Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mozilla Experiments With Site Security Policy

Posted by ScuttleMonkey on from the security-catching-up-with-web-2.0 dept.

An anonymous reader writes "Mozilla has opened comments for an new experimental browser security policy, dubbed Site Security Policy (SSP), designed to protect against XSS, CSRF, and malware-laced IFRAME attacks which infected over 1.5 million pages Web earlier this year. Security experts and developers are excited because SSP extends control over Web 2.0 applications that allow users to upload/include potentially harmful HTML/JavaScript such as on iGoogle, eBay Auction Listings, Roxer Pages, Windows Live, MySpace / Facebook Widgets, and so on. Banner ads from CDNs have had similar problems with JavaScript malware on social networks. The prototype Firefox SSP add-on aims to provide website owners with granular control over what the third-party content they include is allowed to do and where its supposed to originate. No word if Internet Explorer or Opera will support the initiative."

6 of 68 comments (clear)

  1. Re:Why not just include NoScript by default? by Anonymous Coward · · Score: 3, Funny

    unscrupulous Canadians?

  2. Anonymous Answers Itself by Anonymous Coward · · Score: 1, Funny

    Q: Why not just include NoScript by default?

    A: NoScript's security can get kind of annoying sometimes

  3. pages Web by HTH+NE1 · · Score: 2, Funny

    which infected over 1.5 million pages Web earlier this year. That reminds me: I need to update my page Web.
    --
    Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
  4. Re:Why not just include NoScript by default? by onkelonkel · · Score: 2, Funny

    No such thing. We're all totally scrupulous.

    --
    None of them can see the clouds; The polished wings don't care.
  5. Re:Why not just include NoScript by default? by rootofevil · · Score: 2, Funny

    No such thing. We're all totally scrupulous. if you had ended that sentence with ', eh' or mentioned one or more of the following: ice, mooses, the yukon. i would have believed you.
    --
    turn up the jukebox and tell me a lie
  6. it's just not sufficient protection by fred+fleenblat · · Score: 2, Funny

    In all likelihood it will be years before the enabling technology is in place to prevent the most vicious malware of all, the dreaded rickroll.