4 ms·
It's the same for JavaScript.. without safety nets (browser sandbox), it is just a massive problem to security. Looking at the latest security issues, with Jav
by IloveHN84 8y ago
It's the same for JavaScript.. without safety nets (browser sandbox), it is just a massive problem to security.
Looking at the latest security issues, with JavaScript hackers found a faster way to break in: examples, like crypto mining in JS delivered to websites and so on
- floatboth 8y agoMining is not a security issue though. It doesn't break into anything. It just wastes CPU cycles. If by "delivered to websites" you mean without the site owner's consent, via ad networks or comments/whatever user generated content, then it's a problem of trust and/or content filtering, it's orthogonal to browser sandboxing.
- gaius 8y agoit's orthogonal to browser sandboxing Not at all, the owner of a website should not be able to coerce your browser to anything but display the page.
- floatboth 8y ago"Displaying the page" has meant "running arbitrary application code" since Netscape. If you don't agree, disable JavaScript completely and enjoy the 100% working pages everywhere ;)
- gaius 8y agoThere is a big difference between executing a little JS to do a button rollover, and performing arbitrary computation!