4 ms·

It sounds like a lot of this could be prevented if Javascript had a way to disallow monkeypatching. Maybe there could be something like `const` that would preve

It sounds like a lot of this could be prevented if Javascript had a way to disallow monkeypatching. Maybe there could be something like `const` that would prevent external code from modifying an attribute of an object. At least for objects provided by the engine itself. Is there any non malicious reason to allow everyone to replace `window.encodeURIComponent`?

moron4hire 5y ago
Well, window is the default global scope, so it can't be sealed or any top-level declarations wouldn't work. You'd have to create a new global scope to be able to seal window, and that would break large swaths of the web.
- dylan604 5y ago
  >and that would break large swaths of the web. I'm thinking that might not be as bad of a thing as you might be making it out as. Sometimes, you just need to light a match and watch certain things burn. Allow their ashes to be fertilizer for the regrowth period. Unfortunately, in the world of today, I think the underworld of slimey devs would fill the void faster, and implement "new" that appeals to their needs.
  - moron4hire 5y ago
    And what of all those government websites that don't get updated very often, with forms that people rely on to get access to benefits? Something as simple as client-side pre-form-validation would break access and it could be months before anyone does anything about it. Sure, you could argue that the various government bureaus should be better about updating stuff, but that's really just not going to happen.
    - eitland 5y ago
      I've been proposing the same approach as Mozilla took with asm a few years ago: Specify a subset of the language and guarantee that if on sticks to this subset it will run in a simplified and heavily optimized branch of the code.
Sephr 5y ago
It's absolutely possible to have JavaScript coexist in a potentially hostile environment. We utilize a secure reference cache for Transcend Consent so that potentially malicious scripts cannot interfere with the operation of our consent manager.
- jefftk 5y ago
  It's only possible if you can ensure that you are operating on the page before any other scripts. [1] Most third parties on pages don't have that. [1] And that there are no relevant extensions, and no one has modified the browser itself.
  - Sephr 5y ago
    Indeed. We advise our customers to place our consent management script before any scripts that they wish to regulate due to this inherent limitation.
austincheney 5y ago
If browsers provided an option to block third party script requests… solved.

moron4hire 5y ago

Well, window is the default global scope, so it can't be sealed or any top-level declarations wouldn't work. You'd have to create a new global scope to be able to seal window, and that would break large swaths of the web.

dylan604 5y ago
>and that would break large swaths of the web. I'm thinking that might not be as bad of a thing as you might be making it out as. Sometimes, you just need to light a match and watch certain things burn. Allow their ashes to be fertilizer for the regrowth period. Unfortunately, in the world of today, I think the underworld of slimey devs would fill the void faster, and implement "new" that appeals to their needs.
- moron4hire 5y ago
  And what of all those government websites that don't get updated very often, with forms that people rely on to get access to benefits? Something as simple as client-side pre-form-validation would break access and it could be months before anyone does anything about it. Sure, you could argue that the various government bureaus should be better about updating stuff, but that's really just not going to happen.
  - eitland 5y ago
    I've been proposing the same approach as Mozilla took with asm a few years ago: Specify a subset of the language and guarantee that if on sticks to this subset it will run in a simplified and heavily optimized branch of the code.

Sephr 5y ago

It's absolutely possible to have JavaScript coexist in a potentially hostile environment. We utilize a secure reference cache for Transcend Consent so that potentially malicious scripts cannot interfere with the operation of our consent manager.

jefftk 5y ago
It's only possible if you can ensure that you are operating on the page before any other scripts. [1] Most third parties on pages don't have that. [1] And that there are no relevant extensions, and no one has modified the browser itself.
- Sephr 5y ago
  Indeed. We advise our customers to place our consent management script before any scripts that they wish to regulate due to this inherent limitation.

austincheney 5y ago

If browsers provided an option to block third party script requests… solved.