Thursday, August 5, 2021

Can We Fix The Web?

NEW YORK — Douglas Crockford, the creator of JSON (JavaScript Object Notation) (define) and a senior JavaScript Architect at Yahoo (NASDAQ:YHOO) is convinced that the Web is broken.

During a keynote at AjaxWorld conference here, Crockford launched a polemic against the Web as it is exists today.

“The question is not should we fix the Web but can we,” Crockford asked the crowded conference room. “The browser was not state of the art when it was introduced. It was intended as a document presentation platform and is not intended for applications.”

Crockford argued that browsers were not designed to do all ‘all of this Ajax stuff’ and the fact that Ajax works is because people found ways to do Ajax in spite of the limitations. That said he noted that Ajax development is unnecessarily difficult today and it has a major problem.

“The number one problem with the Web is security,” Crockford declared. “The browser is not a safe programming environment. It is inherently insecure.”

Part of the issue is what Crockford referred to as the “Turducken problem,” where developers are “stuffing the turkey with the duck.” He noted that there are many languages on the Web today such as HTTP, HTML, CSS, JavaScript, XML and others that can all be nested inside of each other. And that can lead to problems.

“A text that is benign in one context might be dangerous in another,” Crockford said. “Discovering that is difficult.”

Crockford argued that this is not a Web 2.0 problem either. All of the issues he outlined were apparent with Netscape 2 in 1995. He said the reason we hear more about security issues related to Ajax uses on Web pages is because Ajax developers are using more scripts.

The security problems are based in three core items: JavaScript, DOM (document object model) and Cookies.

“JavaScript’s global object is the root cause of all Cross Site Scripting attacks where all scripts run with the same authority,” Crockford said.

The problem with DOM (define) is that all nodes are linked to all other nodes to the network which presents an insecure model.

In terms of cookies, Crockford noted that Cookies that are misused as tokens for authority are trouble too. Why? It exposes the site to cross site forgery requests.

“If there are scripts from two or more sources the application is not secure — period,” Crockford said. “So how do you do mashups which use two or more sources? Mashups are insecure and mashups must not have access to any confidential information.

There are a few ways to help make Ajax more secure. Among them is the JSLint ( code validation intiative which helps to remove unsafe features from JavaScript. Crockford noted that Google is also working on a similar initiative with the Caja and Cajita efforts.

This article was first published on To read the full article, click here.

Similar articles

Latest Articles

Data Belongs in the...

In 2012, IBM made an oft-quoted claim that 90 percent of the world's data has been created in the last two years. They grossly...

Google Cloud Rolling Out...

WASHINGTON, D.C. — Google Cloud is helping the government sector with zero trust. The set of services are designed to help U.S. federal, state, and...

CFOs Committing to Digital...

STAMFORD, Conn. — More CFOs are planning to increase their spending on digital than any other part of the business in 2021. Eighty-two percent of...

SAP and IBM Partnering...

WALLDORF, Germany and ARMONK, N.Y. — SAP and IBM are working together to help financial institutions accelerate cloud adoptions and “modernize operations.” SAP plans to...