DiscoFeed and jsonp

[Rod Widdowson]

FYI (and off the topic which is about the server)

The EDS does not use JSONP, it doesn't even use JQuery (which can use
JSONP).  It uses raw XMLHeader.

I have a deep rooted distrust of any technology which "overcome[s] the
cross-domain restrictions imposed by browsers".  To my mind it’s a very
short step from that to XSS.  Indeed I prefer to think of it as XSS.  I
don't even want to try the handle of that door let alone open it.  The web
is quite insecure enough without me inadvertently introducing more
insecurity (in the guise of a security product) and I do not have the skills
(and the team does not have the time) to bottom out the precise security
implications for the EDS.

YMMV of course.

Rod