3 ms·

The underlying issue is executing arbitrary third-party JavaScript on your website. It’s unfortunate that browsers and standards organisations haven’t done mor

The underlying issue is executing arbitrary third-party JavaScript on your website. It’s unfortunate that browsers and standards organisations haven’t done more to promote safer methods of third party integration. The state of the art is still injecting script tags into the document. Given that the web is powered by embeds, ads, and analytics, there should be better sandboxing tools.

politician 9y ago
> The underlying issue is executing arbitrary third-party JavaScript on your website's visitors' browsers. Fixed that for you, but I agree with the sentiment: it's a real problem that browser vendors are disincentivized to address.
- jopsen 9y ago
  How is Mozilla discentivized from fixing that? Sure, you can't break everything tomorrow...
lllr_finger 9y ago
AMP achieved this, for better or worse - the only script allowed on the page is AMP common library and approved plugins. I wonder if the Google CDN was removed from the equation if it would have been more embraced.
- JoshMnem 9y ago
  AMP causes many other problems, so it isn't really a solution. uMatrix is one way to block third-party scripts, but it requires some knowledge to use.
- underwater 9y ago
  It hasn’t solved it at all. Google have whitelisted a set of first and third party scripts. They routinely add more through a non scalable process that seems to rely on a preexisting relationship with the company. The analytics tag allows for arbitrary logging endpoints to be used, but that solves one very specific use case. I believe that they’re going to allow worker scripts in the future, but again, that I don’t believe that will solve every case, and will be AMP specific.
plmn 9y ago
Sandboxing tools aren't the answer. The browser itself was supposed to be a sandboxing tool. The answer is to avoid this part: > executing ... JavaScript on your website.
reaperducer 9y ago
I find it interesting and appropriate that the toggle for activating Javascript is under the "Security" tab in Safari.

politician 9y ago

> The underlying issue is executing arbitrary third-party JavaScript on your website's visitors' browsers. Fixed that for you, but I agree with the sentiment: it's a real problem that browser vendors are disincentivized to address.

jopsen 9y ago
How is Mozilla discentivized from fixing that? Sure, you can't break everything tomorrow...

lllr_finger 9y ago

AMP achieved this, for better or worse - the only script allowed on the page is AMP common library and approved plugins. I wonder if the Google CDN was removed from the equation if it would have been more embraced.

JoshMnem 9y ago
AMP causes many other problems, so it isn't really a solution. uMatrix is one way to block third-party scripts, but it requires some knowledge to use.
underwater 9y ago
It hasn’t solved it at all. Google have whitelisted a set of first and third party scripts. They routinely add more through a non scalable process that seems to rely on a preexisting relationship with the company. The analytics tag allows for arbitrary logging endpoints to be used, but that solves one very specific use case. I believe that they’re going to allow worker scripts in the future, but again, that I don’t believe that will solve every case, and will be AMP specific.

plmn 9y ago

Sandboxing tools aren't the answer. The browser itself was supposed to be a sandboxing tool. The answer is to avoid this part: > executing ... JavaScript on your website.

reaperducer 9y ago

I find it interesting and appropriate that the toggle for activating Javascript is under the "Security" tab in Safari.