4 ms·
> But researchers found that the bug could allow malicious JavaScript to run outside of the browser on the host computer. The phrasing may unfortunately mislea
by Eikon 7y ago
> But researchers found that the bug could allow malicious JavaScript to run outside of the browser on the host computer.
The phrasing may unfortunately mislead the less technical readers of their audience.
JavaScript always runs “on the host computer”, this should be described as a sandbox escape.
- asutekku 7y agoI’d say “allowing the code to run on the host computer” is way less confusing for the less technical people than “allowing the code to run outside the sandbox”. Most people have absolutely no idea what sandboxing means.
- Eikon 7y agoIHMO lying / being vague is never good when trying to educate someone. Non-technical people are not dumb and can understand what a sandbox is.
- wtetzner 7y agoHow would they know what it is if nobody explains it to them? It's not like the term is obvious.
- warent 7y agoHave you ever read a summary of a license or a legal document? It's the same idea. Simplifying terms and using approximations so that the uninitiated can understand is not lying, it's good communication. We can't use jargon all the time.
- nine_k 7y agoYou can still cut the jargon and tell the essence. E.g. "the exploit allows malicious code to run without the confines of the browser, giving it access to everything the user normally has access to".
- chrisseaton 7y ago> JavaScript always runs “on the host computer” But they carefully qualified it with "outside of the browser [meaning sandbox]" and you left that out of your quote.
- Eikon 7y ago“Browser” does not mean “sandbox” though.
- chrisseaton 7y agoI think they're using it short for 'browser's sandbox.' Try reading it charitably rather than bending over backwards to find fault and making wild accusations of 'lying.'
- tmcb 7y agoNot really, I think. "[O]utside of the browser on the host computer" implies that there are other possible ways in which JavaScript could execute, one of those inside of the browser on the host computer, which is pretty much the expected thing and tangentially covers the concept of sandboxing.