7 ms·

All About E: A Language That Infiltrated JavaScript

79 points by cpeterso 4y ago

halfmatthalfcat 4y ago
I discovered E years ago and always lament it never had a resurgence. Coming from Scala/Akka, I adore message-based/actor systems and saw the promise of E to that end. Maybe some day we will get a first class actor language. Swift is kind of trying right now but it still feels bolted on.
- olodus 4y ago
  I'm guessing you are not considering Erlang/Elixir "first class" then. Is it because they are hosted on the BEAM? If the hosted VM part is what it comes down to you also have Pony. Haven't looked at it in quite a while but it always surprised me it didn't end up more popular.
  - vanderZwan 4y ago
    My best guess is that a lot of people looked at its capability system and thought "wait, it's like Rust's borrow checker except even more of a hassle than the borrow checker?" and noped out. Which is unfair to Pony, but if you think of how Rust already scares some people off then that first impression of Pony might end up doing even worse.
- ryukafalz 4y ago
  There's Spritely Goblins, which takes a lot of inspiration from E. It's a library so it may feel bolted on to you, but in true lisp fashion it feels like it's part of the language when you're using it: https://docs.racket-lang.org/goblins/ https://docs.racket-lang.org/goblins/
- deleted 4y ago
  [deleted]
kragen 4y ago
Thanks, Chris! Another interesting thing that came out of the object-capability ferment around E and EROS was Darius Bacon's Idel secure virtual machine: https://github.com/darius/idel https://github.com/darius/idel Though no other software is as influential as JS, other currently influential ocap systems include Genode, most of the current implementations of L4 (including seL4), and CHERI.
bastawhiz 4y ago
> One fundamental aspect of E they brought over in ECMAScript 5 was support for the object-capability security model, he said. .... The provider of the object can populate it with methods that capture internal state variables and can encapsulate that state, so the clients of the object cannot tamper with it. By “freezing,” what’s meant is that the properties of the object can no longer be changed, he added. Calling this "security" is hopefully not serious. "the properties of the object can no longer be changed" yes, unless someone else just unfreezes the object. > That step addressed a security problem: prototype poisoning, in which objects created in traditional JavaScript were all mutable and can be subverted to confuse or surveil other parts of a program by anyone who had access to them. This is still a problem, and the "harden" function that is described doesn't actually help because the things that it relies on could be poisoned. From a practical security perspective, none of this actually accomplished anything or protects against any kind of bad actor doing something nefarious. I guess it's maybe useful as a comparison to E, but this article could have been a lot more direct and a lot less "we once did some stuff that is academically interesting in JavaScript."
- naasking 4y ago
  Sorry, how do you unfreeze a frozen object? Only references I see online involve cloning it, which preserves the security properties of a frozen object. As for harden(), whether its vulnerable to it's prototype chain in the way you describe depends entirely on how it's written. That said, these aren't amateurs so I expect they know what they're doing, and transitively freezing an object graph does add important security properties.
- etc_passwd 4y ago
  The security principle is largely based on OCAP-based permission scheme, where implicit access to an object is equal to the right to access, and freezing said object limits its use.
- deleted 4y ago
  [deleted]
- ShredKazoo 4y ago
  >"the properties of the object can no longer be changed" yes, unless someone else just unfreezes the object. There doesn't appear to be any unfreeze method. >This is still a problem, and the "harden" function that is described doesn't actually help because the things that it relies on could be poisoned. I think the threat model here is untrusted code which runs after the "harden" function completes. (I think this article would've been better if it had discussed threat models at the beginning.)
oofbey 4y ago
Doesn’t WASM provide a graceful and natural end to JavaScript’s hegemony? People can just use whatever language they want in the browser now.
- pjmlp 4y ago
  JavaScript is still the language that owns the platform, because WASM doesn't have any capabilities beyond compute, it up to the host to provide callbacks so that WASM code can call into the host, those callbacks are written in JavaScript.
