Re: Is third party javascript on a login page considered dangerous?

[Solar Designer <solar () openwall com>]

Hi all,

Can we please either have this thread focus on Open Source software, or
end the thread?  Georgi's message included one particular example that
made the message kind of appropriate for this list:

> bugzilla.mozilla.org loads from googleanalytics

If Bugzilla of an Open Source project is compromised and private bugs
leak prematurely, that is a concern for the Open Source community, and
third-party JavaScript is a potential avenue to such compromise.  So
maybe replies can address whether and to what extent and in what
scenarios such risk is valid, and what can or should be done by such
projects or/and by others to mitigate that risk.

Alexander