7 ms·

Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change anytime soon. So we are stuck with

Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change anytime soon. So we are stuck with the situation where the defenders (the hardware and software designers) have to be correct 100% of the time on a platform that is constantly changing. The attackers only need to be right once. Maybe someday everything will just be streaming video or something, but that is a long way off. As for relying on users ability to determine what code is safe to download... It's not like users can be relied on to do the right thing all the time even without javascript. People respond to phishing attacks, download executables sent to their email, reuse passwords... I think a sandbox is a better solution than relying on users to understand what code is trustworthy and what isn't.

username223 9y ago
> The web by and large requires javascript, and it's not likely to change. While I am mostly a pessimist, this is one place where I harbor a tiny sliver of optimism. Once users recognize that something is awful, and have the means to get rid of it, they eventually do so. Client side Java and Flash are dead, because everyday users figured out that they sucked, and were given the option not to use them. We're getting close to a situation where average people recognize that millisecond auctions to run arbitrary code on their machines are a bad idea, and those people also have the tools to say "no." Hope springs internal...
- EgoIncarnate 9y ago
  The users didn't make the decision, the platforms did, and the decision was made after an alternative was available in Javascript. If anyone killed Flash and Java, it was Apple by refusing to support either on the iPhone. All the users did was make popular a platform that didn't support them. If Apple had supported Flash and Java we probably would still have them. Signed code that users had to install was tried before with ActiveX. It didn't work either because you can't rely on random developers to write secure code either. It's also how IE ended up with Flash. Click here to download Flash (signed by Macromedia). So basically everything sucks because we're human and make mistakes. Maybe one day we'll have machines that reason more thoroughly than us and they can come up with a secure platform. Until then... Javascript and sandboxes.
  - username223 9y ago
    > If anyone killed Flash and Java, it was Apple by refusing to support either on the iPhone. Apple may have put the nail in the coffin, but long before that quite a few developers and users were avoiding Java programs when there were alternatives, and ClickToFlash was a popular browser plug-in. As they often do, Apple saw which way the wind was blowing.
- pjmlp 9y ago
  > Client side Java and Flash are dead Not paying attention to the news? Just wait until WebAssembly gets more mature.
  - EgoIncarnate 9y ago
    I don't think WebAssembly is going to bring back Flash or Java Applets in any meaningful way. Maybe someone will hack something together and use it for niche old Flash game sites, but it's hard to see a reason for widespread adoption of anything new. People have moved on. Flash and Java Applets may not be "dead" forever, but they also are not likely to ever be more than undead zombies.
    - pjmlp 9y ago
      Again, not paying attention to the news. http://teavm.org/ http://teavm.org/ https://forums.adobe.com/thread/2432179 https://forums.adobe.com/thread/2432179 http://www.mono-project.com/news/2017/08/09/hello-webassembly/ http://www.mono-project.com/news/2017/08/09/hello-webassembl... https://www.hanselman.com/blog/NETAndWebAssemblyIsThisTheFutureOfTheFrontend.aspx https://www.hanselman.com/blog/NETAndWebAssemblyIsThisTheFut... https://github.com/Microsoft/xaml-standard/issues/197 https://github.com/Microsoft/xaml-standard/issues/197
      - EgoIncarnate 9y ago
        I think we are talking about different things. Half your links have nothing to do with Flash or Java Applets (.net, XAML?). You seem to be talking about new platforms that may derive some part from the old. I'm not saying WebAssembly won't be used for new platforms as that's sort of the whole point of it. What I'm saying is that WebAssembly won't bring back people making Flash .swfs or writing classes derived from java.applet.Applet in any mainstream way. In that sense Flash and Java Applets are dead. Maybe someone will hack something together that allows you to run them, but that won't bring the developers back to the old platforms. If Oracle or Adobe announce something, maybe the industry will jump on board, but currently I don't see anything in your list that makes me change my mind about Flash and Java Applets being dead and not coming back.
madez 9y ago
> Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change. This fatalist stance is childish, and dangerous. As long as there are people working to make things better, things do improve. Sure, if you make sure that one small website works without JavaScript then that doesn't change the world. I hear a similiar argument when I explain why I don't eat meat; I'm told that animals will be killed anyways. But if I don't eat meat, then less will be killed. How many less? I can't specify the number, but I don't power-hungrily demand my own decision can magically change the world completely over night, and give up when I realize it doesn't. Still, each and everyones has an influence. It's about doing what's right. And even if you are the only one doing the right thing, things will be a bit better for your actions. But in fact the situation isn't that bad, and one isn't alone. > It's not like users can be relied on to do the right thing all the time anyway. So, if you aren't sure you locked the front door of your house, then it also doesn't matter if you left the door to the garden open? Clearly it does matter! This fatalism deems us into inaction and into accepting the status quo even if we know it's bad.
- EgoIncarnate 9y ago
  >> Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change. >This fatalist stance is childish, and dangerous. As long as there are people working to make things better, things do improve. How is it any more of a fatalist stance than the idea that javascript or running untrusted code in a sandbox is fundamentally broken? Personally I think it's easier and more likely that we attempt to fix a few web browsers than expect millions of websites to change. You might call it fatalism, but I think of it as realism. >> It's not like users can be relied on to do the right thing all the time anyway. > So, if you aren't sure you locked the front door of your house, then it also doesn't matter if you left the door to the garden open? Clearly not! My point was not that security is useless because users are unreliable. My point was that it's better to keep the kids in the sandbox, than to have them play in a busy street. Security should be preserved in spite of users actions, not rely on them.
  - madez 9y ago
pjmlp 9y ago
Depends, I white list JavaScript on the web sites I thrust, and use native apps when given the option. On the OSes I use, I make sure all sandbox options are turned on.
- EgoIncarnate 9y ago
  Would you consider yourself a typical example of a naive user? The security default needs to work for everyone. I think the sandbox approach is better than expecting everyone to correctly decide when it is or isn't okay to allow a site to run code.
  - pjmlp 9y ago
    Yes in the context of iOS, Android and UWP native apps.
    - EgoIncarnate 9y ago
      You must run in much better circles than I do. Nevermind a naive user, the average users I know wouldn't know how to disable javascript, or whitelist sites, or that there even were sandbox settings in the OS. Some of the older people I know can't even correctly choose between between writing a text message, and a facebook post. If you think you are a typical example of a naive user, I would hate to see what you expect of the average user.
      - pjmlp 9y ago
        You completely misunderstood me. iOS, Android and UWP sandboxes for native apps are always enabled, there isn't any configuration for naive user available. You just allow or not the access to specific actions and that's it. On UWP you cannot even access files directly, the user has to select them for your application. You can only change the way sandboxes behave via developer settings, but that is only in the context of debugging, which naive users will never do anyway.
jpttsn 9y ago
Not sure it’s a genie situation. Look at Java applets, Flash player.
- EgoIncarnate 9y ago
  The situation is apples and oranges. Dumping Flash and Java took years, and was driven by rapid adoption of mobile devices that either didn't support them at all (Apple) or very well (everyone else). There was an already deployed alternative (Javascript). Javascript is buried much deeper in modern websites and would be much more difficult to replace than either Flash or Java Applets were for most sites. For most sites Flash was just to play videos or display ads. Many sites only had to replace an object tag with a video tag. Java Applets were fairly niche in the first place, so aren't really comparable. In addition there isn't currently a viable alternative for Javascript. Maybe WebAssembly someday, but currently it's designed to supplement Javascript not replace it.
  - jpttsn 9y ago
    Big changes do happen and look small only in retrospect.
    - EgoIncarnate 9y ago
      But they don't happen overnight. I didn't say change wouldn't happen, I said it wasn't likely to happen anytime soon.
      - jpttsn 9y ago
        Let the record note my gripe was only with the genie/bottle wording, which indicates an irreversible change :)

