Sitting amongst us all, every moment of every day, rests a trojan that has been neglected for as long as I can recall. It quietly lay dormant waiting for the opportune moment to rise up and cause havoc across the globe. Over the last six years it rarely has shown its face to anyone; except those who poke and prod to prove its capability. However, with the rise of Web 2.0, the ugly head of this trojan turns and is gradually rising.

The horror I mention is dubbed, Javascript. The language in which internet users have come to admire and consider a mere toy to add a little extra pop or spice to their internet applications and websites. Our internet browsers rely on this language and there is no way to turn back from it now. Over the years the language has been accepted as a vital member of our internet community and is often worshiped. It receives large amounts of praise from its blood brother: Ajax.

The true nature of these languages are beginning to write tales of horror as they begin to become obvious. We have allowed these languages to penetrate our computers, laughing at our ignorance for allowing a stateless protocol infect us with it; HTTP.

Netscape Communications Corporation’s implementation of the ECMAScript standard was named Javascript, based on the concept of prototype-based scripting languages. The language is best known and witnessed for its implementation within websites, known as client-side Javascript, designed primarily by Brendan Eich, however, also enabling scripting access to objects embedded within other applications. Javascript is designed to execute arbitrary server provided code on a client computer. It has been given permission to bypass many barriers and execute nearly anything imagineable on a client.

Content creation should not be recondite. It should not be this bizarre arcana that only experts and gold-plated computer science gurus can do.

Brendan Eich, Innovators of the Net, primary designer of JavaScript.

May I say wrong? Absolutely! Personally, I completely disagree with Brendan’s statement, a programming language should be simplified, thereby its security follows suit. The so-called experts knew of the dangers long before and are now witnessing as users fall in the realm of insecure applications. We are now utilizing cross-site scripting and javascript shells which are slowly taking over our computers. No lessons learned and all bullshit aside; security’s biggest nemesis is the usability of it. A secure system is extremely difficult to manage, there is a good reason for it; security deals with a large amount of complexity and obscurity which cannot be put into practice with simplicity in mind. It simply implies, to secure your computer, integrate with a firewall to control access.

Getting through the city gates

Imagine for a moment, a language in which was permitted to freely travel through the gates of your computer; travel without question through your firewall. What if someone developed such a language in C, would we have any objections? Obviously not, it was created and we know it as Javascript. Javascript is permitted to travel through the firewall and executed on your local computer by all internet browsers. It is allowed to execute and send data back to remote servers through the HTTP protocol stream. Ajax is the new trojan, in plain view and very strong. Java, the virtual machine, acts as a sandbox for code to be executed, however, Javascript has none. Javascript is allowed to pass through because of our permissions. Ajax isn’t less secure than Javascript, it relies on Javascript.

Javascript is not a toy, respect it..

Javascript has been treated as a toy language for years. Mistaking this language as nothing more than a quick enhancement to HTML for web pages. It was typically utilized to add popups, interactive functionality and even effects to boring sites. Most have ignored the power behind Javascript, most are still oblivious to its strength. With power comes responsibility and inherently exploiting and vulnerabilities is born. I feel as though Javascript is not a toy language and we should stray from these ideas and face the facts about the language. Cross-site scripting opened a whole new world for vulnerabilities. Giving malicious hackers backdoor access to your computer and honestly the opportunity to own your computer. Disabling Javascript could be a quick fix, however, most websites require Javascript to be enabled to enhance the viewing of their particular pages. Online banking systems, social networking, and web mail interfaces all utlize Javascript and who wants to miss the beloved pop-up windows?

Aftermath:

As the internet evolves, especially with Web 2.0 really taking off. A new generation of internet applications and enhancements are being made. These applications are going to take Javascript, especially Ajax to a new level. It will begin to flourish like we have never thought possible. Real-time content fetching, less browser refreshing; almost as if our clients are becoming more and more dependant upon remote servers. They’re beginning to grow closer and closer together, nearly attaching themselves to one another for operation. Until, at some point everything breaks, fails and falls to the conclusion thats Javascript is dangerous.

My prediction and conclusion..

I feel as though the situation cannot be avoided. We have attached ourselves, our browsers and our applications around the concepts provided from Javascript. It is a little too late to drop the beloved language in which our websites depend upon so much. The trojan is amongst us, breathing and evolving with our workstations, applications and community. We must embrace the trojan and live beside it, treat it with extreme care and occasionally provide a little dance to praise the wonderful features it adds.

Browser producers should develop new security techniques and implement technologies to provide a sort of sandbox for Javascript code to be executed within before it is allowed onto the local file system. It is up to our browser counter-parts to not allow Javascript to become the worst trojan we know. A sandbox, virtual machine would prevent Javascript from becoming a logical bomb, destroying all that we have built.

2007 will bring about the real aftermath. Personally, with Web 2.0 being as big as it is, I am going to sit back and watch the show. Hopefully there won’t be fireworks caused by harm but celebration for our new advances.