Hacker News new | ask | show | jobs
by acdha 4738 days ago
> JS should not be required on grounds of security, not just privacy. Sites should not have to run what is essentially unsafe, privileged, arbitrary code

JavaScript is by far the most heavily sandboxed, restricted code in common use. If you think it's harmful to have JS running on someone's site you need to learn more about web security.
1 comments
betterunix 4738 days ago
https://en.wikipedia.org/wiki/Cross_site_scripting

https://en.wikipedia.org/wiki/Clickjacking

It is definitely problematic for me to have Javascript running from arbitrary untrusted sources.

link
acdha 4738 days ago
If I can inject JavaScript into the page I can also inject HTML with a big “Win a free iPad click here!” link. JavaScript is the symptom, not the disease.
link