username223 9y ago

> The web by and large requires javascript, and it's not likely to change. While I am mostly a pessimist, this is one place where I harbor a tiny sliver of optimism. Once users recognize that something is awful, and have the means to get rid of it, they eventually do so. Client side Java and Flash are dead, because everyday users figured out that they sucked, and were given the option not to use them. We're getting close to a situation where average people recognize that millisecond auctions to run arbitrary code on their machines are a bad idea, and those people also have the tools to say "no." Hope springs internal...

EgoIncarnate 9y ago
The users didn't make the decision, the platforms did, and the decision was made after an alternative was available in Javascript. If anyone killed Flash and Java, it was Apple by refusing to support either on the iPhone. All the users did was make popular a platform that didn't support them. If Apple had supported Flash and Java we probably would still have them. Signed code that users had to install was tried before with ActiveX. It didn't work either because you can't rely on random developers to write secure code either. It's also how IE ended up with Flash. Click here to download Flash (signed by Macromedia). So basically everything sucks because we're human and make mistakes. Maybe one day we'll have machines that reason more thoroughly than us and they can come up with a secure platform. Until then... Javascript and sandboxes.
- username223 9y ago
  > If anyone killed Flash and Java, it was Apple by refusing to support either on the iPhone. Apple may have put the nail in the coffin, but long before that quite a few developers and users were avoiding Java programs when there were alternatives, and ClickToFlash was a popular browser plug-in. As they often do, Apple saw which way the wind was blowing.
pjmlp 9y ago
> Client side Java and Flash are dead Not paying attention to the news? Just wait until WebAssembly gets more mature.
- EgoIncarnate 9y ago
  I don't think WebAssembly is going to bring back Flash or Java Applets in any meaningful way. Maybe someone will hack something together and use it for niche old Flash game sites, but it's hard to see a reason for widespread adoption of anything new. People have moved on. Flash and Java Applets may not be "dead" forever, but they also are not likely to ever be more than undead zombies.
  - pjmlp 9y ago
    Again, not paying attention to the news. http://teavm.org/ http://teavm.org/ https://forums.adobe.com/thread/2432179 https://forums.adobe.com/thread/2432179 http://www.mono-project.com/news/2017/08/09/hello-webassembly/ http://www.mono-project.com/news/2017/08/09/hello-webassembl... https://www.hanselman.com/blog/NETAndWebAssemblyIsThisTheFutureOfTheFrontend.aspx https://www.hanselman.com/blog/NETAndWebAssemblyIsThisTheFut... https://github.com/Microsoft/xaml-standard/issues/197 https://github.com/Microsoft/xaml-standard/issues/197
    - EgoIncarnate 9y ago
      I think we are talking about different things. Half your links have nothing to do with Flash or Java Applets (.net, XAML?). You seem to be talking about new platforms that may derive some part from the old. I'm not saying WebAssembly won't be used for new platforms as that's sort of the whole point of it. What I'm saying is that WebAssembly won't bring back people making Flash .swfs or writing classes derived from java.applet.Applet in any mainstream way. In that sense Flash and Java Applets are dead. Maybe someone will hack something together that allows you to run them, but that won't bring the developers back to the old platforms. If Oracle or Adobe announce something, maybe the industry will jump on board, but currently I don't see anything in your list that makes me change my mind about Flash and Java Applets being dead and not coming back.

