digg

This is a pretty good analysis of the problems that apply to MySpace but these problems clearly apply to many web sites and are only going to get worse over time as sites with these sorts of heterogeneous user-supplied content requirements continue to proliferate. This suggests to me that perhaps a broader solution might be appropriate, for example the ability of a web site to specify an active content policy to the browser. So, for example, MySpace should be able to say to the browser "No JavaScript code should be executed from this site or any embedded content referenced by it". Handling the two sides of the web security equation (server versus client/browser) successfully is going to have to mean realistic and appropriate apportioning of responsibility to both sides, for example server code should ensure that the server is not compromised and the browser should be primarily responsible for looking after the user's security. But as I said, the only way this is going to work long-term is if the server and browser can communicate and work together to a greater degree than currently happens.