Can We Fix The Web?

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

NEW YORK — Douglas Crockford, the creator of JSON (JavaScript Object Notation) (define) and a senior JavaScript Architect at Yahoo (NASDAQ:YHOO) is convinced that the Web is broken.

During a keynote at AjaxWorld conference here, Crockford launched a polemic against the Web as it is exists today.

“The question is not should we fix the Web but can we,” Crockford asked the crowded conference room. “The browser was not state of the art when it was introduced. It was intended as a document presentation platform and is not intended for applications.”

Crockford argued that browsers were not designed to do all ‘all of this Ajax stuff’ and the fact that Ajax works is because people found ways to do Ajax in spite of the limitations. That said he noted that Ajax development is unnecessarily difficult today and it has a major problem.

“The number one problem with the Web is security,” Crockford declared. “The browser is not a safe programming environment. It is inherently insecure.”

Part of the issue is what Crockford referred to as the “Turducken problem,” where developers are “stuffing the turkey with the duck.” He noted that there are many languages on the Web today such as HTTP, HTML, CSS, JavaScript, XML and others that can all be nested inside of each other. And that can lead to problems.

“A text that is benign in one context might be dangerous in another,” Crockford said. “Discovering that is difficult.”

Crockford argued that this is not a Web 2.0 problem either. All of the issues he outlined were apparent with Netscape 2 in 1995. He said the reason we hear more about security issues related to Ajax uses on Web pages is because Ajax developers are using more scripts.

The security problems are based in three core items: JavaScript, DOM (document object model) and Cookies.

“JavaScript’s global object is the root cause of all Cross Site Scripting attacks where all scripts run with the same authority,” Crockford said.

The problem with DOM (define) is that all nodes are linked to all other nodes to the network which presents an insecure model.

In terms of cookies, Crockford noted that Cookies that are misused as tokens for authority are trouble too. Why? It exposes the site to cross site forgery requests.

“If there are scripts from two or more sources the application is not secure — period,” Crockford said. “So how do you do mashups which use two or more sources? Mashups are insecure and mashups must not have access to any confidential information.

There are a few ways to help make Ajax more secure. Among them is the JSLint (JSLint.com) code validation intiative which helps to remove unsafe features from JavaScript. Crockford noted that Google is also working on a similar initiative with the Caja and Cajita efforts.

This article was first published on InternetNews.com. To read the full article, click here.