5 ms·

Regardless of their tone, fivea is correct to point this out as myopic. The grandparent comment argues about semantics and provides information that is technic

by pshc 5y ago

Regardless of their tone, fivea is correct to point this out as myopic. The grandparent comment argues about semantics and provides information that is technically correct, but not in a useful sense. To say that "CORS decreases security" because it opens up cross origin communication is perhaps not disingenuous (who can say?) but certainly misleading. All browser users would be worse off without CORS. I think we are arriving at the word 'security' with different starting points and lenses, and a different chunking of what constitutes CORS. So I too am guilty of making a semantic argument.

JanSt 5y ago
I disagree. Just read the article „cors protects us“ - things like these come from misunderstandings like this one.
unclebucknasty 5y ago
>All browser users would be worse off without CORS. You and fivea are conflating functionality with security. Yes, it may be functionally desirable for an app to allow cross-origin requests, as enabled by CORS. But, you're granting permissions, and that is opening things up, possibly making them less secure. I think great-grandparent's point highlighting this is worth making, given that there is so much confusion around CORS.
- Dylan16807 5y ago
  > You and fivea are conflating functionality with security. fivea wasn't conflating functionality and security. They were saying that a world without CORS would be a world where those rights are always granted.
  - JimDabell 5y ago
    > a world without CORS would be a world where those rights are always granted. We’ve already seen a world without CORS, and that didn’t happen. Cross-origin restrictions were brought in almost immediately after the introduction of JavaScript and existed for over a decade before CORS was introduced.
  - unclebucknasty 5y ago
    >a world without CORS would be a world where those rights are always granted. Or a world where those rights are never granted. Which of those you conclude is a matter of semantics, and this interpretability contributes to the confusion around what CORS actually does. It's that confusion which another commenter was addressing [0] and that my comments sought to support/clarify. You may be unaware that some people believe that CORS is intended to "lock things down" vs. "open them up". They don't understand that it's opt-in or the default behavior without it. But, it's a matter of fact that usage of CORS presents risks vs the default policy, and those risks must be considered. That's really the point vs the idea that CORS has no utility. It's worth noting too that, strictly speaking, there are frequently workarounds to the default policy that don't require CORS, some of which are arguably more secure by way of being less prone to configuration errors. [0] https://news.ycombinator.com/item?id=30320613 https://news.ycombinator.com/item?id=30320613
    - Dylan16807 5y ago
      > Which of those you conclude is a matter of semantics, and this interpretability contributes to the confusion around what CORS actually does. It's that confusion which another commenter was addressing [0] and that my comments sought to support/clarify. You may be unaware that some people believe that CORS is intended to "lock things down" vs. "open them up". They don't understand that it's opt-in or the default behavior without it. Okay, sure, there's a semantics question and also some people are just confused. So here is where I took issue: Yes, many confused people are conflating functionality and security. But while fivea/pshc's words might accidentally encourage that confusion, they were not confused, and were not conflating the two.
      - unclebucknasty 5y ago
        >while fivea/pshc's words might accidentally encourage that confusion, they were not confused, and were not conflating the two. Probably more semantics. I don't claim to know what's in fivea/pshc's heads or whether they themselves are confused. I was speaking to my observation that their comments merged the two issues. You may prefer phrasing like, "their words might accidentally encourage confusion" versus "conflation". I'd say conflation is the mechanism there, but OK. Or you might prefer I specifically clarify "their comments conflated the two" vs "they conflated the two". OK.
- TheCoelacanth 5y ago
  The three pillars of security are confidentiality, integrity and availability. Letting people have access to things that they are supposed to have access to is part of security. You don't get perfect security just by denying everyone access to everything.
  - unclebucknasty 5y ago
    Agreed.

by pshc 5y ago

JanSt 5y ago

I disagree. Just read the article „cors protects us“ - things like these come from misunderstandings like this one.

unclebucknasty 5y ago

>All browser users would be worse off without CORS. You and fivea are conflating functionality with security. Yes, it may be functionally desirable for an app to allow cross-origin requests, as enabled by CORS. But, you're granting permissions, and that is opening things up, possibly making them less secure. I think great-grandparent's point highlighting this is worth making, given that there is so much confusion around CORS.

Dylan16807 5y ago
> You and fivea are conflating functionality with security. fivea wasn't conflating functionality and security. They were saying that a world without CORS would be a world where those rights are always granted.
- JimDabell 5y ago
  > a world without CORS would be a world where those rights are always granted. We’ve already seen a world without CORS, and that didn’t happen. Cross-origin restrictions were brought in almost immediately after the introduction of JavaScript and existed for over a decade before CORS was introduced.
- unclebucknasty 5y ago
  >a world without CORS would be a world where those rights are always granted. Or a world where those rights are never granted. Which of those you conclude is a matter of semantics, and this interpretability contributes to the confusion around what CORS actually does. It's that confusion which another commenter was addressing [0] and that my comments sought to support/clarify. You may be unaware that some people believe that CORS is intended to "lock things down" vs. "open them up". They don't understand that it's opt-in or the default behavior without it. But, it's a matter of fact that usage of CORS presents risks vs the default policy, and those risks must be considered. That's really the point vs the idea that CORS has no utility. It's worth noting too that, strictly speaking, there are frequently workarounds to the default policy that don't require CORS, some of which are arguably more secure by way of being less prone to configuration errors. [0] https://news.ycombinator.com/item?id=30320613 https://news.ycombinator.com/item?id=30320613
  - Dylan16807 5y ago
    > Which of those you conclude is a matter of semantics, and this interpretability contributes to the confusion around what CORS actually does. It's that confusion which another commenter was addressing [0] and that my comments sought to support/clarify. You may be unaware that some people believe that CORS is intended to "lock things down" vs. "open them up". They don't understand that it's opt-in or the default behavior without it. Okay, sure, there's a semantics question and also some people are just confused. So here is where I took issue: Yes, many confused people are conflating functionality and security. But while fivea/pshc's words might accidentally encourage that confusion, they were not confused, and were not conflating the two.
    - unclebucknasty 5y ago
      >while fivea/pshc's words might accidentally encourage that confusion, they were not confused, and were not conflating the two. Probably more semantics. I don't claim to know what's in fivea/pshc's heads or whether they themselves are confused. I was speaking to my observation that their comments merged the two issues. You may prefer phrasing like, "their words might accidentally encourage confusion" versus "conflation". I'd say conflation is the mechanism there, but OK. Or you might prefer I specifically clarify "their comments conflated the two" vs "they conflated the two". OK.
TheCoelacanth 5y ago
The three pillars of security are confidentiality, integrity and availability. Letting people have access to things that they are supposed to have access to is part of security. You don't get perfect security just by denying everyone access to everything.
- unclebucknasty 5y ago
  Agreed.