3 ms·

That's not arbitrary code in the security sense though. It's the very narrow range of things which are permitted to run in a javascript sandbox (more or less "

• capableweb 6y ago
  > That's not arbitrary code in the security sense though True, you're right. > It's the very narrow range of things which are permitted to run in a javascript sandbox Well, yes and no. Narrow scope in terms of what other programming languages offer, yes. But in terms of limiting the amount of information that can leak from the user (you and your browser), it's not that narrow. And since est31 is making the privacy-argument, I'm guessing they are referring to that. Cover Your Track by EFF showcases how much information is actually leaking and what Twitter et al could do with it: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
• mindslight 6y ago
  > That's not arbitrary code in the security sense though Yes it is. It's not system level, but it is indeed arbitrary code - users have no lasting visibility into what it's doing, and little ability to control it. > It's the very narrow range of things which are permitted to run in a javascript sandbox Browsers have had a pretty naive threat model, up until recent Firefox with its new resist fingerprinting feature. Seemingly innocuous things like reporting your window size are vulnerabilities that are being used to track you, because the groups who designed the various web APIs had no security mindset besides sandboxing. One of the chief browser makers is even an unabashed surveillance company! It's going to take a long time to close or mitigate all those holes.