Javascript leashed with google Caja

Like I wrote recently I am contracted at a German ISP at the moment to build a new Portal where one can put several different widgets on his or her personal web page. Similar to igoogle. My customer also wants to provide the possibility of own widgets to external developers, so to avoid security issues we will need to sandbox each of those widgets, but like we all know that can be a serious problem when it comes to the “evil unleashed monster” javascript. So in order to leash it inside a sandbox on a secure chain we came across google caja.

Sometimes I wonder about Developers

Lately I came across a nice article at “der fiese Admin” about the security leak at a German portal for kids, that made me wonder about the work attitude of some of my so called colleagues.

Security issues happen from time to time, nobody can possibly built a bullet proof website, someone will find a hole in your system from time to time, we all know that, but … guys honestly ?!