3 ms·

Yeah there are hacks around the problem, even JS application could be downloaded to a VM that is airgapped and the sate of which is saved, and after auditing th

by maqp 5y ago

Yeah there are hacks around the problem, even JS application could be downloaded to a VM that is airgapped and the sate of which is saved, and after auditing the minified code (painful as hell) you know you can trust it on consecutive runs. This is all mostly fine but having to rely on such sandboxes isn't what we really want from security software, especially when minification makes auditing e.g. implementation of cryptographic algorithms really difficult.

zzo38computer 5y ago
One way to improve it might be to add a new JavaScript function into HTML which causes all further network access made by the current document to be blocked; the user who downloads the file can insert that command at the beginning of the file if they want to disable network access. (Since it is called before the rest of the document can change its definition, it will be effective.) (It is one of the many things which will need to be fixed in a newer web browser program, I think.)