Security interactions

Thinking about including Google’s javascript in my webpages last month (1 and 2) has had me thinking more on how complex interactions happen with software and security implications. The Sony mess with DRM is a good example of complex interactions, but this has largely been interactions on a single machine, possibly with a remote attacker. XSS, email, IM and the like bring in a bit of a network aspect. But it seems like we’re getting into a new realm where it’s harder to quantify risk or actively manage it as code moves onto other peoples’ servers.
That Google was able to “fix” by changing code on Google servers a major security flaw in Microsoft’s Internet Explorer that their Google Desktop software exposed is fascinating. Fixing desktop code in a third party’s software by putting changes on your server that your user doesn’t actually have to download. That’s complexity and means problems.