What is 'trusted' javascript though?
There is no differentiation between 'trusted' and 'untrusted', which I think was the point that the presentation was making.
There is no differentiation between 'trusted' and 'untrusted', which I think was the point that the presentation was making.
trusted: I wrote it / looked over the source code
untrusted: I pasted some <script src=http://gonnaHackU.com/blah.js>; into my page.
Including <script> tags from external entities is always a potential security risk. And it's always better to do it serverside if at all possible.
Please, somebody think of the users!
There are obvious technical solutions to this, but people seem unwilling to acknowledge that they might even be necessary.