3 ms·
There is a huge difference between a program that computes the wrong answer and one that corrupts memory, hijacks a shell, and installs a rootkit. Javascript i
by gizmo 11y ago
There is a huge difference between a program that computes the wrong answer and one that corrupts memory, hijacks a shell, and installs a rootkit.
Javascript is turing complete but it's trivial to write a (slow) javascript interpreter in Python that allows anybody to run any javascript program without any risk to their machine. No memory attacks possible. To privilege escalation possible. No unchecked stack overflows. The system would be sandboxed and secure. It will just work or fail gracefully.
It's only when we increase the complexity of our runtimes a thousand fold and when we cut corners to squeeze out higher performance that all the nasty vulnerabilities start to creep in.
- JoeAltmaier 11y agoFor pure Java perhaps. But native code is inevitable, and it has no such protection. So in practice Java is not a lot of protection.
- piva00 11y agoI didn't understand how Java relates to his comment about JavaScript + Python.
- JoeAltmaier 11y agoSorry, its because I'm an idiot. Anyway, secure languages use native code, and that's still a problem.
- sklogic 11y agoIt must be really slow in order to avoid attacks like this one: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs