5 ms·

Yes, and most of them shouldn't be.

by myrion 10y ago

enraged_camel 10y ago
That's not the problem. The problem is that the frameworks developers use to make their content interactive and manage state are overkill. It's like needing to display today's date on the page and downloading an entire date library to do it when you can just do "Date();"
- toyg 10y ago
  They are two distinct problems, but they are both problems. Problem 1: A text-sharing platform was coerced into being a sandboxed pseudo-distributed virtual machine. Problem 2: The way this virtual machine is built and re-built for each "app" is terrible (wasteful, overkill, overbearing). You might think 1) is a fait accompli, but it continues to impact and create issues downstream in so many areas (security, privacy, usability etc etc) because the platform was simply not built for what we're making it do.
  - Klathmon 10y ago
    But both of those problems aren't problems, they are solutions to problems. When I make a web app, it's specifically because i want it to run in a sandboxed pseudo-distributed virtual machine that installs and runs in less than a second, and is removed automatically after some time has passed. My users don't want to download and install a binary onto their PC, they don't want to have to manage any dependencies I may rely on, they don't want to have to configure anything, they just want to use my app ASAP in a safe manner and then go on with their lives. If i gave you 2 options, which would you choose? 1. Download and execute this binary blob on your PC. 2. Run this javascript in your browser. Option 1 provides little protection. I could access GPS, camera, microphone, disk, etc... without as much as a single prompt. And if the PC's permissions are messed up, i can even access other programs' data and even manipulate them. Option 2 provides permission-locked options to access a lot of those, in a language which was designed to be sandboxed, in a browser with exactly the same amount of permissions as Option 1 (so even if all the permission-locking measures failed or were bypassed, the app is still bound by the same permissions and restrictions as option 1 would be). It installs itself in seconds, it runs fast enough for most use cases, and is cross-platform in a way that nothing else ever has been able to even come close to before.
    - toyg 10y ago
      Please, let's not try to justify post-facto what is an utter accident of history. Javascript wasn't "designed to be sandboxed", it was designed (in something like a week) to move crap around an html page. It then grew and mutated in the frankenvm we all "enjoy" today; which is why all these "security features" that were tacked on (like xmlhttprequest, same-origin, "secure cookies" etc etc) are constantly failing and require more and more hacks to keep up appearances. > My users don't want to download and install a binary onto their PC Your users were absolutely fine with Flash, and if Macromedia had not gone to the dogs after the Adobe acquisition, they would likely still be. They were fine with ActiveX objects (in fact, they loved them!). Your users don't know the difference between markup and binary blobs, they just don't care. By shoving scripts down their throat "because the browser starts faster than a java applet", we simply abuse their good faith. Maybe you could have claimed "javascript is more secure" back in 2001, when 99.99% of scripts out there were perfectly readable with view-source; in the age of minifying, obscuring and compiling, that's simply not true anymore. Javascript is now effectively the same as a binary blob, the only difference being that Google, Microsoft and Mozilla do some of the bootstrapping for you. Hell, even HTTP/2 is now binary! Please, don't try to claim a moral high ground that was lost 10 years ago. We've decided to abuse the browser-donkey, fine; but let's not delude ourselves that there was some grand design or logic behind it all. > Option 1 provides little protection. I could access GPS, camera, microphone, disk, etc Yeah, because the browser today cannot access GPS, camera, microphone, disk... oh wait. In Microsoft land, the browser can even bork your entire system! These problems are problems because we're using the wrong tools to find solutions to a different class of problems altogether. In so doing, we've perverted what was a wonderful document-oriented system. The browser was not born to run apps, but we've decided it's good enough to do it anyway, logic be damned. This comes to mind: https://www.youtube.com/watch?v=aXQ2lO3ieBA https://www.youtube.com/watch?v=aXQ2lO3ieBA
