3 ms·
Back in the 2000s pretty much everyone knew not to run un-trusted code ("don't open that email attachment"). But then javascript happened and the utility was so
by superkuh 4y ago
Back in the 2000s pretty much everyone knew not to run un-trusted code ("don't open that email attachment"). But then javascript happened and the utility was so profound everyone decided to forget.
- selfhoster11 4y agoEven if it's far from obvious to an average person that JavaScript is a pwn vector, I think you're more correct than not. You need enough isolation to run untrusted code. If JS code can still exploit CPU bugs, then clearly more isolation is needed one way or another.
- mirashii 4y agoI think you're looking at the past with rose-colored glasses. ActiveX allowed the execution of unsandboxed x86 code from controls embedded in webpages and was enabled by default in Internet Explorer, the dominant browser of the time. Javascript caught on because it's at least interpreted and sandboxed, a huge step up from what ActiveX was.
- ginko 4y agoCan't you mitigate just the Javascript VM? JS is a slow scripting language anyways. Seems like a waste to slow down the entire system.
- marshray 4y agoPeople have been running code having different security levels on the same hardware since the early time-sharing systems (1960's).