4 ms·
What is 'trusted' javascript though? There is no differentiation between 'trusted' and 'untrusted', which I think was the point that the presentation was makin
by gdp 17y ago
What is 'trusted' javascript though?
There is no differentiation between 'trusted' and 'untrusted', which I think was the point that the presentation was making.
- axod 17y agoSure there is (I agree js doesn't know the difference, but we do, and we are the music makers). trusted: I wrote it / looked over the source code untrusted: I pasted some <script src=http://gonnaHackU.com/blah.js> http://gonnaHackU.com/blah.js> into my page. Including <script> tags from external entities is always a potential security risk. And it's always better to do it serverside if at all possible.
- gdp 17y agoRight, but that's just a social distinction. It does nothing to protect users from careless web developers, and it does nothing to help web developers be less careless. Please, somebody think of the users! There are obvious technical solutions to this, but people seem unwilling to acknowledge that they might even be necessary.