3 ms·
> Websites should prevent this kind attack I've had far too coworkers argue that we shouldn't "waste time" preventing XSS attacks _because_ Chrome already dete
by commandlinefan 7y ago
> Websites should prevent this kind attack
I've had far too coworkers argue that we shouldn't "waste time" preventing XSS attacks _because_ Chrome already detects and prevents (most of) them.
- sieabahlpark 7y agoYour coworkers aren't too smart
- acdha 7y agoThis comment doesn't really contribute anything — and it makes a common mistake of treating this as an issue of intelligence when it's more specific security experience and awareness. In particular, I've seen a pathology around XSS where part of the problem is that someone is pretty savvy and downplays the risks thinking “well, I'd never set things up so that would work”, ignoring all of the times they've made mistakes, used a library or vendor product, had projects change hands, etc.
- WengerPen 7y agoThe classic "we already have a wall (1 meter high, that folks do not understand very well)" so why need to build a new wall, on top the current wall or prepare for a potential invasion?"