4 ms·

"This XSS filter has to be one of the most braindead far-reaching decisions since the invention of magic_quotes in PHP." So, I'm guessing you're also against t

by qeorge 17y ago

"This XSS filter has to be one of the most braindead far-reaching decisions since the invention of magic_quotes in PHP." So, I'm guessing you're also against the XSS filter Firefox is adding, and NoScript, and any other attempt to automatically mitigate XSS attacks? All those are also "marketing-driven technical incompetence" right? This bug in IE8's XSS filter is a bad one, and its much worse that they've known about it and not fixed it. That doesn't mean its categorically a bad idea.

bumblebird 17y ago
NoScript is pretty braindead. It's like refusing to eat anything incase you get food poisoning. There's far better ways to protect yourself.
- Mathnerd314 17y ago
  "Better ways..." such as using IE8? The key thing about NoScript is that it is far easier to allow a common subset of safe actions rather than to deny every possible malicious action. Consider why people like using sudo on *nix.
dasil003 17y ago
It depends on the approach. Noscript is a good idea because it just disables executable code which is a simple and absolutely effective solution to the problem of script security, as long as you can live without modern web functionality. As far as XSS filters I could get behind the idea if it exclusively reduced code entry points. But anything that further obfuscates the code leading to vulnerability of the reported is infuriating, especially when it comes from one of the top 3 browser makers, where it will inevitably haunt us for years.
- qeorge 17y ago
  I feel you, but I think its the cost of doing business / innovation. If you don't do anything, you don't make any mistakes. But anything that further obfuscates the code leading to vulnerability of the reported is infuriating, especially when it comes from one of the top 3 browser makers, where it will inevitably haunt us for years. I don't think this one will haunt us for years. IE8 users have already shown a proclivity for updating. Its the IE6/7 & Firefox 2 users that cause us trouble.

by qeorge 17y ago

bumblebird 17y ago

NoScript is pretty braindead. It's like refusing to eat anything incase you get food poisoning. There's far better ways to protect yourself.

Mathnerd314 17y ago
"Better ways..." such as using IE8? The key thing about NoScript is that it is far easier to allow a common subset of safe actions rather than to deny every possible malicious action. Consider why people like using sudo on *nix.

dasil003 17y ago

It depends on the approach. Noscript is a good idea because it just disables executable code which is a simple and absolutely effective solution to the problem of script security, as long as you can live without modern web functionality. As far as XSS filters I could get behind the idea if it exclusively reduced code entry points. But anything that further obfuscates the code leading to vulnerability of the reported is infuriating, especially when it comes from one of the top 3 browser makers, where it will inevitably haunt us for years.

qeorge 17y ago
I feel you, but I think its the cost of doing business / innovation. If you don't do anything, you don't make any mistakes. But anything that further obfuscates the code leading to vulnerability of the reported is infuriating, especially when it comes from one of the top 3 browser makers, where it will inevitably haunt us for years. I don't think this one will haunt us for years. IE8 users have already shown a proclivity for updating. Its the IE6/7 & Firefox 2 users that cause us trouble.