As pointed out here and in the blog's comments, if example.com does a <script src="http://friendfeed.com/api/feed/public?callback=alert%28document.cookie%29%3Bf

As pointed out here and in the blog's comments, if example.com does a <script src="http://friendfeed.com/api/feed/public?callback=alert%28document.cookie%29%3Bfoo http://friendfeed.com/api/feed/public?callback=alert%28docum... the code will run in example.com's origin, not friendfeed.com's. This means it's not an XSS in FriendFeed. When testing for this type of issue, using alert(document.domain) makes it clear what origin the JavaScript is running in. Although the blog did not fully describe a real XSS, developers should not allow characters such as < and > in JSONP callbacks. Does anyone know how to contact security at FriendFeed? [update: there's a bug report form, hopefully someone reads it http://friendfeed.com/about/contact/bug http://friendfeed.com/about/contact/bug ]