Hi all, I apologize for being a little off-topic, since this isn't directly caja-related, but I didn't know where else to look for the world's greatest _java_script__ security experts. I've hacked together a little _java_script__ game called ecmanomic (played in the browser at http://ecmanomic.org ).  I think it may interest some of you and I'm eager to hear your feedback on it.  Ecmanomic is inspired by Peter Suber's game of Nomic, where each play of the game changes the rules of the game.  There's a google group (cc'd) and a google code project as well, both called ecmanomic . (This was a learning project for me since I didn't know anything about _java_script__ at the beginning.  So please excuse the terrible _style_ and all the egregious mistakes I've no-doubt made.) Suber's Nomic was designed to model the legislative process, where there are _layer_s of security that enforce a kind of self-paternalism. Similarly, in ecmanomic there are several _layer_s of security that I've tried to implement in (almost) pure _java_script__.  I'd like to know if any of you see a way to violate any of these _layer_s. 1. The entire game is stored in a _java_script__ _object_, serialized in a    slightly-modified JSON.  The game allows p_layer_s to change the game    _object_, but only in specific ways: e.g. proposing an amendment, voting    on existing amendments, and activating an amendment with sufficient    positive votes.  Can you use these basic interactions to pervert the    game _object_ itself (for example, changing your p_layer_'s score to 100)?    (I'll give you 100 _meta_phorical points if you can.) 2. The game also has a small hosted data_base_.  I added this at the last    minute so that it can maintain libraries of code which aren't part of    the game proper (and thus don't slow down the page load).  The data_base_    is stored in JSON flat files on a linux filesystem.  The small bootstrap    perl-_script_ which is responsible for running the server-side JS also    provides the game access to the files.  However, the bootstrap _script_    has no security; I've attempted to _layer_ on some security from within    the _java_script__ game.  Can you can subvert this security to gain    unfettered read or write access to the data_base_?  (25 points for read,    50 points for write.  If you could write, you could execute arbitrary    code in the p_layer_'s browser, but not in the serverside game; however    this would be enough for dastardly deeds.) 3. Within the game of ecmanomic I've implemented a few little subgames.    All of these involve eval() statements, as a test of how robust I could    make the security.  In the first game, CodeWriter, you submit a snippet    of code which must evaluate to a function.  Before evaluating your code,    I pass it through some regexps looking for unsafe patterns.  If your    code is OK, your function enters the game arena and competes against    other functions.  Can you subvert this game and force yourself to win?    (1 point if you can.  Also 1 point each round you can come up with the    cleverest function!) 4. Another subgame, much more ambitious, is called Moo .  In this game I    allow persistence of user-created data and code, including a bastardized    version of prototypical inheritance, and I allow users to interact with    each others' _object_s and functions.  The _object_s have owner fields    that should restrict write-access.  1 point for you if you can change    someone else's _object_ without their permission.  Also, to prevent    DOS-_style_ bloat attacks, each user has a limited budget of bytes to add    to the game; the budget can only be refilled by another p_layer_ who is    impressed by your work.  Half a point for anyone who can find a way    circumvent this, but please don't demonstrate by filling the game up    with spam! 5. Within the Moo subgame, there's yet another _layer_ of security.  I tried    to create an in-subgame non-scarce currency called props .  The idea is    that I can depute certain _object_s by name; these _object_s are    authorized to give props on my behalf.  There's an example in the Avatar    lobby: a graffiti wall which will give you one props from me if you    write on it.  0.5 points if you can violate this currency model,    e.g. get more than 1 props from me or remove someone else's props. Anyway, if you feel inclined to take a look at the game in your copious free time, I'd love to hear what you think of it, either here or on the ecmanomic newsgroup.  All criticism will be graciously accepted!  (I already know that the user interface is not very good, but one beauty of the game is that any p_layer_ can improve the interface for everyone, so feel free to jump in and help out!) Cheers,