Hacker News Reader

> Websites should prevent this kind attack

I've had far too coworkers argue that we shouldn't "waste time" preventing XSS attacks _because_ Chrome already detects and prevents (most of) them.

View on HN

The classic "we already have a wall (1 meter high, that folks do not understand very well)" so why need to build a new wall, on top the current wall or prepare for a potential invasion?"

Your coworkers aren't too smart

This comment doesn't really contribute anything — and it makes a common mistake of treating this as an issue of intelligence when it's more specific security experience and awareness. In particular, I've seen a pathology around XSS where part of the problem is that someone is pretty savvy and downplays the risks thinking “well, I'd never set things up so that would work”, ignoring all of the times they've made mistakes, used a library or vendor product, had projects change hands, etc.

Reply on news.ycombinator.com