madez 9y ago

> Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change. This fatalist stance is childish, and dangerous. As long as there are people working to make things better, things do improve. Sure, if you make sure that one small website works without JavaScript then that doesn't change the world. I hear a similiar argument when I explain why I don't eat meat; I'm told that animals will be killed anyways. But if I don't eat meat, then less will be killed. How many less? I can't specify the number, but I don't power-hungrily demand my own decision can magically change the world completely over night, and give up when I realize it doesn't. Still, each and everyones has an influence. It's about doing what's right. And even if you are the only one doing the right thing, things will be a bit better for your actions. But in fact the situation isn't that bad, and one isn't alone. > It's not like users can be relied on to do the right thing all the time anyway. So, if you aren't sure you locked the front door of your house, then it also doesn't matter if you left the door to the garden open? Clearly it does matter! This fatalism deems us into inaction and into accepting the status quo even if we know it's bad.

EgoIncarnate 9y ago
>> Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change. >This fatalist stance is childish, and dangerous. As long as there are people working to make things better, things do improve. How is it any more of a fatalist stance than the idea that javascript or running untrusted code in a sandbox is fundamentally broken? Personally I think it's easier and more likely that we attempt to fix a few web browsers than expect millions of websites to change. You might call it fatalism, but I think of it as realism. >> It's not like users can be relied on to do the right thing all the time anyway. > So, if you aren't sure you locked the front door of your house, then it also doesn't matter if you left the door to the garden open? Clearly not! My point was not that security is useless because users are unreliable. My point was that it's better to keep the kids in the sandbox, than to have them play in a busy street. Security should be preserved in spite of users actions, not rely on them.
- madez 9y ago

pjmlp 9y ago

Depends, I white list JavaScript on the web sites I thrust, and use native apps when given the option. On the OSes I use, I make sure all sandbox options are turned on.

EgoIncarnate 9y ago
Would you consider yourself a typical example of a naive user? The security default needs to work for everyone. I think the sandbox approach is better than expecting everyone to correctly decide when it is or isn't okay to allow a site to run code.
- pjmlp 9y ago
  Yes in the context of iOS, Android and UWP native apps.
  - EgoIncarnate 9y ago
    You must run in much better circles than I do. Nevermind a naive user, the average users I know wouldn't know how to disable javascript, or whitelist sites, or that there even were sandbox settings in the OS. Some of the older people I know can't even correctly choose between between writing a text message, and a facebook post. If you think you are a typical example of a naive user, I would hate to see what you expect of the average user.
    - pjmlp 9y ago
      You completely misunderstood me. iOS, Android and UWP sandboxes for native apps are always enabled, there isn't any configuration for naive user available. You just allow or not the access to specific actions and that's it. On UWP you cannot even access files directly, the user has to select them for your application. You can only change the way sandboxes behave via developer settings, but that is only in the context of debugging, which naive users will never do anyway.

jpttsn 9y ago

Not sure it’s a genie situation. Look at Java applets, Flash player.

EgoIncarnate 9y ago
The situation is apples and oranges. Dumping Flash and Java took years, and was driven by rapid adoption of mobile devices that either didn't support them at all (Apple) or very well (everyone else). There was an already deployed alternative (Javascript). Javascript is buried much deeper in modern websites and would be much more difficult to replace than either Flash or Java Applets were for most sites. For most sites Flash was just to play videos or display ads. Many sites only had to replace an object tag with a video tag. Java Applets were fairly niche in the first place, so aren't really comparable. In addition there isn't currently a viable alternative for Javascript. Maybe WebAssembly someday, but currently it's designed to supplement Javascript not replace it.
- jpttsn 9y ago
  Big changes do happen and look small only in retrospect.
  - EgoIncarnate 9y ago
    But they don't happen overnight. I didn't say change wouldn't happen, I said it wasn't likely to happen anytime soon.
    - jpttsn 9y ago
      Let the record note my gripe was only with the genie/bottle wording, which indicates an irreversible change :)