search for: bsterne

...ally, it is easy for a autobot > to find them all and zero day your forums, xss your whatever, and so on. > > Dang scary to leave JS on at all....even though you basically have too. Mozilla is beginning to address this issue with Content Security Policy -=- http://people.mozilla.org/~bsterne/content-security-policy/ -=- CSP will require pro-active webmasters who use it and browsers that enforce the client side enforcement, but it's a step in the right direction. I wrote a php class that partially implements CSP server side as an output filter -=- http://www.clfsrpm.net/xss/ -=...