On Fri, Aug 15, 2008 at 12:22 PM, Cassie <[EMAIL PROTECTED]> wrote: > As this change is only introducing a js dependency on caja couldn't we have > caja host their js file in a well known location - and then have the feature > pull from the web? This is currently how the analytics feature works.
Pulling content directly from a third-party is risky. They might go down. They might get hacked. They might break something. Analytics requires pulling content from a third-party in order to do tracking, so it pretty much requires the dependency, but for sanitize HTML it's not a good idea.
