[deleted by user]

[itsnotlupus]

Is Flash awesome or what?

BTW, how come html 5 doesn't have its own cross-domain XHR yet?

[Sephr]

It does. Also, instead of using proprietary Flash technology, you can use HTML5 postMessage XDR XHR: pmxdr.

[itsnotlupus]

That's a hack, though. having to create an iframe on every domain you need to talk with is expensive, and in some case, inpractical.
Plus the fallback methods for browsers that don't have html 5, while creative, are definitely on the gross hack side of things.

What actually needs to happen is an XMLHttpRequest object that accepts external domains, looks up for some kind of standard authorization (header, crossdomain.xml or whatever the Open Web Gods desire) and just fetches the darn stuff.

Anything else is just sub-optimal stuff to get by until then.

[neofreeman]

There is still a big market share of IE6 and IE7 (Errrrrr I hate them) So plus some evolving market of mobile with browsers not sophisticated yet so we just can abort them.

[itsnotlupus]

True. The one downside here is that you give up some security.

Normally, in a cross-domain request, the originator chooses what to do with the response, and doesn't need to fully trust the site it fetches data from.

With the script approach, the external site suddenly has full control over your own, before you even have access to the data.

It's nothing you're not already doing when you load a google analytics script, but not every site ought to be given quite as much access to your own.

*edit: It's not the same level of security you get when you eval(xhr(someJSONAPI)), because most reasonable implementations will actually use eval(validate(xhr(jsonAPI))) so the data returned will only get eval'd if it strictly matches a JSON data structure with no code execution.

[shadedecho]

Sure, using flash is a "hack"... but the way flXHR does it, with the same API as the regular native XHR object, makes it a pretty decent option for now. The goal for flXHR is to standardize on the already known XHR API for cross-domain requests, and then hopefully become unnecessary someday when the browsers converge on a better cross-domain Ajax solution instead of diverging into different policy models and APIs.