It wasn't surprising that the story turned out to be a hoax. The vague hints about the exploit didn't ring true, given the security features that do exist in JS. Restrictions against running code from two different domains, for example, are severe enough to crimp my style writing legitimate applications.

That's not to say that JS exploits are impossible. Reference to code migrating through MySpace sounds more plausible, using the script-injection attacks we've talked about before. Crossdomain security isn't any help in a situation like MySpace, where all the material comes from the same domain. If a MySpace user can get JS into his/her page, it can tunnel up from one page to get at things on another user's home page, such as the form for changing user info and settings. The technique was used at eBay a few months ago, with JS on an item listing page tunnelling up to search result listings and altering them.

Could you build a scanner in JavaScript to scan a local network? The hints sounded feasible, but the technique's pretty lame and unreliable. Apparently it just involves JS creating IMG tags for numeric IP addresses pointing to "images in known locations". Right...except for default installations of IIS that leave a default page showing, there's no such thing as a standard image location, let alone image filenames. Then there's the question of who cares? JS can't determine your IP address, so this technique must assume that you're using the standard range of private IP addresses, 192.168.x.x et al. If so, then those computers aren't directly addressible from the Net anyway--their data goes through a firewall with address translation.

Much ado about almost nothing, and not enough ado about the somethings that really exist.