We have taken a thorough look at the Caja system for protecting a root site or container (and its associated users) from third-party code being hosted on it. Now that we are looking at a lighter solution to the same issue—ADsafe—we will inevitably need to answer the question of which one we should use. Let’s look at our choices in a little more depth.

I categorize ADsafe into the semitrust bucket. What I mean by this is that ADsafe does a good job of removing many of the major tools that a malicious developer could use to attack a user. This does not mean that ADsafe takes into account and adjusts for all attack vectors; it just means ADsafe takes away a lot of the sharpest knives from the developer. When I say semitrust bucket, I am referring to the level of trust you have in the third-party code being hosted. ADsafe makes a great system if you partially trust the code that will be hosted, as you would in the case of ads. You trust that the source is a legitimate ad company, but you may not be entirely confident that it will never have an issue with its ads that affects your site (i.e., the site that the ads are hosted on). This is the perfect use case for ADsafe: when you have a limited trust relationship with the source of the content being hosted, and you know where the content may be coming from. The impact on developers building code to exist within an ADsafe object is minimal, and users are fairly well protected from malicious code.

On the other hand, I categorize Caja into a no-trust bucket. This means that Caja is a perfect tool for hosting code from sources that you don’t know and developers that you have not built a trust relationship with. Since Caja’s aim is to remove any malicious attack vectors from the third-party code being hosted and rewrite the entire code base into a secure version, it ensures that most of the malicious code that developers implement has been removed before the user ever interacts with it. This is a much more secure system for the user, but presents more challenges to the developer building out the code for the site or container.

Overall, ADsafe and Caja both have their target markets. Though they may overlap a bit, their primary developer audiences are quite different, which makes both ADsafe and Caja very acceptable solutions depending on the problem at hand.