4 ms·

I don't know if it's still the case, but one of the first things I learned about JavaScript was how it was inherently secure. Then I actually started using the

I don't know if it's still the case, but one of the first things I learned about JavaScript was how it was inherently secure. Then I actually started using the language, and learned what utter bullshit that is.

gramstrong 9y ago
> inherently secure Who told you that? I don't think "inherently secure" is a thing in the tech industry.
- calibas 9y ago
  I was taught that Javascript is safe because it has no input/output on its own, which is essentially true, but it's dangerous to work from that assumption since in the real world a program needs to have input/output to be useful.
  - marshray 9y ago
    Node.js adds that input/output.
TheAceOfHearts 9y ago
The ECMAScript spec doesn't include details about its environment. You can run it in varying environments, each of which has different security criteria. For example, you can run a fully isolated JS VM that has no interactions with the real world, which is certainly quite safe. Node has full access to pretty much all the user's system resources, while the browser is a bit more sandboxed and restricted in what it can access.
- calibas 9y ago
  Except in the case of Spectre/Meltdown...