4 ms·

Javascript is turing-complete. That's a /lot/ of power and that means that security-conscious users (especially given the proliferation of more-powerful JS apis

by gue5t 15y ago

Javascript is turing-complete. That's a /lot/ of power and that means that security-conscious users (especially given the proliferation of more-powerful JS apis allowing the possibility for exploits in file, GPU, etc. access, along with JIT-enabled exploits as opposed to the old simple interpreting) will have it turned off whenever possible. Using CSS for non-turing-complete interactions which are limited in their computational ability to a simple automaton means that CSS can be trusted much more than JS, and that there are stricter guarantees on performance. It's also semantically cleaner when used for things like visual effects on windows, because even if CSS doesn't load, the markup representing the menu will be intact. JS systems have the ability to load markup asynchronously or generate it from other data in the page and destroy all notion of graceful degradation.

benregenspan 15y ago
Let's be clear: "security-conscious users" who turn off Javascript are a very small minority. If a site is geared towards serving developers or small startups, it might be serving this minority. If not, SEO ("how do I make this site readable by search engines?") will be a much larger concern than "graceful degradation for the benefit of the tiny few who care about security enough to disable Javascript or use NoScript but not whitelist my sites' scripts". Often designing something to gracefully degrade will serve both SEO and security-conscious users, but in cases where it won't (this case for example -- where Google decidedly doesn't care about the layout of the navigation items, as long as they're accessible to it), there's not much incentive to find a pure-CSS approach when a pure-JS approach might be simpler.
robin_reala 15y ago
CSS is technically Turing complete too: http://lambda-the-ultimate.org/node/4222 http://lambda-the-ultimate.org/node/4222
ajanuary 15y ago
It has nothing to do with turing completeness. More complexity leading to bigger surface area for potential attacks, yes. GPU and file access, yes. But nothing to do with turing completeness. Here's a non turing complete language I wouldn't like to be able to run in a web context. It has a single command: rm {path} On the other hand a turing complete language that has no access to any IO, DOM manipulation etc. I would be perfectly happy to let run. It isn't the power that comes from turing completeness that makes javascript a potential security vulnerability, it's the interactions it can have outside of computation.
- silentOpen 15y ago
  Its imperative nature (mutation, side effects) and potential non-termination makes it unattractive as a catch-all hypertext document language. By using the language of Least Power (timbl@w3c.org) that still accomplishes your task, you achieve a more concise and more analyzable document. I wouldn't call that "nothing to do with TC".
  - ajanuary 15y ago
    Its imperative nature is unrelated to TC. Non TC languages can be sufficiently complex as to make analysis difficult. I don't see any of the risks of js as linked to TC in any meaningful way beyond a very hand-wavey "TC tends to lead to complexness".

by gue5t 15y ago

benregenspan 15y ago

Let's be clear: "security-conscious users" who turn off Javascript are a very small minority. If a site is geared towards serving developers or small startups, it might be serving this minority. If not, SEO ("how do I make this site readable by search engines?") will be a much larger concern than "graceful degradation for the benefit of the tiny few who care about security enough to disable Javascript or use NoScript but not whitelist my sites' scripts". Often designing something to gracefully degrade will serve both SEO and security-conscious users, but in cases where it won't (this case for example -- where Google decidedly doesn't care about the layout of the navigation items, as long as they're accessible to it), there's not much incentive to find a pure-CSS approach when a pure-JS approach might be simpler.

robin_reala 15y ago

CSS is technically Turing complete too: http://lambda-the-ultimate.org/node/4222 http://lambda-the-ultimate.org/node/4222

ajanuary 15y ago

It has nothing to do with turing completeness. More complexity leading to bigger surface area for potential attacks, yes. GPU and file access, yes. But nothing to do with turing completeness. Here's a non turing complete language I wouldn't like to be able to run in a web context. It has a single command: rm {path} On the other hand a turing complete language that has no access to any IO, DOM manipulation etc. I would be perfectly happy to let run. It isn't the power that comes from turing completeness that makes javascript a potential security vulnerability, it's the interactions it can have outside of computation.

silentOpen 15y ago
Its imperative nature (mutation, side effects) and potential non-termination makes it unattractive as a catch-all hypertext document language. By using the language of Least Power (timbl@w3c.org) that still accomplishes your task, you achieve a more concise and more analyzable document. I wouldn't call that "nothing to do with TC".
- ajanuary 15y ago
  Its imperative nature is unrelated to TC. Non TC languages can be sufficiently complex as to make analysis difficult. I don't see any of the risks of js as linked to TC in any meaningful way beyond a very hand-wavey "TC tends to lead to complexness".