Dangers of remote Javascript
As we move to a widget web, where the goodies on your site may not necessarily come from your site, it's worth sparing a thought for security. We at O'Reilly just got bit on perl.com, which redirected to a porn site courtesy a piece of remotely-included Javascript.
Context & Ripple Effects
O'Reilly's own network became the object lesson for the widget web its Radar desk chronicles: perl.com, a page that executes JavaScript fetched from remote hosts at render time, was silently handing visitors off to a porn site courtesy of one of those includes. The confirmed mechanics matter more than the embarrassment — any publisher that runs remotely included scripts inherits whatever the third-party host decides to serve, trusted code and malicious payloads alike.
First-order effects
- O'Reilly had to hunt down and strip the compromised include from perl.com while its readership was being diverted, taking reputational damage from code its own servers never served.
- Every operator embedding remotely hosted JavaScript learns the same lesson at once: a page's integrity is only as strong as the third-party host it trusts, a component it does not control.
Second-order effects
- Widget and ad-network providers supplying these scripts come under pressure to demonstrate their delivery infrastructure is uncompromised, because one bad host now implicates every customer page simultaneously.
- Publishers weighing widget functionality against page control may pull third-party includes or demand stronger guarantees from script vendors, shifting bargaining power in the widget-supplier relationship.
Third-order effects
- If the widget web scales on remotely included code, the industry's effective trust perimeter moves from each site's own servers to a shared pool of script hosts, where a single compromise propagates across many unrelated domains.
- Repeated incidents of this shape point toward demand for mechanisms that verify or constrain remote scripts before execution, rather than the current default of running whatever arrives.
The trend: As the web reorganizes around widgets and remotely included code, security responsibility migrates from the site owner to whichever third party serves the script.