3 ms·

Are you talking about the risk from inclusion to the including page? The concern about cross-origin requests was in the other direction (to the remote resource,

Are you talking about the risk from inclusion to the including page? The concern about cross-origin requests was in the other direction (to the remote resource, not the including page). That concern applies to <script> inclusion as well, in addition to the possibility of running unwanted or incompatible script code.

Muromec 2y ago
Yes, I was talking about the risk from the perspective of the including page. From the perspective of the risk to remote it makes even less sense from the 90ies point of view. Data isn't supposed to be in javascript anyway, it should be in XML. It's again on you (the remote) if you expose your secrets in the javascript that is dynamically generated per user. With a hindsight from this year -- of course you have a point.
- fweimer 2y ago
  Ahh, the data-in-XML argument is indeed very convincing from a historic perspective.
  - Muromec 2y ago
    XHR is called xmlthttprequest for a reason, but that was added in 2000ies I think. SOAP was late 90ies, but I don't think you can call it from browser. There was no reason to have data in javascript before DOM and XHR which were late additions. All the stuff was in the page itself rendered by server and you don't get that across the domain boundary.
    - thaumasiotes 2y ago
      > 2000ies Now this is interesting. I've seen a lot of "40ties", "90ies", etc around, and I'm not sure why people do that. But once you've done it, it's clear how to read the text. Most of the non-numeric suffix is redundant; people mean "forties", not "forty-ties". But "2000ies" has no potential redundancy and no plausible pronunciation. It's spelled as if you're supposed to pronounce it "two thousandies", but there's no such thing as a thousandy.
      - alt227 2y ago
        I enjoyed your analysis. I think people should really just be putting 's on the end, then it works for all: 40's, 50's, 2000's. The apostrophe is unecesary, but IMO without it it looks like the 's' is a standard unit of measurement: 40s, 50s, 2000s
      - Muromec 2y ago
        twothousandies and twenty-zeroes makes sense
edoceo 2y ago
The point being, presumably, the page author explicitly chose to include a cross-domain script
- Muromec 2y ago
  The script author however didn't. CORS is more about the remote giving consent to exfiltrate the data than it is about preventing injecting the data into it. You can always reject the data coming in

Muromec 2y ago

Yes, I was talking about the risk from the perspective of the including page. From the perspective of the risk to remote it makes even less sense from the 90ies point of view. Data isn't supposed to be in javascript anyway, it should be in XML. It's again on you (the remote) if you expose your secrets in the javascript that is dynamically generated per user. With a hindsight from this year -- of course you have a point.

fweimer 2y ago
Ahh, the data-in-XML argument is indeed very convincing from a historic perspective.
- Muromec 2y ago
  XHR is called xmlthttprequest for a reason, but that was added in 2000ies I think. SOAP was late 90ies, but I don't think you can call it from browser. There was no reason to have data in javascript before DOM and XHR which were late additions. All the stuff was in the page itself rendered by server and you don't get that across the domain boundary.
  - thaumasiotes 2y ago
    > 2000ies Now this is interesting. I've seen a lot of "40ties", "90ies", etc around, and I'm not sure why people do that. But once you've done it, it's clear how to read the text. Most of the non-numeric suffix is redundant; people mean "forties", not "forty-ties". But "2000ies" has no potential redundancy and no plausible pronunciation. It's spelled as if you're supposed to pronounce it "two thousandies", but there's no such thing as a thousandy.
    - alt227 2y ago
      I enjoyed your analysis. I think people should really just be putting 's on the end, then it works for all: 40's, 50's, 2000's. The apostrophe is unecesary, but IMO without it it looks like the 's' is a standard unit of measurement: 40s, 50s, 2000s
    - Muromec 2y ago
      twothousandies and twenty-zeroes makes sense

edoceo 2y ago

The point being, presumably, the page author explicitly chose to include a cross-domain script

Muromec 2y ago
The script author however didn't. CORS is more about the remote giving consent to exfiltrate the data than it is about preventing injecting the data into it. You can always reject the data coming in