- Mikeb85 4y ago
  No because most languages don't just compile to WASM... You need to compile and distribute a runtime or, in the case of dynamic languages, full interpreter with the web page. JS is way less code to ship depending on how much interactivity you want...
  - berkes 4y ago
    > You need to compile and distribute a runtime or, in the case of dynamic languages, But for all other languages there are easy compilers. Which is why WASM, apparently, is used with such languages mostly[1] I'd expect that these runtimes can be both distributed with browsers when they become really popular, and can be reduced in size. E.g. Python's runtime is relatively large and ships with a large stdlib. Most of which won't be needed in your code, so I'd expect it to be possible to compile a runtime that only includes what your code really needs, for example. [1] https://blog.scottlogic.com/2022/06/20/state-of-wasm-2022.html https://blog.scottlogic.com/2022/06/20/state-of-wasm-2022.ht...
- dmitriid 4y ago
  > People can just use whatever language they want in the browser now. Except, you know, WASM has zero access to browser APIs, and all interactions have to go through JavaScript. And on top of that you need to load your language's entire runtime to make it work.
  - 4y ago
goto11 4y ago
I'm unclear about what kind of threat "freeze" protects against. Is it just protecting against your own mistakes, or against malicious code somehow running in the same JavaScript process?
- etc_passwd 4y ago
  the ability to create and send an object that cannot be modified
- beebeepka 4y ago
  I think Object.freeze is insufficient but there is value in immutable properties of objects. I wish TS understood this
- kragen 4y ago
  Malicious code running in the same JS process, specifically malicious code that modifies an object you give it (that you retain references to) or that gives you an object and then changes it later. Running multiple mutually untrusting pieces of code in the same process was the main point of E, and that's what the modifications to JS being discussed here are aimed at. The reason for such "frozen" objects is explained in http://www.erights.org/elang/kernel/auditors/index.html http://www.erights.org/elang/kernel/auditors/index.html.
  - goto11 4y ago
    Interesting! But I have a hard time understanding the use case in the context of a web page. If you import malicious code in a web app, wouldn't it be able to wreck all kinds of havoc anyway?
    - kragen 4y ago
      The objective of Jessie and the other capability-secure dialects of JS is precisely to allow you to import malicious code in a web app without allowing it to either wreak or wreck any havoc. You can imagine lots of ways this could be useful. One of the most boring but profitable was Crockford's original application for one such dialect at Yahoo — interactive banner ads: https://www.crockford.com/adsafe/ https://www.crockford.com/adsafe/ More generally, what if you want to drop a poll into a chat channel, upload a trading bot to a cryptocurrency exchange, run an image-filtering plugin for your paint program without giving its author access to your imagery, etc.? There are lots of scenarios where fine-grained security permits useful kinds of collaboration.
j-pb 4y ago
That whole E "security model" is a really annoyingly academic endeavour. It's pretty absurd that they managed to push something into the standard only for the gain of their own obscure consulting company. Nobody else uses it and no library utilizes it, most people haven't even heard of it. Yet it has expensive ramifications for the rest of the language. Proxies for example are super cripled, and extremely hard to use, e.g. to build seamless database integrations (OOM), and super slow, with an added equality checks and whatnot on every access, because they are supposed to also serve as an API gateways within that security framework.
- 7373737373 4y ago
  Internal encapsulation is essential to be able to import and run (partially) untrusted code, to limit its potential side effects, and it has to be implemented in the language itself. How many more decades do you want to wait before programming languages and with them, actual programming practice, become secure? All major languages have failed us in this aspect - and avoiding their shortcomings won't be possible without these primitives. Until people realize this, the world will have to suffer a million hacks that could have been avoided otherwise. https://medium.com/agoric/pola-would-have-prevented-the-event-stream-incident-45653ecbda99 https://medium.com/agoric/pola-would-have-prevented-the-even... It does require a different mindset, perhaps even a conceptual inversion to understand and apply the security model, but that doesn't make it purely academic. Yes, it will remain that way if its logical truths are not implemented, but their applications and the consequences of ignoring them are very real. To suggest that they only do it for their own sake is incredibly presumptuous.
