5 ms·

> It's time that browser makers went back to the drawing board and came up with a base security model to cut the fat away from the basic attack footprint. Some

by chime 16y ago

> It's time that browser makers went back to the drawing board and came up with a base security model to cut the fat away from the basic attack footprint. Some drastic limit on the source of executable JS files, specified in an HTTP header, could be very effective. Absolutely! I'm just surprised that so many people here are against any changes to the browsers while expecting that every single developer in the world ensure there's not one bug in their code. This isn't the same thing as PHP's safe_mode that never really worked as excepted. This is more like crossdomain.xml file. It is something browser makers can proactively do to improve security. Sure, web developers should keep sanitizing inputs as much as possible. And browsers should try to prevent XSS as much as possible. Why can't both work together? Why is it only the developers' problem?

seancron 16y ago
I don't think people are against changes to the browsers. I think they just realize that there are many different browsers out there that each do things slightly differently. If you've ever tried to get CSS working for all possible browsers, you've probably come across cases where it works in some browsers, but not others (I'm looking at you IE6), and you have to use a hack to get it to work. Changes to browser standards occur at a much slower rate than changes to your code. Politics, competition, and disagreements on standards often get in the way. Just look at all the controversy over the HTML 5 video codec. Unless browser makers, by some miracle, agree on a common standard for browser security, there are always going to be little idiosyncrasies that occur from browser version to browser version. Just because it's secure in all the browsers you tested, doesn't mean that it's secure in the browsers you didn't test. The best solution as of right now is to develop ways of writing more secure code, with less potential for human error.

by chime 16y ago

seancron 16y ago

I don't think people are against changes to the browsers. I think they just realize that there are many different browsers out there that each do things slightly differently. If you've ever tried to get CSS working for all possible browsers, you've probably come across cases where it works in some browsers, but not others (I'm looking at you IE6), and you have to use a hack to get it to work. Changes to browser standards occur at a much slower rate than changes to your code. Politics, competition, and disagreements on standards often get in the way. Just look at all the controversy over the HTML 5 video codec. Unless browser makers, by some miracle, agree on a common standard for browser security, there are always going to be little idiosyncrasies that occur from browser version to browser version. Just because it's secure in all the browsers you tested, doesn't mean that it's secure in the browsers you didn't test. The best solution as of right now is to develop ways of writing more secure code, with less potential for human error.