, you used to have to use the “callback” parameter and do something like callback=location.href=”http://example.com/%3Fvalue=”+encodeURIComponent(jdata)+”%26item=”+locacation.search.replace… (and some code to figure out what item is […]

  2009/1/9 13:06Eli Greyhttps://eligrey.com/blog/new-jdata-api/

• HTML 5 dataset support

  Update: Getting (not setting) data-* attributes through Element.dataset now works in IE8 with the help of Xccessors. I have made an implementation of HTML 5 dataset (data-* attributes) support that almost conforms to the HTML 5 spec* and works in Firefox 1.5+, Opera 9.5+, Safari, and Google Chrome. It uses getters and setters to simulate […]

  2008/12/21 06:45Eli Greyhttps://eligrey.com/blog/html-5-dataset-support/

• CiteDrag drag and drop script

  Firefox 3.1 beta 2 recently added support for the standard drag and drop model (also with some extra Mozilla-only ones). I had an idea to automatically add citation info to text dragged from websites to plain and rich text editors using this newly supported API. I named the finished script CiteDrag, which requires no setup […]

  2008/12/10 08:24Eli Greyhttps://eligrey.com/blog/citedrag-drag-and-drop-script/