Originally published on eve.gd on 21 May 2007, last updated 6 September 2026.
Read this post on the web (with images, PDF and citation details)
GNUCITIZEN has been going on about this for some time now, but the truly devastating impact of what he has been saying only actually hit me today when reading about his JavaScript interface to Johnny's Google Hacking Database.
GNUCITIZEN
JavaScript interface
Johnny's Google Hacking Database
The scenario is as follows. The interface contains NO SERVER SIDE SCRIPTS and no iframes or other such methods for loading offsite data but instead utilises the JSON data format to include remote script files. GC's example uses Dapper to perform the remote data retrieval in JSON format and then loads it into a script tag. For example:
<script src="http://www.dapper.net/transform.php?dappName=GoogleHackingDatabaseCategoriesReader&transformer=JSON& extraArg_callbackFunctionWrapper=json_1179755998729&applyToUrl=http%3A%2F%2Fjohnny.ihackstuff.com%2Fghdb.php" type="text/javascript"></script>
This loads the contents of the Google Hacking Database into a JavaScript object which can then be parsed. Essentially this is remote data retrieval entirely from JavaScript. If services like Dapper continue to develop (for example to allow access to an exact URL and return the output in JSON format) then the Same Origin Policy is history.
This reference list has been generated, in many cases, through an automated process and may therefore contain errors or incomplete metadata. It is provided purely as assistance for finding the items mentioned within this post.
1. GNUCITIZEN <http://www.gnucitizen.org>