How does `while (1) {}` help prevent CSRF?

Question

Possible duplicate:
Why is there a "while (1);" in the answer of XmlHttpRequest?
What does (1) do in Gmail

I recently stumbled on the practice of adding AJAX return data using while (1==1) {} to offer some great protection against CSRF attacks, but I don’t see how this code can be useful. Can someone explain please?

Answer 1

A remote site attempting a CSRF attack will need to load data using a JSONP call. (entering a script block on the page) If you try to make a JSONP call and the script that you enter on your web page, javascript vm will not be able to load the data (due to the while loop). Thus, an attacker will not be able to see the data.

This ensures that only clients that comply with the same origin policy (downloading data via a regular ajax call) can use the data, thereby preventing any attacker from accessing data from a remote site.