Javascript Must Die!
Posted by: Ken Harthun
Exploits, insecure, javascript, Opinion, Security, Vulnerabilities
At least that’s what Mr. John Graham-Cumming says on his blog–and what he told attendees at Virus Bulletin 2009 in his presentation called, “JavaScript Security: The Elephant running in your browser:”
My thesis is that the security situation with JavaScript is so poor that the only solution is to kill it. End users have very little in the way of protection against malicious JavaScript, major web sites suffer from XSS and CSRF flaws, the language itself allows appalling security holes, and as data moves to the cloud the 14 year old JavaScript security sandbox becomes more and more irrelevant.
I’ve been recommending that everyone use NoScript with Firefox for quite some time. Here’s my article from more than a year ago: Software for Secure Computing: Firefox & NoScript. Recent security updates to Firefox tend to reinforce this view since most of the workarounds for security flaws recommend disabling Javascript.
What do you think? Should Javascript be killed? Would this break 99% of the web sites out there?
Maybe it’s time for a new technology.
Comment
RSS Feed
Email a friend
