Mozilla plans for Firefox 3 and beyond

It's hopefully not a huge security hole in that the "cross-site XHR" is actually the "build a
security framework that allows cross-site XHR in the cases where it is safe but not in the
ones where it isn't" feature.  There's a W3C proposal and all that.  So that's reassuring,
right?

I haven't followed the design of this thing myself, and the track record of people trying to
build secure stuff on top of the incredibly complex mash that is web technologies doesn't make
me terribly confident that they'll manage to get it right... but then again, the web is such a
mess security-wise that I'm not sure it's likely to make things much worse.

http://developer.mozilla.org/en/docs/Cross-Site_XMLHttpRe...