AJAX is fun, but… this Gnomie hits the nail on the head:

It’s interesting to me how we keep coming back to “old” technology and treat it as “new”. All web-based programming, be it an OS or application, is the same as Star LAN with each workstation being only alive when connected to the server and able to run programs only when connected. The choice for most has been peer-to-peer with each workstation being alive on its own and able to shared with another as desired.

Both general systems have security and operability problems unique to their configuration. With the advent of the internet, security became tougher as an unwanted member of the network could join in without invitation or special connection whenever and however it wanted.

But the article you referenced had some very good, although generic, ideas of how one should approach the security issue when writing AJAX applications. The question seems to me to be the application that talks between the user and the server, so it is therefore a server-side issue. You and I, as users, can only choose to use or not use AJAX applications at this time.

I am still old school – I want control over my OS, my applications and my data! I am not interesting in farming it out to some unknown corporation and assume that they have my interest in mind. I love to be able to communicate my data and my ideas through the medium of the internet, but I am very aware that the US Postal Service works very well and will also perform the same service – just a LOT slower. Sometimes it is good to take a little time and be a bit more secure. But someone can intercept my letter, can’t they?

Ajax, Google and Microsoft