Why AWS APIs don't have CORS headers?
I'm sure there's a boring and obvious reason but I want to use the AWS SDK *inside* the browser to do some stuff...
6
Replies
1
Boost
Look I'm sure some very smart people have been over and over this but it does feel like "we allowed running untrusted code" and then just 2 decades of papering over that decision.
@arichtman untrusted is an iffy way to phrase it. could you genuinely audit all the code running on your system? the purpose of the OS is to provide effective isolation. web vendors are not good at being responsible since they were all created for the purpose of surveillance, much like the internet itself
@hipsterelectron @arichtman "untrusted" is a good weasel word to describe "code that you wouldn't choose to run if they gave you a choice"
@emily_s @arichtman it's used by google and microsoft to describe "code we haven't backdoored yet"
@arichtman elgamal who now works at RSA being the first author of SSL is just fucked
