5 ms·

I think what he is saying is that Javascript is a broken language. Fundamentally un-securable when third party code is used.

bastawhiz 5y ago
That's a pretty extreme way to say it. Python is in essentially the same boat, as is bash, Ruby, PHP, dart... Calling languages "broken" is to say that one hard problem makes them unsuitable for use, which is hardly true.
- akhmatova 5y ago
  I think the main concern here is that it isn't that the language is too permissive -- but that the primary installer (and what many people cite as one of the greatest strengths of JS, largely responsible for ushering in its Golden Age) -- is structurally (and perhaps irreparably) insecure. Whether this is really so (and in a significant way compared to its other competitors, out in dynamic programming land) -- is what people seem to be trying to suss out in this thread.
  - johnny22 5y ago
    how is it any less problematic than python or ruby in this regard?
  - bastawhiz 5y ago
    The top comment mentions Deno, which doesn't have NPM or even use a package manager. So I'm not sure how the "installer" is the relevant problem
- krapp 5y ago
  Javascript was designed and intended to be used within the context of a browser to manipulate the DOM and script webpages. It is unsuitable for any other use.
  - paulhodge 5y ago
    agree, assuming you're talking about language version ES1 circa 1995.
  - hackerfromthefu 5y ago
    The fact that including a package in your webpage/app, which includes a tree of hundreds of others, one of which can 'dynamically' overwrite/redefine other pieces of the namespace with impunity, is why it's broken in the first place. ergo it is insecure by design for all uses, and unsuitable for anything important relying on code you wrote doing what you expect. It's fair to say it's broken in a world where what we do in webpages MATTERS. It was fine in the past where nothing truly important happened in web pages, but that ship has sailed.
akhmatova 5y ago
Yup, that's how I read it too. :) Was just wondering what a comprehensive counter-argument would look like. If there is one, that is.
- koonsolo 5y ago
  So which language doesn't have this problem when including 3rd party libraries?
koonsolo 5y ago
So when you include a 3rd party C++ library, how do you know it's not doing some malicious things?

bastawhiz 5y ago

That's a pretty extreme way to say it. Python is in essentially the same boat, as is bash, Ruby, PHP, dart... Calling languages "broken" is to say that one hard problem makes them unsuitable for use, which is hardly true.

akhmatova 5y ago
I think the main concern here is that it isn't that the language is too permissive -- but that the primary installer (and what many people cite as one of the greatest strengths of JS, largely responsible for ushering in its Golden Age) -- is structurally (and perhaps irreparably) insecure. Whether this is really so (and in a significant way compared to its other competitors, out in dynamic programming land) -- is what people seem to be trying to suss out in this thread.
- johnny22 5y ago
  how is it any less problematic than python or ruby in this regard?
- bastawhiz 5y ago
  The top comment mentions Deno, which doesn't have NPM or even use a package manager. So I'm not sure how the "installer" is the relevant problem
krapp 5y ago
Javascript was designed and intended to be used within the context of a browser to manipulate the DOM and script webpages. It is unsuitable for any other use.
- paulhodge 5y ago
  agree, assuming you're talking about language version ES1 circa 1995.
- hackerfromthefu 5y ago
  The fact that including a package in your webpage/app, which includes a tree of hundreds of others, one of which can 'dynamically' overwrite/redefine other pieces of the namespace with impunity, is why it's broken in the first place. ergo it is insecure by design for all uses, and unsuitable for anything important relying on code you wrote doing what you expect. It's fair to say it's broken in a world where what we do in webpages MATTERS. It was fine in the past where nothing truly important happened in web pages, but that ship has sailed.

akhmatova 5y ago

Yup, that's how I read it too. :) Was just wondering what a comprehensive counter-argument would look like. If there is one, that is.

koonsolo 5y ago
So which language doesn't have this problem when including 3rd party libraries?

koonsolo 5y ago

So when you include a 3rd party C++ library, how do you know it's not doing some malicious things?