3 ms·
> You're basically saying "let's consider reinventing the internet", which I think is not reasonable or a good idea. It's absolutely reasonable to require the
by kyledrake 5y ago
> You're basically saying "let's consider reinventing the internet", which I think is not reasonable or a good idea.
It's absolutely reasonable to require the user to give a web page permission to start executing powerful, potentially dangerous code on their computer. Also JavaScript is not "the internet", nor is it even really "the web", which for most of its history was relatively benign HTML documents that you read, and things have frankly been on a downward trajectory in terms of safety and usability since we started changing it.
Powerful JS is a relatively recent phenomenon in the history of the web, and largely under the theory that we can do it safely with correct design. As someone that has to moderate code on un-trustable web sites as part of my work, I can just say it's not working out very well, even leaving out stuff like spectre/meltdown.
- staticassertion 5y agoI don't think this would solve anything. This is like putting Word macros behind a "do you want to run this macro?". Yes, yes they do want to run it. If people were willing to put every webpage behind a "do you want to run this webpage" we'd see them all using noscript already - virtually no one wants that experience. > largely under the theory that we can do it safely with correct design I blame operating systems and hardware vendors tbh. It's their job to make this safe, and they do a pretty bad job of it. Browser vendors have had to pick up a massive amount of slack to try to compensate, to the extent that browser teams have to make major patches to the Linux kernel.