3 ms·

It's ActiveX, but completely secure and open source. Sounds like a good idea. Regardless, it's pretty much already been killed. Too bad it's taken 8 years for

by espes 9y ago

It's ActiveX, but completely secure and open source. Sounds like a good idea. Regardless, it's pretty much already been killed. Too bad it's taken 8 years for a web standard (WebAssembly) to match it.

Aaargh20318 9y ago
> completely secure Yeah, there has never been a case of software breaking out of a sandbox or VM. Fact is it allows running native x86 code downloaded from the internet, it's orders of magnitude more dangerous than e.g. Javascript running inside a sandboxed runtime.
- espes 9y ago
  Why do you think that? There's been way more bugs in V8 over the years than the NaCl core sandbox.
  - Aaargh20318 9y ago
    I'm not sure why you're trying to say ? Two wrongs make a right ? For the record: I think that JS is a horrible idea too. What happened to the old rule of thumb that once you let someone else run their own code on your machine you should consider it compromised ?
    - Dylan16807 9y ago
      Depending on your requirements, it can be really easy to sandbox code. I could write a simple virtual machine in an hour or two that's more secure than your typical jpeg decoder. So it's really worth looking at exactly what kind of sandboxing and complexity is involved.
    - VMG 9y ago
      > What happened to the old rule of thumb People realized it's a stupid and impractical rule and ignored it.
      - phkahler 9y ago
        >> People realized it's a stupid and impractical rule and ignored it. If by "people" you mean developers, and by "stupid and impractical" you mean inconvenient.
        joshuamorton 9y ago
        Given that your rule of thumb is one that only developers would know or care about, yes...exactly. Developers realized that their rule was stupid and impractical (not just inconvenient, but actively impractical: async interaction is faster and requires js), and so ignored it.
    - danellis 9y ago
      People stopped following that rule sometime around the time the computer was invented.
  - simonh 9y ago
    And now we have browsers with both sets of bugs instead of only one. Lucky us.

by espes 9y ago

Aaargh20318 9y ago

> completely secure Yeah, there has never been a case of software breaking out of a sandbox or VM. Fact is it allows running native x86 code downloaded from the internet, it's orders of magnitude more dangerous than e.g. Javascript running inside a sandboxed runtime.

espes 9y ago
Why do you think that? There's been way more bugs in V8 over the years than the NaCl core sandbox.
- Aaargh20318 9y ago
  I'm not sure why you're trying to say ? Two wrongs make a right ? For the record: I think that JS is a horrible idea too. What happened to the old rule of thumb that once you let someone else run their own code on your machine you should consider it compromised ?
  - Dylan16807 9y ago
    Depending on your requirements, it can be really easy to sandbox code. I could write a simple virtual machine in an hour or two that's more secure than your typical jpeg decoder. So it's really worth looking at exactly what kind of sandboxing and complexity is involved.
  - VMG 9y ago
    > What happened to the old rule of thumb People realized it's a stupid and impractical rule and ignored it.
    - phkahler 9y ago
      >> People realized it's a stupid and impractical rule and ignored it. If by "people" you mean developers, and by "stupid and impractical" you mean inconvenient.
      - joshuamorton 9y ago
        Given that your rule of thumb is one that only developers would know or care about, yes...exactly. Developers realized that their rule was stupid and impractical (not just inconvenient, but actively impractical: async interaction is faster and requires js), and so ignored it.
  - danellis 9y ago
    People stopped following that rule sometime around the time the computer was invented.
- simonh 9y ago
  And now we have browsers with both sets of bugs instead of only one. Lucky us.