3 ms·
Thanks, but while the restrictions on XHR are heavy, they aren't stupid. An unnamed party used the same idea to implement a LAN sniffer: each successive root do
by aristus 19y ago
Thanks, but while the restrictions on XHR are heavy, they aren't stupid. An unnamed party used the same idea to implement a LAN sniffer: each successive root domain pointed to the IP addresses of well-known routers, like 192.168.15.1. The script ran down the chain and attempted to log in to the admin page of the router, using default passwords.
- DanielBMarkham 19y agoNice. Not that I approve. But nice. I'm a JSON person myself. Ran into too many problems with domains and XMLHttpRequest. From a security standpoint, the entire browser is broken, but that's probably a discussion for another day. Neat how you re-routed.
- aston 19y agoThe real point is that with enough smarts, you can get around the restrictions, so you might as well eliminate them altogether so that there's no false sense of security.
- aristus 19y agoI feel that way sometimes when I can't do something cool. But it passes. No restrictions on user processes is a major reason why "Windows security" is a contradiction, for example. It doesn't work in an adversarial networked environment.