Can We Fix The Web?

NEW YORK — Douglas Crockford, the creator of JSON (JavaScript Object Notation) and a senior JavaScript Architect at Yahoo (NASDAQ:YHOO), is convinced that the Web is broken.

During a keynote at the AjaxWorld conference here, Crockford launched a polemic against the Web as it is exists today.

“The question is not should we fix the Web but can we,” Crockford asked the crowded conference room at the Roosevelt Hotel. “The browser was not state of the art when it was introduced. It was intended as a document presentation platform and is not intended for applications.”

Crockford argued that browsers were not designed to do all “all of this Ajax stuff” and the fact that Ajax works is because people found ways to deploy Ajax in spite of programming tool’s limitations. Ajax development is unnecessarily difficult these days because of a major problem: security.

“The browser is not a safe programming environment. It is inherently insecure.”

Part of the issue is what Crockford referred to as the “Turducken problem,” where developers are “stuffing the turkey with the duck.” He noted that there are many languages on the Web today such as HTTP, HTML, CSS, JavaScript, XML and others that can all be nested inside of each other. And that can lead to problems.

“A text that is benign in one context might be dangerous in another,” Crockford said. “Discovering that is difficult.”

Crockford argued that this is not a problem with the current version of the Web. All of the issues he outlined were apparent with Netscape 2 in 1995 when browsers were just starting to gain popularity. He said the reason security problems keep popping up with Ajax-heavy Web pages is because Ajax developers are using more scripts.

The security problems are based in three core items: JavaScript, DOM (document object model) and Cookies.

“JavaScript’s global object is the root cause of all Cross Site Scripting attacks where all scripts run with the same authority,” Crockford said.

The problem with DOM is that all nodes are linked to all other nodes to the network, which presents an insecure model for Web sites.

In terms of cookies, Crockford noted that Cookies that are misused as tokens for authority are trouble too. Why? It exposes the site to cross site forgery requests.

“If there are scripts from two or more sources the application is not secure — period,” Crockford said. “So how do you do mashups which use two or more sources? Mashups are insecure and mashups must not have access to any confidential information.

There are a few ways to help make Ajax more secure. Among them is the JSLint (JSLint.com) code validation initiative which helps to remove unsafe features from JavaScript. Crockford noted that Google is also working on a similar initiative with the Caja and Cajita efforts.

Crockford also laid into the browser vendors, in particular Mozilla Firefox for introducing new insecure JavaScript features.

“Ultimately we need to replace JavaScript with a secure language,” Crockford said. “We need to replace HTML and HTML 5 isn’t the solution.”

Crockford argued that the web used to be a great diver of innovation but today it’s an obstacle to innovation and needs to be fixed.

“Until it’s fixed never trust the browser, formally validate everything you receive from the browser, properly encode everything you send to the browser or database. And validate all input,” Crockford said. “The Web standards process is broken we need to put pressure on browser makers and standard makers, they are putting you at risk .”