Modern browsers break same origin policy?

Question

According to this video http://www.facebook.com/video/video.php?v=562087699610 modern browsers break same origin policy so javascript can make ajax calls to whatever domain.

Is this true?

If yes, does this mean that this will be natural/acceptable whenever necessary eg to fetch data from my partner applications?

Answer 1

Perhaps a reference to CORS ?

Answer 2

Note that browsers don't enforce this policy for included scripts (the same for included images or CSS). That means that someone can cleverly dynamically add:

<script type="text/javascript" src="http://otherdomain/something.js"&gt;&lt;/script&gt;

In order to have cross-domain data. This is possible even without using CORS.

Look at JSONP at Wikipedia.