Hacker News Reader

Um, the "people writing HTML" have done a lot of work to prevent XSS, by introducing Content-Security-Policy and other HTTP headers: http://ibuildings.nl/blog/2013/03/4-http-security-headers-yo...

The main problem is backwards compatibility, as older browsers don't support them, but the idea that people have their head in the sand re. XSS is complete nonsense.

Wrong. Even in an xss-free web, JavaScript based cryptography in the browser is unsafe against an attacker that can MITM - the attacker can just replace the crypto code being used.

There is no permanent cure for any attack surface in a given technology. Security is an ongoing effort and requires deep understanding of the underlying platform.

If "writing HTML" exposes cross-site scripting vulnerabilities on your site, then maybe "writing HTML" isn't so easy after all.

It's any MITM attack, not just XSS, right?