I'd like to live for a time, sure, but even five hundred years might be too long. I'd either get driven insane by the constant bow-shocks of ever advancing culture, or I'd lapse into some kind of boredom-induced stupor.
It's not wrong either for the rest of us to be curious.
The same key can be used for each session...when the Gmail page is being generated, I am saying this embedded in-line key can be associated TO the user's cookie, so that there is a one-to-one correspondence between this "Javascript cookie/session variable" and the user's actual cookie. There is no problem whatsoever. The only thing to be done is the exact same authentication that Google has to do to determine from which authenticated user chat requests are coming from (or any other AJAX request sent to Gmail).
EDIT: To answer your question of "are they doing some kind of lookup for each AJAX request?" Well of course, since they already have to look up a user's ID, account information, etc. based on the cookie they send.
And the Gmail engineers should add an opt-out "high security" mode that checks the referer to make sure the form submission is coming from Gmail itself and not some outside website. This way people who like to use custom/blank referers can ignore this security concern if they want, and all the rest of us can prevent the risk of this problem.
EDIT: Or how about just adding an in-line Javascript variable? Say, on all Gmail pages, you could embed this in the page:
And then when sending AJAX or form requests in the background, make sure to include that as a request parameter. That way, even if the user has the right authentication cookies, external websites won't be able to fool Gmail into thinking they are Gmail.
Really, this doesn't seem like a very hard problem to solve...couple lines of code...
Reading that article made me expect a future in which a musician will not be known for a particular composition, but for the algorithm he devised for creating music of a particular flavor.
This only goes to show that eventually, all fields of knowledge will be nothing except mathematics!
However, read debt's comment below. XSS is irrelevant here since "XSS" means cross-site scripting, i.e., ,managing to embed Javascript into pages someone ELSE sees. Only the client sees this, it doesn't get reproduced for anyone else.
I think mediocrity is sort of the complement to laziness, in that respect. For example, settling for a cubicle job that drains you because you don't think you can do anything better or don't want to--that's still "laziness" in the way you're describing.