4 ms·
Nah, we can now formally prove that the code inside an ad is completely safe. So much that this is proposed since a few days ago for direct inclusion in the Jav
by inglor 11y ago
Nah, we can now formally prove that the code inside an ad is completely safe. So much that this is proposed since a few days ago for direct inclusion in the JavaScript language.
This is Mark Miller's work http://static.googleusercontent.com/media/research.google.com/en//pubs/archive/40673.pdf http://static.googleusercontent.com/media/research.google.co...
Anyone who wants to hold an educated opinion on the topic should read it.
EDIT: sauce for "direct inclusion": https://github.com/FUDCo/ses-realm https://github.com/FUDCo/ses-realm
- justabystander 11y agoWhat code is "safe" isn't necessarily something that's set in stone. Exploits could easily deliver code that looks safe but causes problems. And each new version could introduce a new exploit. And then there's the upcoming WebAssembly, which is bound to be ruined by ad networks in the future.
- tyingq 11y agoI believe it's also common to just create a safe, but high CTR ad (OMG 60% off) and save the malicious javascript for the landing page.