3 ms·

JS is already treated like code you can’t trust. Adjustments will be needed from time to time. A full block would not be for engineering reasons, but for ideol

• kyledrake 5y ago
  "Strong JavaScript" continues to fail this trust model even with very careful design, leading to (among other things) mitigations in the form of multiple double digit performance hits to all computing. That seems more like an engineering reason to re-evaluate the status quo to me. "Web sites should be allowed to run untrustable executable code because we can manage it" feels far more ideological to me, because it's based on a belief that is becoming increasingly unfounded by the accumulating evidence.
  • slver 5y ago
    When you talk about performance hit, are you under the impression that moving this to the server side would be faster? No. So what is the alternative? If you move everything to apps, apps become the vector. If you ask for explicit ok online, it becomes like the cookie dialog. Pointless. Offer an alternative.