  - j-pb 4y ago
    I completely agree that we should aim for more secure languages, and I even concede that IF javascript had pervasive use of these (E based) security ideas both in libraries and culture, that it'd be a good thing. However, I'd argue that the security concept introduced by E is at fundamental odds with the reality of javascript programmers. There are other language construct that would have really improved security, such as persistent data structures, good functional programming capabilities that focus on pure functions, even E's actors could be used as isolated execution contexts that communicate via said persistent data-structures. Having just one isolation mechanism, and making it very hard to use wrong, would really address existing security concerns, instead of just throwing a bunch of security primitives that are easy to misuse at a community that neither has the capacity to use them correctly, nor really cares.
dang 4y ago
Related: Capability Myths Demolished (2003) - https://news.ycombinator.com/item?id=22753464 https://news.ycombinator.com/item?id=22753464 - April 2020 (30 comments) E Programming Language - https://news.ycombinator.com/item?id=19981720 https://news.ycombinator.com/item?id=19981720 - May 2019 (53 comments) Satan Comes to Dinner (1997) - https://news.ycombinator.com/item?id=16512555 https://news.ycombinator.com/item?id=16512555 - March 2018 (14 comments) Concurrency Among Strangers: Programming in E as Plan Coordination (2005) [pdf] - https://news.ycombinator.com/item?id=13653503 https://news.ycombinator.com/item?id=13653503 - Feb 2017 (2 comments) Vats – Monte documentation - https://news.ycombinator.com/item?id=13295071 https://news.ycombinator.com/item?id=13295071 - Jan 2017 (1 comment) E Programming Language: Write Secure Distributed Software - https://news.ycombinator.com/item?id=11608985 https://news.ycombinator.com/item?id=11608985 - May 2016 (21 comments) Capability Based Security - https://news.ycombinator.com/item?id=10684129 https://news.ycombinator.com/item?id=10684129 - Dec 2015 (35 comments) The E programming language - https://news.ycombinator.com/item?id=2497941 https://news.ycombinator.com/item?id=2497941 - April 2011 (9 comments) E, the secure distributed pure-object platform and p2p scripting language - https://news.ycombinator.com/item?id=809714 https://news.ycombinator.com/item?id=809714 - Sept 2009 (7 comments) The E Language in a Walnut - https://news.ycombinator.com/item?id=70712 https://news.ycombinator.com/item?id=70712 - Oct 2007 (1 comment) Other threads?
MattPalmer1086 4y ago
Fascinating! I had no idea that Mark Miller had brought in ideas from E into JavaScript. I used to play with E back when I was studying infosec. I was very interested in capability based security. Also not a little ironic that a language often regarded as one of least secure has elements from one of the most secure languages ever designed!
edg5000 4y ago
I'm not sure why nobody is talking about TypeScript? If browsers were to natively support it, that would be a game changer. We could phase out quirky features of JS and mark them as obsolete in IDEs. More use of the Map class for example would avoid some quirks of using objects.
- toxicFork 4y ago
  I guess we would not need to compile it down to js and instead evaluate or jit it directly? Could someone do this on an open source browser perhaps? Or would it require some initial big chunk of work?
- indy 4y ago
  I'm surprised that Microsoft haven't already done this with their Edge browser. At least offer a 'developer' mode which enables TypeScript support only during development
  - deleted 4y ago
    [deleted]
  - mlajtos 4y ago
    Don't give them ideas. https://en.wikipedia.org/wiki/JScript https://en.wikipedia.org/wiki/JScript
    - protomolecule 4y ago
      Why not? https://en.wikipedia.org/wiki/XMLHttpRequest#History https://en.wikipedia.org/wiki/XMLHttpRequest#History
- neongreen 4y ago
  Map is in JS: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... TypeScript is designed in such a way that type annotations can't influence the runtime behavior. This is unlike e.g. Haskell, where types can drive code generation. Happy to elaborate more if necessary. This means that transpiling TypeScript to JavaScript consists merely of stripping the type annotations + transpiling some of the syntactic features that might not be supported by the target JS version. The "Type Annotations" proposal (https://github.com/tc39/proposal-type-annotations https://github.com/tc39/proposal-type-annotations), IIRC championed partly by the TS team, will allow type annotations with almost-TS-like-syntax in plain JavaScript, which will make the "stripping type annotations" step unnecessary. You would still use the TS tooling to actually type-check the code, though. Which exact part of TS do you want to be built into browsers?
