3 ms·
Maybe because they still wanted it to be easy to use? From further down: > Getting everything to work in a context isolated world was a many month effort, whic
by Semaphor 6y ago
Maybe because they still wanted it to be easy to use? From further down:
> Getting everything to work in a context isolated world was a many month effort, which had begun long before this bug was reported to our team.
-- https://news.ycombinator.com/item?id=24823460 https://news.ycombinator.com/item?id=24823460
- pilif 6y agoI am well aware of the compatibility issues and the associated difficulties. I wasn't saying the option of turning it off shouldn't be given. I'm saying that the setting should have been mandatory. People wanting to do it the "easy" way (using scare quotes because turning any XSS into an RCE feels like hard mode to me) set contextIsolation to false and they are done. Also consider newly created applications: when the limitations exist from the start, it's much easier to build this correctly (the same way it's easier to get to 100% test coverage if you start with TDD than if you have to refactor years of static methods and global state and implicit dependencies). By having a default setting and having it default to insecure, even newly created applications will be unsafe and will require refactoring in the future.