Switching off scripts

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi...

Sorry, that may run out of scope, and I promise this is my last out-of-scope mail regarding the usage of client side scripts here... :o)

> > (That means that you should encourage all your users to switch off all
> > kind of scripting and don't rely on it within your apps).
>
> That's a bit extreme. Why not just fix the XSS hole.

Yep. Right. Of course the XSS hole needs to be fixed for all the users that use client side scripts or keep using it against better knowledge.

The background here is that I never experienced any merit from using client side scripting anyway:

- - it induces additional security risks
- - it lowers usability significantly
- - it renders sites inaccessible most often
- - it has got severe compatibility problems in nearly any case

Client side scripting is a nuisance and it is unnecessary. If you want to have more client side functionality, consider building "distributed" applications rather than web applications.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Kind regards

Ingo

• -- ingo@ingostruck.de Use PGP: http://ingostruck.de/ingostruck.gpg with fingerprint C700 9951 E759 1594 0807 5BBF 8508 AF92 19AA 3D24 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux)

iD8DBQE/O5SahQivkhmqPSQRAkNYAKC63oJeHreTUt1gb/1xvO3C3OkzQACguOEI z57EiWuLg0I7ZADUPPl5ycI=
=0vxH
-----END PGP SIGNATURE----- Received on Thu Aug 14 10:34:46 2003