Sometimes I just want to give up. I really hate XSS because it is really a tricky issue to explain to people that don’t understand. It basically boils down to bad people using my website to compromise clients. What they do with those compromised clients can range from fairly benign replicating worms , phishing scams, all the way to total remote control of the end users browser. The fine folks at Scam ScanAlert clearly don’t think this is a problem though.
It is hard enough to educate web site owners that this is a problem and how it impacts them without having to fight against people in our own industry telling them it is OK to have XSS vulnerabilities.
Jeremiah and Jericho provide more great commentary.
If you enjoyed this post, make sure you subscribe to my RSS feed!
