cap-based security employed by yahoo.com

10.24: news.addn/dev.caja/cap-based goes big-time:

to General discussions concerning capability systems ,

Discussion of E and other capability languages ,

Google Caja Discuss

date Mon, Oct 12, 2009 at 5:08 PM

subject [e-lang] Caja gadgets on Yahoo! home page!!

Caja (and thus object-capabilities) are now protecting one of the

world's top three web pages, the Yahoo! home page.

http://developer.yahoo.com/yap/guide/caja-support.html

http://www.wait-till-i.com/2009/10/11/introduction-to-yahoo-open-applications/

The other two top web pages are the Google search page and the

Facebook page

. The Google search page has no need for isolation.

The primary means of isolation on the

Facebook page is also Javascript-to-Javascript rewriting (their FBJS),

http://wiki.developers.facebook.com/index.php/FBJS

which is also an ocap-oriented approach in most ways. AFAICT, it is

not until you get to site #11 that you find a site needing isolation

within a page and using iframes and the same origin policy (SOP) as

the primary means of providing it. (Note that iframes/SOP is still used

as a defense-in-depth backstop for Caja on the Yahoo! home page,

just in case. And Facebook does make some use of iframes as well.)

It seems that within pages served at huge scale, ocap-oriented

JS-to-JS rewriting is now the primary means of isolation, having

overtaken and surpassed iframes and SOP. While it is way too early to

declare victory, it is not too early to applaud Yahoo! for their

tremendous progress contributing to a safer web.