3 ms·
I'm wondering, would it be possible to add a mechanism that would allow JavaScript to get information like the list of fonts, but make it impossible to send it
by xigoi 4y ago
I'm wondering, would it be possible to add a mechanism that would allow JavaScript to get information like the list of fonts, but make it impossible to send it anywhere? Have the list wrapped in some special type that infests everything it touches and things that perform requests will refuse to send it.
- chrismorgan 4y agoThis is fundamentally impossible to implement in anything anywhere near as powerful as JavaScript, because of side-channel attacks <https://en.wikipedia.org/wiki/Side-channel_attack https://en.wikipedia.org/wiki/Side-channel_attack>. (In practice, you wouldn’t even get that far, because universal taint checking would certainly be deemed unacceptably expensive. You can get away with such stuff for individual types, like in Trusted Types kinda, but imposing it on the entire language is not going to fly.)