UXSS - a really good thing

When these type of vulnerabilities come up, they're generally really rotten. But I think this one's actually a good thing - because the (developer-side) fix for the vulnerability is the same as the fix for XSRF - authenticating where the request came from prior to here with a transaction token.

UXSS will get a lot more media attention and get a lot more people fixing problems than XSRF has to date. Except XSRF, while harder to exploit, is probably as bad of a problem. It's just that we've not taken XSRF very seriously. Once we have a good server-side fix for this, we've got the right fix for XSRF - so this may be a means to fixing another problem.

Developers, please fix the UXSS vulnerabilities by using a bit tunnel. And then apply the same tools to fix all your XSRF.