3 ms·
I've never been impressed by the argument that JavaScript is somehow less secure than native apps (which are still mostly written in C, and which have full acc
by Turing_Machine 7y ago
I've never been impressed by the argument that JavaScript is somehow less secure than native apps (which are still mostly written in C, and which have full access to the hardware by default).
The mere fact that JavaScript doesn't have unchecked array bounds eliminates about 70% of the really serious security hacks of the last 30 years.
- jakelazaroff 7y agoOn the other hand, JavaScript is executed automatically; your native app needs to be downloaded and run manually.
- Turing_Machine 7y agoA fair point, but we both know there's no shortage of people who will click on a link to an executable and then blindly run it, especially if it purports to be from "Microsoft Technical Support" or "Amazon Security" or some such.
- hombre_fatal 7y agoBut you have a lot of control over the web browser. You can run zero Javascript. You can write extensions. You can easily see network traffic and conditionally block it. You can block Google Analytics. With native apps, you have very little control. You basically either run it or you don't. You can't just pick the parts you want to run. And you need to use a mitm proxy just to see what it's doing. The OS gives you no power here unlike the browser. A native app can send a request to Google Analytics on every keystroke and it's nontrivial to find that out compared to opening a browser's network tab. Native apps have some advantages like performance, but they are no free lunch, especially when it comes to privacy.