[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20221101135530.GA8278@openwall.com>
Date: Tue, 1 Nov 2022 14:55:31 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Is third party javascript on a login page considered dangerous?
Hi all,
Can we please either have this thread focus on Open Source software, or
end the thread? Georgi's message included one particular example that
made the message kind of appropriate for this list:
> bugzilla.mozilla.org loads from googleanalytics
If Bugzilla of an Open Source project is compromised and private bugs
leak prematurely, that is a concern for the Open Source community, and
third-party JavaScript is a potential avenue to such compromise. So
maybe replies can address whether and to what extent and in what
scenarios such risk is valid, and what can or should be done by such
projects or/and by others to mitigate that risk.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
