3 ms·

Wouldn't it be a bit of a security risk for browsers to let web sites specify what languages can run? Get rid of the downloadfrom attribute and select from a l

Wouldn't it be a bit of a security risk for browsers to let web sites specify what languages can run? Get rid of the downloadfrom attribute and select from a list of options acceptable to the browser. But then you have the challenge getting your favorite language accepted by all the browsers Maybe the next standard should require support for an additional language. The competition would benefit everybody. Even if we just put all the language names in a hat and pick one, we'd be on a better path than we are now.

tlrobinson 16y ago
If the other languages have the same constraints as JavaScript why would it be any less secure? The real problem is getting the language deployed on a critical mass of browsers. You can do it today by compiling to JavaScript. See: Objective-J, CoffeeScript, Gordon (Flash), GWT (Java), Pyjamas (Python), ParenScript (Lisp), HotRuby (Ruby), haXe, etc. But of course JavaScript isn't exactly the best language to target, and it could be a lot faster if there were a secure low level VM we could target. Something like the JVM, LLVM, or NativeClient. Then the language runtime could simply be downloaded the first time a page requiring the language is loaded.