Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 1 Nov 2022 14:55:31 +0100
From: Solar Designer <>
Subject: Re: Is third party javascript on a login page considered dangerous?

Hi all,

Can we please either have this thread focus on Open Source software, or
end the thread?  Georgi's message included one particular example that
made the message kind of appropriate for this list:

> loads from googleanalytics

If Bugzilla of an Open Source project is compromised and private bugs
leak prematurely, that is a concern for the Open Source community, and
third-party JavaScript is a potential avenue to such compromise.  So
maybe replies can address whether and to what extent and in what
scenarios such risk is valid, and what can or should be done by such
projects or/and by others to mitigate that risk.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.