Hacker News Reader

Most social plugins already have an iframe option.

E.g. search for iframe in http://developers.facebook.com/docs/opengraph/

Edit: I think I may have misunderstood you. Did you mean embed an iframe and using postMessage to control it?

There's a difference between the iframe version of Facebook's like button and the XFBML version. The XFBML version, for various reasons, is preferable to the iframe version (e.g. say you want to subscribe to the edge.create event to determine if someone clicked on the like button).

Now, if you want to add the XFBML version of the like button, you'd have to embed Facebook's JavaScript SDK script (https://connect.facebook.net/en_US/all.js) to your site. If connect.facebook.net ever gets compromised via a fake SSL certificate, your site will also be compromised.

Instead of letting third-party scripts run on your main site, it may be safer to let them run within an iframe based off of a different domain so that a compromised third-party script doesn't compromise your main site.

Reply on news.ycombinator.com