How the Web Tangled Itself
summary
Analysis of Internet Archive snapshots (1997–2016) inspects 659,710 documents, 1.4M frames, 5M scripts and 21M HTTP headers to track client-side security trends. JavaScript grows to ~99% use, average script size and cyclomatic complexity rise sharply after 2007, sites pull code from about 12 third-party domains, jQuery version churn leaves many sites running known-vulnerable releases, detected XSS spikes (~50% of top sites in 2009, ≈8% in 2016), HTTP-only cookies and X-Frame-Options see fast adoption while CSP lags (~10% adoption).
AI-written summary · about
chapters (18)
- 0:00Start
- 1:35The Tangled Web
- 2:37Internet Archive
- 4:35The Evolution of Client-Side Technology
- 5:15Usage of Javascript As Well as Flash around 2003
- 8:18Discovered Security Issues
- 9:23Cross Domain Communication
- 11:18Jquery
- 12:19Flash
- 14:09Indicators for Security Awareness
- 14:33Http Only Cookies
- 17:24Content Acuity Policy
- 22:14Threats to Validity
- 22:56Lessons That We Learned
- 23:20Make Security Mandatory
- 23:47Improve the Tools for and the Awareness of Developers
- 24:24Update Ability of Libraries
- 24:47Conclusion
related talks
32mJavaScript security: a retrospective
43mRestricting the scripts, you're ...
40mHostile JavaScript: Attacking and Defending the Browser
25mThe Chronic Disease Plaguing the Internet
29mYour Scripts In My Page - What Could Possibly Go Wrong?
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
24mWe're struggling to keep up
53mFrom HTML to here: The evolution of Web development and where we lost our way