Google Caja Pwns Facebook’s FBJS
With one stroke, Google’s interest in translating js to safe js pwns Facebook’s interest in sanitizing web widgets.
This entry was posted on Friday, October 12th, 2007 at 7:03 pm and is tagged with web widgets, facebook, pwns, google, js, stroke. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback.


on October 15th, 2007 at 10:33 am
Any insights to back that up?
on February 2nd, 2008 at 12:37 pm
I don’t know why I’m replying so long afterwards when it won’t get read
, but I believe the awesome thing about Caja as compared to FBJS is that Caja will let you write ordinary JavaScript as opposed to JavaScript that only works in Facebook (or OpenSocial or whatever).
Facebook effectively imposes some of the cost of maintaining security on you. Most non-FBJS JavaScript libraries won’t work there. (I say this having developed a Facebook app.) It’s not exactly the DOM you know (although you won’t have too much trouble adjusting).
Conversely, Caja not only fails to stand in your way; it makes it easier to port Web apps you wrote into the Google world.