[update] XSS / CSRF using AJAX

A couple of weeks ago i wrote about how cross-domain AJAX could be a nasty idea from a security perspective, today Chris Shiflett (whose writing prompted my post) addressed the subject: http://shiflett.org/archive/250.

A much more important concern is that cross-domain Ajax effectively eliminates the CSRF safeguard implemented by many web applications...

...In fact, there's nothing any web application could do about it.