      - Klathmon 10y ago
        Saying javascript was designed in a week is incredibly disingenuous. Literally nobody is using the javascript that was designed in a week, in fact the language that was designed in a week was called mocha. Javascript (in name or in spirit) wasn't even included in the browser until at least a year (and several revisions) after it was written in "a week". >all these "security features" that were tacked on (like xmlhttprequest, same-origin, "secure cookies" etc etc) are constantly failing and require more and more hacks to keep up appearances. I don't see those security features or anything like them in any other platform, and that's my point. Regardless of how we got here, the browser is a platform that i feel MOST comfortable executing random code from the internet on because of those restrictions. If i'm going to execute code, the next best alternative is pretty poor. Obviously they aren't perfect, but they are more things that need to fail in order for something bad to happen. Also, since when is an evolution of a product considered "more and more hacks"? Is anything that wasn't included in Linux 1.0 a hack? > Javascript is now effectively the same as a binary blob I 100% agree that modern JS payloads are basically binary blobs at this point, that's why i compared them to binary blobs... I'm saying that the language (more the "standard library" that js running in the browser has access to) is meant to be run by everyone in a secure and safe manner. That is something that just about no other language/platform is designed to do today. Yes, there are ways you could make something like python for instance safe enough to allow random websites to execute code on your PC, but that is going to be much riskier because the language is not meant to be run that way (not to mention that it won't be even within a few magnitudes as "battle tested" as javascript is). >Yeah, because the browser today cannot access GPS, camera, microphone, disk... oh wait. You can't just quote the parts of the sentence you like and ignore the rest. The very next words were "without a single prompt". The browser has those features and more permission-locked (and more recently enabled only for TLS secured pages), just about all desktop platforms don't even have the concept of "access to webcam" permissions, most mobile platforms are pretty on-par in this aspect, but even they don't have restrictions like requiring the user confirm if the app wants to store more than like 10mb of data on the disk in a permanent manner (which all major browsers do). >In Microsoft land, the browser can even bork your entire system! And i'm in no way advocating for that... Most of the web community and all browser vendors are moving away from dangerous plugins/extensions like those that were used in the 90's and early 2000's. Bringing up microsoft specific extensions like activex (or even flash!) in a discussion about web development in 2016 is just building yourself a strawman to kick down. That's not web development any more than running a program in x86 real mode is current desktop application programming. >In so doing, we've perverted what was a wonderful document-oriented system. That wonderful document-oriented system still works just fine. I get that you don't like the web, but arguing that it was a mistake is completely missing the point. The language and the platform has evolved since it's inception, and these evolutions aren't mistakes, they are changes made by all major browser vendors as well as multiple standards bodies in an effort to improve it. You may not like that it's changing, but it's no mistake. Javascript is designed to be a sandboxed, quick, programming language regardless of what it's "first inception" was meant to be, and the web is designed to be an application platform regardless of how much you don't want it to be one.

