6 ms·

running untrusted code is a fundamental part of our daily experience. If you kill the webs ability to do that, people will build something else. The we have t

running untrusted code is a fundamental part of our daily experience. If you kill the webs ability to do that, people will build something else. The we have to go through the rigmarole of securing this whole new platform with the same bugs but in different ways. Instead of neutering the web, let's build secure cpus.

cm2187 9y ago
No, drop down menus, pre-validation of forms, adaptive rendering are the daily experience. Javascript is just the way we currently achieve that. I argue that a better html would avoid having to do this in javascript, as these are standard features that are needed everywhere. And even if Intel comes up with a new design available for sale next month, we will still be stuck for many years with this flaw on all the devices out there. We also need to fix CPUs, but that’s a very long term solution.
- deleted 9y ago
  [deleted]
- littlestymaar 9y ago
  > No, drop down menus, pre-validation of forms, adaptive rendering are the daily experience. Javascript is just the way we currently achieve that. I argue that a better html would avoid having to do this in javascript, as these are standard features that are needed everywhere. You can certainly standardize a certain set of feature and put them in a non-turing-complete language like HTML, but standardizing all the legitimate use-cases of JavaScript is almost impossible, you talked about «drop-down menus, form validation or adaptive rendering», but what about interactive charting, modal view of full-size pictures, auto-completion of search tags ? These are just features I use on my personal blog ! And what about infinite-scrolling ? What about partial content-update ? There are thousands of legitimate use-case for JavaScript: it's not achievable to standardize every single one of them and put it in the HTML, and even if it were possible, do you imagine the nightmare it would be to learn HTML then ?
  - deleted 9y ago
    [deleted]
  - madez 9y ago
    > but standardizing all the legitimate use-cases of JavaScript is almost impossible I see the problem of not always having the newest technologies in browsers, but the pain of that problem vanishes the more we already have. One might say that securing JavaScript sandboxes is almost impossible, but still we are working on it. Let's work in the same spirit on advancing the open web :-)
  - bennofs 9y ago
    > non-turing-complete language like HTML I would be careful about that: It wouldn't suprise me if HTML with CSS (at least with all the new things like animations) is turing complete (it probably is).
    - robin_reala 9y ago
      ‘You can encode Rule 110 in CSS3, so it's Turing-complete so long as you consider an appropriate accompanying HTML file and user interactions to be part of the “execution” of CSS.’ https://stackoverflow.com/a/5239256/453783 https://stackoverflow.com/a/5239256/453783
- netcraft 9y ago
  If history is any indication, getting browsers to design, agree upon, and implement "better html" would take about as long as fixing cpus.
cabalamat 9y ago
> Instead of neutering the web If you took JSW off of most websites, it wouldn't be neutering the web it'd be making it better.
- littlestymaar 9y ago
  A taxidermist could argue that dead animals are better than living ones : they are indeed more convenient, less dangerous and cheaper to feed. But they aren't animal anymore, are they ?
  - letsgetphysITal 9y ago
    Absolutely true. However, I'm not also not likely to find my stuffed cat slowed to a crawl and using all my electricity by mining Bitcoin because some 3rd party advertising network got compromised. Any other daft analogies you want to use?
    - littlestymaar 9y ago
      Your stuffed cat could not, but a living cat could bring you rabies if some third party in your neighborhood got infected, that's my point ;).
      - zingmars 9y ago
        So your point is that we _should_ JavaScript?
        PuffinBlue 9y ago
        Who knows! This comment thread is so wrapped up in its own analogy i just stuffed my cat full of JavaScript.
        optimuspaul 9y ago
        I think it's obvious that the point was no javascript... but a live cat is way more fun, so I'm not on board with that.
madez 9y ago
The notion that there are so many users of digital devices and services because we are running untrusted, unaccounted code that is automatically executed is plain wrong. Hardware advanced in ways we didn't imagine in the past, and interfaces got better. Society learned about computers as they got cheaper and knowledge spread, while better software tools formed, accelerating the growth of the ecosystem. Nothing of that requires running delivered code upon visiting a random website. HTML (or whatever standard we come up with) can be expanded to add the needed features, and enrich the web that way. JavaScript is used to lock us in, exactly what the web shouldn't do.
- iovrthoughtthis 9y ago
  > HTML (or whatever standard we come up with) can be expanded to add the needed features I think it is hubris to think we can ever build a spec with all the needed features. > JavaScript is used to lock us in, exactly what the web shouldn't do. While I agree the web shouldn't lock us in I would like to understand how you think JavaScript does that?
  - madez 9y ago
    I don't think it is possible to have a spec thats always contains all the latest functionality. But that is also not necessary. The better the spec, the more problems we can solve completely. I don't think we can always support the newest latest advancement to solve the latest obscure problem, but I think it's no problem to wait a period, even if it were months or years, for it to be standardized and supported in browser. The delay is not a nuisance nor a cost without any benefit. We maintain the open trustable web by doing that. We have already a pretty good idea of what functionality we need. For example, we can look at what common JavaScript frameworks solve, and think about what we should standardized from that. Nobody did that so far, but we totally could, and should.
    - iovrthoughtthis 9y ago
      Waiting months and years for features that your site or app depends on is unacceptable. > We have already a pretty good idea of what functionality we need. For example, we can look at what common JavaScript frameworks solve, and think about what we should standardized from that. Nobody did that so far, but we totally could, and should. And once we have captured those concept, what then? Where do we mine the new concepts, designs, behaviours that will need to be introduced to the spec and implemented by each browser vendor individually?

