4 ms·
It has nothing to do with turing completeness. More complexity leading to bigger surface area for potential attacks, yes. GPU and file access, yes. But nothing
by ajanuary 15y ago
It has nothing to do with turing completeness.
More complexity leading to bigger surface area for potential attacks, yes. GPU and file access, yes. But nothing to do with turing completeness.
Here's a non turing complete language I wouldn't like to be able to run in a web context. It has a single command: rm {path}
On the other hand a turing complete language that has no access to any IO, DOM manipulation etc. I would be perfectly happy to let run.
It isn't the power that comes from turing completeness that makes javascript a potential security vulnerability, it's the interactions it can have outside of computation.
- silentOpen 15y agoIts imperative nature (mutation, side effects) and potential non-termination makes it unattractive as a catch-all hypertext document language. By using the language of Least Power (timbl@w3c.org) that still accomplishes your task, you achieve a more concise and more analyzable document. I wouldn't call that "nothing to do with TC".
- ajanuary 15y agoIts imperative nature is unrelated to TC. Non TC languages can be sufficiently complex as to make analysis difficult. I don't see any of the risks of js as linked to TC in any meaningful way beyond a very hand-wavey "TC tends to lead to complexness".