Simon Willison’s Weblog

When Ajax Attacks! Web application security fundamentals. Slides and (other people’s) notes from my presentation at @media Ajax on Tuesday.

# 11:18 pm / ajax, atmediaajax, atmediaajax08, csrf, javascript, security, speaking, xss, recovered

Frame-Busting Gadgets. I’ve always been slightly suspicious of the Google Gadgets / OpenSocial idea of sandboxing untrusted third party content in an iframe. Sure enough, it turns out iframe busting scripts work in Gadgets, meaning a seemingly harmless gadget could potentially launch a phishing attack.

# 11:23 pm / framebusting, gadgets, javascript, opensocial, phishing, security

DjangoCon and learning from Zope 2. Mark Ramm presented probably the most thought-provoking talk at DjangoCon. He’s started writing it up as a series of posts.

# 11:25 pm / django, djangocon, mark-ramm, python, turbogears, zope2