How to build a plugin system on the web and also sleep well at night
This is one of the cleverest things I've seen in JS in a while.In a nutshell, they use a same origin iframe to ensure the plugin gets its own copy of globals (so it can't mess up the globals your app uses), coupled with a proxy object which whitelists certain globals for the plugin to use along with certain vars from your app.Really rather clever, although the guys who develop browsers should consider an API for something like this as it's becoming such a common use case.