4 edited tags
| link
    Tweeted twitter.com/#!/StackSecurity/status/301227363683926016
3 edited body
source | link

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning that there are no limits or structure as to what the 3rd party site is permitted to do.

In addition there doesn't appear to be any structured exception handling (SEH) available for Javascript anytime independent website author's scripts reside on the same web page.

Example

On 2/7/1113 several sites that integrate with Facebook effectively DOSed half of the Internet, rendering several sites unusable. I think this problem could be avoided if 3rd party javascript could be constrained (as defined by the website owner and honored by the browser), and/or there was a variation of meta-Structured Exception Handling for Javascript.

Question

  • Is there any research or proposal that attempts to constrain or control 3rd party javascript at any level?

  • What working group (W3C, RFC group, vendor, etc) is the most appropriate for formally proposing and defining a standard for 3rd party javascript controls?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning that there are no limits or structure as to what the 3rd party site is permitted to do.

In addition there doesn't appear to be any structured exception handling (SEH) available for Javascript anytime independent website author's scripts reside on the same web page.

Example

On 2/7/11 several sites that integrate with Facebook effectively DOSed half of the Internet, rendering several sites unusable. I think this problem could be avoided if 3rd party javascript could be constrained (as defined by the website owner and honored by the browser), and/or there was a variation of meta-Structured Exception Handling for Javascript.

Question

  • Is there any research or proposal that attempts to constrain or control 3rd party javascript at any level?

  • What working group (W3C, RFC group, vendor, etc) is the most appropriate for formally proposing and defining a standard for 3rd party javascript controls?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning that there are no limits or structure as to what the 3rd party site is permitted to do.

In addition there doesn't appear to be any structured exception handling (SEH) available for Javascript anytime independent website author's scripts reside on the same web page.

Example

On 2/7/13 several sites that integrate with Facebook effectively DOSed half of the Internet, rendering several sites unusable. I think this problem could be avoided if 3rd party javascript could be constrained (as defined by the website owner and honored by the browser), and/or there was a variation of meta-Structured Exception Handling for Javascript.

Question

  • Is there any research or proposal that attempts to constrain or control 3rd party javascript at any level?

  • What working group (W3C, RFC group, vendor, etc) is the most appropriate for formally proposing and defining a standard for 3rd party javascript controls?

2 edited title
| link

How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?

1
source | link