5 ms·

Where is parent talking about any of that? What about today's javascript lends itself to fingerprinting any more than javascript from twenty years ago?

mattlondon 7y ago
Agreed - I don't see how adding things like "let" instead of "var" or the spread operator (e.g "[...x]" instead of "[].concat(x)") makes fingerprinting or anything nefarious any more likely, apart from making it more pleasant to program so maybe more people will use it? The "old" javascript was turing complete (as the article points out), as is the current one. It is not like they've added "Object.turnOnNefariousPrivacyInvasions()". Granted, the browser APIs have evolved (e.g. webcam access, localstorage etc) and are exposed via Javascript, but that is nothing to do with JS the language.
- SquareWheel 7y ago
  Those APIs also have a much stronger security model behind them today. Browsers require things like TLS and user confirmation before sharing geo information. Other actions like the clipboard API require user interaction (eg. button clicks). JS of the past was the wild west. You want to add a bookmark? Go for it! You want to trigger a print dialogue? Why not!
  - krapp 7y ago
    >JS of the past was the wild west. You want to add a bookmark? Go for it! You want to trigger a print dialogue? Why not! Yeah. People forget that in the bad old days you could even do things like redefine the global Array constructor[0]. [0]https://johnresig.com/blog/re-securing-json/ https://johnresig.com/blog/re-securing-json/
- xthestreams 7y ago
  While I fully agree with you, being Turing complete has nothing to do with it. I think the article is slightly wrong too on this point. Turing completeness is a property about the computational "power" of a language. It has nothing to do with the environment in which the program runs. For example, it can exist a language that is Turing complete and has no way at all to access the network: it can do no harm, doesn't matter if it has the same computational power as Javascript.

mattlondon 7y ago

Agreed - I don't see how adding things like "let" instead of "var" or the spread operator (e.g "[...x]" instead of "[].concat(x)") makes fingerprinting or anything nefarious any more likely, apart from making it more pleasant to program so maybe more people will use it? The "old" javascript was turing complete (as the article points out), as is the current one. It is not like they've added "Object.turnOnNefariousPrivacyInvasions()". Granted, the browser APIs have evolved (e.g. webcam access, localstorage etc) and are exposed via Javascript, but that is nothing to do with JS the language.

SquareWheel 7y ago
Those APIs also have a much stronger security model behind them today. Browsers require things like TLS and user confirmation before sharing geo information. Other actions like the clipboard API require user interaction (eg. button clicks). JS of the past was the wild west. You want to add a bookmark? Go for it! You want to trigger a print dialogue? Why not!
- krapp 7y ago
  >JS of the past was the wild west. You want to add a bookmark? Go for it! You want to trigger a print dialogue? Why not! Yeah. People forget that in the bad old days you could even do things like redefine the global Array constructor[0]. [0]https://johnresig.com/blog/re-securing-json/ https://johnresig.com/blog/re-securing-json/
xthestreams 7y ago
While I fully agree with you, being Turing complete has nothing to do with it. I think the article is slightly wrong too on this point. Turing completeness is a property about the computational "power" of a language. It has nothing to do with the environment in which the program runs. For example, it can exist a language that is Turing complete and has no way at all to access the network: it can do no harm, doesn't matter if it has the same computational power as Javascript.