4 ms·
counterpoint: I haven't really heard of any "javascript escaping the container" bugs in a really long time (excepting node.js-related issues)
by rtpg 10y ago
counterpoint: I haven't really heard of any "javascript escaping the container" bugs in a really long time (excepting node.js-related issues)
- ChristianBundy 10y agoJavaScript doesn't run on the JVM.
- cloudjacker 10y agothanks for saying this, sometimes I'm like "wow" on hackernews comments, because you kind of assume people know what they're talking about but then its like not really.
- rtpg 10y agoI know that Javascript isn't run in the JVM, my point was that it's possible to write a virtual machine that doesn't get exploited every 5 minutes. the JVM is a bit special because there are a large amount of escape hatches, native code and a complex trust model, which has caused a lot of the exploits you end up seeing.
- astrodust 10y agoJavaScript has several mature, thoroughly scrutinized implementations. Ethereum has one brand new implementation. To put it mildly: There will be blood.
- andrewflnr 10y agoThere are at least two ethereum implementations, the main one and one in Rust.
- danfinlay 10y agoThere are actually eight different implementations at this time, although the go client has a slight majority of users according to ethstats.net http://ethdocs.org/en/latest/ethereum-clients/index.html http://ethdocs.org/en/latest/ethereum-clients/index.html
- TheDong 10y agoFunny, most pwn2owns there are multiple successful escapes of any of a number of js sandboxes. I hear about it at least yearly, if not more often.
- Chris2048 10y agoBut. JS was designed with this in mind, and has been tested for it for years. It's actually one of the greatest strengths of JS, but I imagine it was a lot of work (except, perhaps, maybe functional languages).