On Fri, Jan 23, 2009 at 2:01 PM, Mark Smith <[email protected]> wrote: >> It'd be very nice to be able to add widgets, yeah. The problem with >> that is that you have to design it very carefully, because allowing >> Flash and Javascript can lead to significant security holes, which >> would be Bad. > > Jesse and I were talking about this the other night. > > The rules against JS/Flash were established before we forced per-user > subdomains to be on. Once everything split out to subdomains, then > the security policy became antiquated and should be revisited. > > I think it's probably okay to allow JS and Flash in styles. (NOT > entries/comments as they can be viewed in various places!) But > allowing someone to have really interesting styles? I could see that > being a real possibility.
+1 Now that everyone's forced on to their own subdomains, we limit access from cookies to LJ/DW pages through the www subdomain, and there is some crazy redirect magic that goes on that allows you to read restricted entries from user subdomains. If we allow JS/Flash/whatever on styles, the potential harm from an XSS attack is very limited. JS/Flash in styles allows a far greater potential for customization and expression, and it doesn't have to be forced on anyone because we have user preferences like style=mine. -- Jesse Proulx _______________________________________________ dw-discuss mailing list [email protected] http://lists.dwscoalition.org/cgi-bin/mailman/listinfo/dw-discuss
