5 ms·

The "modern" Javascript parts make me almost physically sick. Gimme back my plain old browser Javascript. It was primitive, but at least it wasn't actively har

The "modern" Javascript parts make me almost physically sick. Gimme back my plain old browser Javascript. It was primitive, but at least it wasn't actively harmful.

debaserab2 7y ago
Care to elaborate? "Modern" javascript runs just fine in your plain old browser.
- s_Hogg 7y ago
  Parent is talking about all the vulnerabilities and slowness that can come with it. Fair enough, it runs, but it can also open the door to fingerprinting and other weird nasties. Particularly anything reliant on the `npm install` way of managing dependencies is a potential risk from both server and client point of view.
  - debaserab2 7y ago
    Where is parent talking about any of that? What about today's javascript lends itself to fingerprinting any more than javascript from twenty years ago?
    - mattlondon 7y ago
      Agreed - I don't see how adding things like "let" instead of "var" or the spread operator (e.g "[...x]" instead of "[].concat(x)") makes fingerprinting or anything nefarious any more likely, apart from making it more pleasant to program so maybe more people will use it? The "old" javascript was turing complete (as the article points out), as is the current one. It is not like they've added "Object.turnOnNefariousPrivacyInvasions()". Granted, the browser APIs have evolved (e.g. webcam access, localstorage etc) and are exposed via Javascript, but that is nothing to do with JS the language.
      - SquareWheel 7y ago
        Those APIs also have a much stronger security model behind them today. Browsers require things like TLS and user confirmation before sharing geo information. Other actions like the clipboard API require user interaction (eg. button clicks). JS of the past was the wild west. You want to add a bookmark? Go for it! You want to trigger a print dialogue? Why not!
        krapp 7y ago
        >JS of the past was the wild west. You want to add a bookmark? Go for it! You want to trigger a print dialogue? Why not! Yeah. People forget that in the bad old days you could even do things like redefine the global Array constructor[0]. [0]https://johnresig.com/blog/re-securing-json/ https://johnresig.com/blog/re-securing-json/
      - xthestreams 7y ago
        While I fully agree with you, being Turing complete has nothing to do with it. I think the article is slightly wrong too on this point. Turing completeness is a property about the computational "power" of a language. It has nothing to do with the environment in which the program runs. For example, it can exist a language that is Turing complete and has no way at all to access the network: it can do no harm, doesn't matter if it has the same computational power as Javascript.

The "modern" Javascript parts make me almost physically sick. Gimme back my plain old browser Javascript. It was primitive, but at least it wasn't actively harmful.

debaserab2 7y ago

Care to elaborate? "Modern" javascript runs just fine in your plain old browser.

s_Hogg 7y ago
Parent is talking about all the vulnerabilities and slowness that can come with it. Fair enough, it runs, but it can also open the door to fingerprinting and other weird nasties. Particularly anything reliant on the `npm install` way of managing dependencies is a potential risk from both server and client point of view.
- debaserab2 7y ago
  Where is parent talking about any of that? What about today's javascript lends itself to fingerprinting any more than javascript from twenty years ago?
  - mattlondon 7y ago
    Agreed - I don't see how adding things like "let" instead of "var" or the spread operator (e.g "[...x]" instead of "[].concat(x)") makes fingerprinting or anything nefarious any more likely, apart from making it more pleasant to program so maybe more people will use it? The "old" javascript was turing complete (as the article points out), as is the current one. It is not like they've added "Object.turnOnNefariousPrivacyInvasions()". Granted, the browser APIs have evolved (e.g. webcam access, localstorage etc) and are exposed via Javascript, but that is nothing to do with JS the language.
    - SquareWheel 7y ago
      Those APIs also have a much stronger security model behind them today. Browsers require things like TLS and user confirmation before sharing geo information. Other actions like the clipboard API require user interaction (eg. button clicks). JS of the past was the wild west. You want to add a bookmark? Go for it! You want to trigger a print dialogue? Why not!
      - krapp 7y ago
        >JS of the past was the wild west. You want to add a bookmark? Go for it! You want to trigger a print dialogue? Why not! Yeah. People forget that in the bad old days you could even do things like redefine the global Array constructor[0]. [0]https://johnresig.com/blog/re-securing-json/ https://johnresig.com/blog/re-securing-json/
    - xthestreams 7y ago
      While I fully agree with you, being Turing complete has nothing to do with it. I think the article is slightly wrong too on this point. Turing completeness is a property about the computational "power" of a language. It has nothing to do with the environment in which the program runs. For example, it can exist a language that is Turing complete and has no way at all to access the network: it can do no harm, doesn't matter if it has the same computational power as Javascript.