> "Old computer security" did not have "download and execute code from arbitrary strangers" in its threat profile, but the fact that our industry has driven tha

> "Old computer security" did not have "download and execute code from arbitrary strangers" in its threat profile, but the fact that our industry has driven that exact policy to become the dominant method of running software is the basis of much wasted electricity in our sisyphean efforts to protect our data in the land of SPAs and Service Workers. That started way before SPA's and service workers. Ever download some shareware/freeware from a random bbs/ftp or similar? Ever downloaded some random exe from a website in the 90's or 00's? Ever used napster/kazaa/limewire/bittorrent to pirate software? I'm guessing basically all HN readers have done at least one of those, at least once. I think it's fair to say that ever since the internet allowed us to share code we have "downloaded and executed code from arbitrary strangers", in more or less secure ways. The internet was a bit less malicious back then, so we were generally afforded more naivety to do so but I think the current way for normal people to do it (sandboxed js in a browser VM) is the most secure way to do it yet.