Yes, and most of them shouldn't be.

by myrion 10y ago

Yes, and most of them shouldn't be.

That's not the problem. The problem is that the frameworks developers use to make their content interactive and manage state are overkill. It's like needing to display today's date on the page and downloading an entire date library to do it when you can just do "Date();"

toyg 10y ago
They are two distinct problems, but they are both problems. Problem 1: A text-sharing platform was coerced into being a sandboxed pseudo-distributed virtual machine. Problem 2: The way this virtual machine is built and re-built for each "app" is terrible (wasteful, overkill, overbearing). You might think 1) is a fait accompli, but it continues to impact and create issues downstream in so many areas (security, privacy, usability etc etc) because the platform was simply not built for what we're making it do.
- Klathmon 10y ago
  But both of those problems aren't problems, they are solutions to problems. When I make a web app, it's specifically because i want it to run in a sandboxed pseudo-distributed virtual machine that installs and runs in less than a second, and is removed automatically after some time has passed. My users don't want to download and install a binary onto their PC, they don't want to have to manage any dependencies I may rely on, they don't want to have to configure anything, they just want to use my app ASAP in a safe manner and then go on with their lives. If i gave you 2 options, which would you choose? 1. Download and execute this binary blob on your PC. 2. Run this javascript in your browser. Option 1 provides little protection. I could access GPS, camera, microphone, disk, etc... without as much as a single prompt. And if the PC's permissions are messed up, i can even access other programs' data and even manipulate them. Option 2 provides permission-locked options to access a lot of those, in a language which was designed to be sandboxed, in a browser with exactly the same amount of permissions as Option 1 (so even if all the permission-locking measures failed or were bypassed, the app is still bound by the same permissions and restrictions as option 1 would be). It installs itself in seconds, it runs fast enough for most use cases, and is cross-platform in a way that nothing else ever has been able to even come close to before.
  - toyg 10y ago
    Please, let's not try to justify post-facto what is an utter accident of history. Javascript wasn't "designed to be sandboxed", it was designed (in something like a week) to move crap around an html page. It then grew and mutated in the frankenvm we all "enjoy" today; which is why all these "security features" that were tacked on (like xmlhttprequest, same-origin, "secure cookies" etc etc) are constantly failing and require more and more hacks to keep up appearances. > My users don't want to download and install a binary onto their PC Your users were absolutely fine with Flash, and if Macromedia had not gone to the dogs after the Adobe acquisition, they would likely still be. They were fine with ActiveX objects (in fact, they loved them!). Your users don't know the difference between markup and binary blobs, they just don't care. By shoving scripts down their throat "because the browser starts faster than a java applet", we simply abuse their good faith. Maybe you could have claimed "javascript is more secure" back in 2001, when 99.99% of scripts out there were perfectly readable with view-source; in the age of minifying, obscuring and compiling, that's simply not true anymore. Javascript is now effectively the same as a binary blob, the only difference being that Google, Microsoft and Mozilla do some of the bootstrapping for you. Hell, even HTTP/2 is now binary! Please, don't try to claim a moral high ground that was lost 10 years ago. We've decided to abuse the browser-donkey, fine; but let's not delude ourselves that there was some grand design or logic behind it all. > Option 1 provides little protection. I could access GPS, camera, microphone, disk, etc Yeah, because the browser today cannot access GPS, camera, microphone, disk... oh wait. In Microsoft land, the browser can even bork your entire system! These problems are problems because we're using the wrong tools to find solutions to a different class of problems altogether. In so doing, we've perverted what was a wonderful document-oriented system. The browser was not born to run apps, but we've decided it's good enough to do it anyway, logic be damned. This comes to mind: https://www.youtube.com/watch?v=aXQ2lO3ieBA https://www.youtube.com/watch?v=aXQ2lO3ieBA
    - Klathmon 10y ago
      Saying javascript was designed in a week is incredibly disingenuous. Literally nobody is using the javascript that was designed in a week, in fact the language that was designed in a week was called mocha. Javascript (in name or in spirit) wasn't even included in the browser until at least a year (and several revisions) after it was written in "a week". >all these "security features" that were tacked on (like xmlhttprequest, same-origin, "secure cookies" etc etc) are constantly failing and require more and more hacks to keep up appearances. I don't see those security features or anything like them in any other platform, and that's my point. Regardless of how we got here, the browser is a platform that i feel MOST comfortable executing random code from the internet on because of those restrictions. If i'm going to execute code, the next best alternative is pretty poor. Obviously they aren't perfect, but they are more things that need to fail in order for something bad to happen. Also, since when is an evolution of a product considered "more and more hacks"? Is anything that wasn't included in Linux 1.0 a hack? > Javascript is now effectively the same as a binary blob I 100% agree that modern JS payloads are basically binary blobs at this point, that's why i compared them to binary blobs... I'm saying that the language (more the "standard library" that js running in the browser has access to) is meant to be run by everyone in a secure and safe manner. That is something that just about no other language/platform is designed to do today. Yes, there are ways you could make something like python for instance safe enough to allow random websites to execute code on your PC, but that is going to be much riskier because the language is not meant to be run that way (not to mention that it won't be even within a few magnitudes as "battle tested" as javascript is). >Yeah, because the browser today cannot access GPS, camera, microphone, disk... oh wait. You can't just quote the parts of the sentence you like and ignore the rest. The very next words were "without a single prompt". The browser has those features and more permission-locked (and more recently enabled only for TLS secured pages), just about all desktop platforms don't even have the concept of "access to webcam" permissions, most mobile platforms are pretty on-par in this aspect, but even they don't have restrictions like requiring the user confirm if the app wants to store more than like 10mb of data on the disk in a permanent manner (which all major browsers do). >In Microsoft land, the browser can even bork your entire system! And i'm in no way advocating for that... Most of the web community and all browser vendors are moving away from dangerous plugins/extensions like those that were used in the 90's and early 2000's. Bringing up microsoft specific extensions like activex (or even flash!) in a discussion about web development in 2016 is just building yourself a strawman to kick down. That's not web development any more than running a program in x86 real mode is current desktop application programming. >In so doing, we've perverted what was a wonderful document-oriented system. That wonderful document-oriented system still works just fine. I get that you don't like the web, but arguing that it was a mistake is completely missing the point. The language and the platform has evolved since it's inception, and these evolutions aren't mistakes, they are changes made by all major browser vendors as well as multiple standards bodies in an effort to improve it. You may not like that it's changing, but it's no mistake. Javascript is designed to be a sandboxed, quick, programming language regardless of what it's "first inception" was meant to be, and the web is designed to be an application platform regardless of how much you don't want it to be one.