Gluing Together Wet Cats in a Crowd

Gluing Together Wet Cats in a Crowd Douglas Crockford Yahoo! Inc.

Minimalism

Creative Laziness

Intersection

Adhesives

Lubricants

Loobcon 2010

Out with the old Relational DB XML HTTP/HTML

Mashups

A Mashup is a self inflicted XSS attack. A confusion of interests.

What can an attacker do if he gets some script into your page?

An attacker can request additional scripts from any server in the world. Once it gets a foothold, it can obtain all of the scripts it needs.

An attacker can read the document. The attacker can see everything the user sees.

An attacker can make requests of your server. Your server cannot detect that the request did not originate with your application.

If your server accepts SQL queries, then the attacker gets access to your database. SQL was optimized for SQL Injection Attacks

An attacker has control over the display and can request information from the user. The user cannot detect that the request did not originate with your application.

An attacker can send information to servers anywhere in the world.

The browser does not prevent any of these. Web standards require these weaknesses.

The consequences of a successful attack are horrible. Harm to customers. Loss of trust. Legal liabilities.

Cross site scripting attacks were invented in 1995. We made no progress on the fundamental problems in 14 years.

Safe JavaScript Subsets Deny access to the global object and the DOM. Caja. http://code.google.com/p/google-caja/ ADsafe. http://www.ADsafe.org/

ECMAScript Fifth Edition/Strict December 2009

HTML5 A big step in the wrong direction.

HTML5 makes things worse three ways 1. Increases the attack surface, giving attackers new modes of attack. 2. Gives powerful new capabilities to the attacker, such as access to the local database and interprocess communication. 3. The standards process itself is blocking progress toward a solution.

Reset HTML5 • Throw out the current HTML5 proposal and start over. • The new charter makes the timely solution of the XSS problem the highest priority. • The old HTML5 set can be mined for good ideas as long as that does not undermine the prime directive.

The Next Browser Standard • HTML4/ECMAScript 5 Compatibility mode to support old applications. • An opt-in safe mode that has a new HTML language, ECMAScript 6, and a powerful new DOM. • The new DOM should look like an Ajax library.

The Web is important enough to fix. HTML5 does not fix the web. It makes it worse. Reset HTML5 and start over.

The IE6 Problem

IE6 is fading very slowly. Five years ago I predicted that IE6 would fade away in five years.

There are more obsolete copies of IE in use than Opera, Safari, and Chrome combined. IE6 is hanging on because we are allowing it to hang on.

IE6 MUST DIE!

Recap • Clown Computing. • Minimalism. • Creative Laziness. • Lubricants. • Mashups. • Reset HTML5. • IE6 must die.

Get slippery!

Gluing Together Wet Cats in a Crowd

by Douglas Crockford on May 27, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

2 Embeds 51

Statistics

Gluing Together Wet Cats in a Crowd — Presentation Transcript

http://www.slideshare.net	48
http://www.lmodules.com	3