4 ms·
> One protocol fix that might get the best of both worlds it would be good unless following fact - many developers DONT follow HTML5 tricks, and vk.com is an e
by homakov 14y ago
> One protocol fix that might get the best of both worlds
it would be good unless following fact - many developers DONT follow HTML5 tricks, and vk.com is an example. They rely on framebreakers because it worked once and they DONT expect it to get broken someday.
- A1kmm 14y agoA protocol fix that meant that the server serving the content needed to opt in to no-script through a new X-Frame-Options header would mean that legacy content like vk.com wouldn't send a X-Frame-Options header, and so wouldn't be able to be framed in a no-script iframe.
- homakov 14y agoand nobody will use it. because in fact NOBODY wants to run their pages w/o JS. And this is why sandbox is a bad idea.
- tptacek 14y agoThe parent comment raises a very good point. Does the supposed VK.com CJ vector work at all with Javascript disabled? Disabling JS stops the framebreaker; does the site UI still work when you do that?
- homakov 14y agoyes it does. VK migrates "gracefully" and Like/friend/comment buttons work w/o JS. I'm sure you know that most of the Rails forms will work w/o JS as well.
- acdha 14y agoWhy is the answer not “HTML5 sandbox cannot compensate for non-security-minded developers”? After reading this and the discussion, the only thing which seems certain is that the vk.com developers need to set XFO.
- homakov 14y ago> HTML5 sandbox cannot compensate for non-security-minded developers framebreaker worked well until it sandbox was invented. If we should blame someone - it is rather W3C, not VK.