> Guys from HN disappoint me with their conservatism. It's quite easy to repeat "It works fine, Google and Mozilla have best programmers, well known attack, pop

> Guys from HN disappoint me with their conservatism. It's quite easy to repeat "It works fine, Google and Mozilla have best programmers, well known attack, popular sites are protected(ORLY?!), go home kid". > That was an expected behavior, so I hope, this post makes them to face facts. 2+2=4 and CSRF = the huge, wide-spreaded problem that should be solved now or never. From the previous discussion, your critics were mostly concerned about your "solution" to CSRF. As was said there, it's not a browser vulnerability. It's an application vulnerability. I agree with you that CSRF is a problem that desperately needs as much attention as SQL injection has gotten over the years, but don't get sour because your solution to block all POST requests to different domains[0] is inadequate. Aside from the bitterness towards people pointing out inaccuracies in your previous post, this was great. Developers should be thinking about CSRF (and basic security) more! [0]: http://news.ycombinator.com/item?id=3779160 http://news.ycombinator.com/item?id=3779160 "Please point out where in my post I said to deny ALL requests. I was talking about ONLY POST requests."