4 ms·

How is it weird? You literally go from > viewing text/parsing XML to > allowing remote sites to execute code on your machine, immediately when you load a sit

by thehta 5y ago

How is it weird? You literally go from > viewing text/parsing XML to > allowing remote sites to execute code on your machine, immediately when you load a site. That's quite a big jump, regardless of all the browser sandboxing.

nl 5y ago
HTML has never been XML. And HTML + CSS3 is Turing complete without Javascript anyway: https://accodeing.com/blog/2015/css3-proven-to-be-turing-complete https://accodeing.com/blog/2015/css3-proven-to-be-turing-com...
- kitsune_ 5y ago
  Amen, I think if memory serves correctly HTML was SGML inspired and once XML became popular there was a XHTML standardization push for a brief time. I think you could argue that the ubiquity of HTML led to people see value in something like XML back in the late 90's / early 00' and HTML drove XML invention and adoption and not the other way around.
jstummbillig 5y ago
In a mere 20-ish years. Crazy.
- diroussel 5y ago
  And how many years did HTML exist before JavaScript was invented?
  - jstummbillig 5y ago
    100000 years?
pjmlp 5y ago
Technically you already allow remote code execution via XSLT.
afloatboat 5y ago
I see people comment this on HN on a daily basis and it always boggles my mind. For me this reads as: 'This thing that was initially conceived years ago when computers were incapable of much more than display text should never evolve/change to take advantage of current capabilities'. Yes, initially the web could only display hyperlinked text. The same can be said for many technologies/inventions, should we therefore never expand the capabilities of our tools? What is the difference between the web and your operating system in that regard? Why are OS APIs so different? We can also look at the positive effect this evolution has had where what used to be platform specific tooling is now often simply available via a URL. I much prefer that over random executables that are not sandboxed and by default have full access to all your data. Yes, this can be mitigated, but the average user won't. No it's not all sunshine and roses, we've made trade-offs with regards to performance and UX among others, but this is still an ongoing process as the modern web is still relatively young and changing.
- zelphirkalt 5y ago
  We have HTML and CSS, which evolved quite a lot and already allow for what 90% (estimate) of the websites do. Usually it is people using JS, where they should not and tracking from FAANG and others, which are the reason to block JS. You are painting a wrong picture there. If 95% of the web devs used JS in appropriate ways and it was not used so much for spying on people, well, then it would be a different story.
  - scrollaway 5y ago
    You say that, but even if all trackers disappeared today, everybody and their alt account would still be complaining on HN about javascript omnipresence, "why are you using React when you could do this serverside" and what not. (And if you agree with telling people they're doing their development wrong by using JS for anything less than an in-browser implementation of Starcraft, you're painting yourself as the arbiter of what is and isn't appropriate -- please don't.) Hating trackers is rational. The JS hate on HN, is not.
    - 5y ago
exporectomy 5y ago
You just restated the belief as if the reason is self-evident. What's the reason? Security? Even displaying a JPEG has had security vulnerabilities. You can't really seem to escape that just by not executing code. And no PDFs too, I guess, because they contain code?
- _Algernon_ 5y ago
  Reducing the attack surface is the pragmatic thing to do and it just happens that js alone makes a several orders of magnitude difference on its own. Don't let perfect be the enemy of the good.
kitsune_ 5y ago
Yes, but JavaScript has been a thing since the 90's and was widely used by web sites even back in the the days of GeoCities. So it's really a bit weird to complain about something that has been part of the web since almost its beginnings, and arguably has been one of the main drivers for the 'rise of the web' itself.

by thehta 5y ago

nl 5y ago

HTML has never been XML. And HTML + CSS3 is Turing complete without Javascript anyway: https://accodeing.com/blog/2015/css3-proven-to-be-turing-complete https://accodeing.com/blog/2015/css3-proven-to-be-turing-com...

kitsune_ 5y ago
Amen, I think if memory serves correctly HTML was SGML inspired and once XML became popular there was a XHTML standardization push for a brief time. I think you could argue that the ubiquity of HTML led to people see value in something like XML back in the late 90's / early 00' and HTML drove XML invention and adoption and not the other way around.

jstummbillig 5y ago

In a mere 20-ish years. Crazy.

diroussel 5y ago
And how many years did HTML exist before JavaScript was invented?
- jstummbillig 5y ago
  100000 years?

pjmlp 5y ago

Technically you already allow remote code execution via XSLT.

afloatboat 5y ago

I see people comment this on HN on a daily basis and it always boggles my mind. For me this reads as: 'This thing that was initially conceived years ago when computers were incapable of much more than display text should never evolve/change to take advantage of current capabilities'. Yes, initially the web could only display hyperlinked text. The same can be said for many technologies/inventions, should we therefore never expand the capabilities of our tools? What is the difference between the web and your operating system in that regard? Why are OS APIs so different? We can also look at the positive effect this evolution has had where what used to be platform specific tooling is now often simply available via a URL. I much prefer that over random executables that are not sandboxed and by default have full access to all your data. Yes, this can be mitigated, but the average user won't. No it's not all sunshine and roses, we've made trade-offs with regards to performance and UX among others, but this is still an ongoing process as the modern web is still relatively young and changing.

zelphirkalt 5y ago
We have HTML and CSS, which evolved quite a lot and already allow for what 90% (estimate) of the websites do. Usually it is people using JS, where they should not and tracking from FAANG and others, which are the reason to block JS. You are painting a wrong picture there. If 95% of the web devs used JS in appropriate ways and it was not used so much for spying on people, well, then it would be a different story.
- scrollaway 5y ago
  You say that, but even if all trackers disappeared today, everybody and their alt account would still be complaining on HN about javascript omnipresence, "why are you using React when you could do this serverside" and what not. (And if you agree with telling people they're doing their development wrong by using JS for anything less than an in-browser implementation of Starcraft, you're painting yourself as the arbiter of what is and isn't appropriate -- please don't.) Hating trackers is rational. The JS hate on HN, is not.
  - 5y ago

exporectomy 5y ago

You just restated the belief as if the reason is self-evident. What's the reason? Security? Even displaying a JPEG has had security vulnerabilities. You can't really seem to escape that just by not executing code. And no PDFs too, I guess, because they contain code?

_Algernon_ 5y ago
Reducing the attack surface is the pragmatic thing to do and it just happens that js alone makes a several orders of magnitude difference on its own. Don't let perfect be the enemy of the good.

kitsune_ 5y ago

Yes, but JavaScript has been a thing since the 90's and was widely used by web sites even back in the the days of GeoCities. So it's really a bit weird to complain about something that has been part of the web since almost its beginnings, and arguably has been one of the main drivers for the 'rise of the web' itself.