4 ms·
Long story short, this topic won't end until XSS gets fixed. The people writing HTML don't consider XSS their problem, its been what 20 years? Nobody even know
by Already__Taken 12y ago
Long story short, this topic won't end until XSS gets fixed. The people writing HTML don't consider XSS their problem, its been what 20 years?
Nobody even knows what 'fixing' xss would look like.
- pestaa 12y agoThere is no permanent cure for any attack surface in a given technology. Security is an ongoing effort and requires deep understanding of the underlying platform. If "writing HTML" exposes cross-site scripting vulnerabilities on your site, then maybe "writing HTML" isn't so easy after all.
- mdellabitta 12y agoIt's any MITM attack, not just XSS, right?
- jonrimmer 12y agoUm, the "people writing HTML" have done a lot of work to prevent XSS, by introducing Content-Security-Policy and other HTTP headers: http://ibuildings.nl/blog/2013/03/4-http-security-headers-you-should-always-be-using http://ibuildings.nl/blog/2013/03/4-http-security-headers-yo... The main problem is backwards compatibility, as older browsers don't support them, but the idea that people have their head in the sand re. XSS is complete nonsense.
- beagle3 12y agoWrong. Even in an xss-free web, JavaScript based cryptography in the browser is unsafe against an attacker that can MITM - the attacker can just replace the crypto code being used.