4 ms·
"Strong JavaScript" continues to fail this trust model even with very careful design, leading to (among other things) mitigations in the form of multiple double
by kyledrake 5y ago
"Strong JavaScript" continues to fail this trust model even with very careful design, leading to (among other things) mitigations in the form of multiple double digit performance hits to all computing. That seems more like an engineering reason to re-evaluate the status quo to me. "Web sites should be allowed to run untrustable executable code because we can manage it" feels far more ideological to me, because it's based on a belief that is becoming increasingly unfounded by the accumulating evidence.
- slver 5y agoWhen you talk about performance hit, are you under the impression that moving this to the server side would be faster? No. So what is the alternative? If you move everything to apps, apps become the vector. If you ask for explicit ok online, it becomes like the cookie dialog. Pointless. Offer an alternative.