cm2187 9y ago

No, drop down menus, pre-validation of forms, adaptive rendering are the daily experience. Javascript is just the way we currently achieve that. I argue that a better html would avoid having to do this in javascript, as these are standard features that are needed everywhere. And even if Intel comes up with a new design available for sale next month, we will still be stuck for many years with this flaw on all the devices out there. We also need to fix CPUs, but that’s a very long term solution.

deleted 9y ago
[deleted]
littlestymaar 9y ago
> No, drop down menus, pre-validation of forms, adaptive rendering are the daily experience. Javascript is just the way we currently achieve that. I argue that a better html would avoid having to do this in javascript, as these are standard features that are needed everywhere. You can certainly standardize a certain set of feature and put them in a non-turing-complete language like HTML, but standardizing all the legitimate use-cases of JavaScript is almost impossible, you talked about «drop-down menus, form validation or adaptive rendering», but what about interactive charting, modal view of full-size pictures, auto-completion of search tags ? These are just features I use on my personal blog ! And what about infinite-scrolling ? What about partial content-update ? There are thousands of legitimate use-case for JavaScript: it's not achievable to standardize every single one of them and put it in the HTML, and even if it were possible, do you imagine the nightmare it would be to learn HTML then ?
- deleted 9y ago
  [deleted]
- madez 9y ago
  > but standardizing all the legitimate use-cases of JavaScript is almost impossible I see the problem of not always having the newest technologies in browsers, but the pain of that problem vanishes the more we already have. One might say that securing JavaScript sandboxes is almost impossible, but still we are working on it. Let's work in the same spirit on advancing the open web :-)
- bennofs 9y ago
  > non-turing-complete language like HTML I would be careful about that: It wouldn't suprise me if HTML with CSS (at least with all the new things like animations) is turing complete (it probably is).
  - robin_reala 9y ago
    ‘You can encode Rule 110 in CSS3, so it's Turing-complete so long as you consider an appropriate accompanying HTML file and user interactions to be part of the “execution” of CSS.’ https://stackoverflow.com/a/5239256/453783 https://stackoverflow.com/a/5239256/453783
netcraft 9y ago
If history is any indication, getting browsers to design, agree upon, and implement "better html" would take about as long as fixing cpus.

cabalamat 9y ago

> Instead of neutering the web If you took JSW off of most websites, it wouldn't be neutering the web it'd be making it better.

littlestymaar 9y ago
A taxidermist could argue that dead animals are better than living ones : they are indeed more convenient, less dangerous and cheaper to feed. But they aren't animal anymore, are they ?
- letsgetphysITal 9y ago
  Absolutely true. However, I'm not also not likely to find my stuffed cat slowed to a crawl and using all my electricity by mining Bitcoin because some 3rd party advertising network got compromised. Any other daft analogies you want to use?
  - littlestymaar 9y ago
    Your stuffed cat could not, but a living cat could bring you rabies if some third party in your neighborhood got infected, that's my point ;).
    - zingmars 9y ago
      So your point is that we _should_ JavaScript?
      - PuffinBlue 9y ago
        Who knows! This comment thread is so wrapped up in its own analogy i just stuffed my cat full of JavaScript.
      - optimuspaul 9y ago
        I think it's obvious that the point was no javascript... but a live cat is way more fun, so I'm not on board with that.

madez 9y ago

The notion that there are so many users of digital devices and services because we are running untrusted, unaccounted code that is automatically executed is plain wrong. Hardware advanced in ways we didn't imagine in the past, and interfaces got better. Society learned about computers as they got cheaper and knowledge spread, while better software tools formed, accelerating the growth of the ecosystem. Nothing of that requires running delivered code upon visiting a random website. HTML (or whatever standard we come up with) can be expanded to add the needed features, and enrich the web that way. JavaScript is used to lock us in, exactly what the web shouldn't do.

iovrthoughtthis 9y ago
> HTML (or whatever standard we come up with) can be expanded to add the needed features I think it is hubris to think we can ever build a spec with all the needed features. > JavaScript is used to lock us in, exactly what the web shouldn't do. While I agree the web shouldn't lock us in I would like to understand how you think JavaScript does that?
- madez 9y ago
  I don't think it is possible to have a spec thats always contains all the latest functionality. But that is also not necessary. The better the spec, the more problems we can solve completely. I don't think we can always support the newest latest advancement to solve the latest obscure problem, but I think it's no problem to wait a period, even if it were months or years, for it to be standardized and supported in browser. The delay is not a nuisance nor a cost without any benefit. We maintain the open trustable web by doing that. We have already a pretty good idea of what functionality we need. For example, we can look at what common JavaScript frameworks solve, and think about what we should standardized from that. Nobody did that so far, but we totally could, and should.
  - iovrthoughtthis 9y ago
    Waiting months and years for features that your site or app depends on is unacceptable. > We have already a pretty good idea of what functionality we need. For example, we can look at what common JavaScript frameworks solve, and think about what we should standardized from that. Nobody did that so far, but we totally could, and should. And once we have captured those concept, what then? Where do we mine the new concepts, designs, behaviours that will need to be introduced to the spec and implemented by each browser vendor individually?