replygirl 4y ago
these sites without scrollbars are terrible
- berkes 4y ago
  I see a scrollbar here, though. Firefox, desktop.
schickm11 4y ago
Can someone demonstrate the “objects as closures” concept they mention? I can’t find any references to it elsewhere online
- gildas 4y ago
  See "Crockford Objects" here for example: https://levelup.gitconnected.com/crockford-objects-in-javascript-9947a65fc5e8#0795 https://levelup.gitconnected.com/crockford-objects-in-javasc...
  - schickm11 4y ago
    Thanks, that’s super clear. That’s such a simple technique when you compare it to using prototypes.
- kragen 4y ago
  This function creates a closure with a private variable, "n". When invoked the closure will increase n by the specified amount, but there is no way to decrease it. const incfac = () => { let n = 0; return m => (m > 0 ? n += m : n) }; A more extensive example due to Norm Hardy, presuming a multiuser Scheme interpreter that supports ocap security, is this Scheme program for voting on where to have lunch: http://cap-lore.com/CapTheory/Language/Lunch.html http://cap-lore.com/CapTheory/Language/Lunch.html (define (mocntr) (let ((x 0)) (cons (lambda () (let ((yet #t)) (lambda () (if yet (begin (set! yet #f) (set! x (+ 1 x)) x))))) (lambda () x)))) (define lunchcrowd (list (lambda (x) (write (cons "for Bill" x))) (lambda (x) (write (cons "for Bob" x)) ((cdr (assoc "Mandarin" (cdr x))))))) (define restaurants (list "Mandarin" "Casa Lupe" "Coffee Shop")) (define (noontime) (let ((bb (map (lambda(r) (cons r (mocntr))) restaurants))) (for-each (lambda (e) (e (cons "Lunchtime!" (map (lambda(r)(cons (car r) ((cadr r)))) bb)))) lunchcrowd) (lambda ()(map (lambda(x) (cons (car x) ((cddr x)))) bb)))) You can translate this into current versions of ES straightforwardly but it doesn't get much more readable. Norm explains: > An invocation of mocntr is made each day for each restaurant. It returns a source of options, one of which will be offered to each of the lunch crowd. The second lambda in the definition produces such an option. The variable yet in that proc remembers if the option has been taken. The third lambda produces the getter for the count. > bb is created each day for lunch and constitutes the ballot box. It is a list of pairs <restuarant name, <option source, count getter>>. This list is iterated over first to send each vote solicitation, and then later to count the votes. Unfortunately he's vitrified now, so if you send him questions he will answer after a long delay, if ever.

79 points by cpeterso 4y ago

I discovered E years ago and always lament it never had a resurgence. Coming from Scala/Akka, I adore message-based/actor systems and saw the promise of E to that end. Maybe some day we will get a first class actor language. Swift is kind of trying right now but it still feels bolted on.

olodus 4y ago
I'm guessing you are not considering Erlang/Elixir "first class" then. Is it because they are hosted on the BEAM? If the hosted VM part is what it comes down to you also have Pony. Haven't looked at it in quite a while but it always surprised me it didn't end up more popular.
- vanderZwan 4y ago
  My best guess is that a lot of people looked at its capability system and thought "wait, it's like Rust's borrow checker except even more of a hassle than the borrow checker?" and noped out. Which is unfair to Pony, but if you think of how Rust already scares some people off then that first impression of Pony might end up doing even worse.
ryukafalz 4y ago
There's Spritely Goblins, which takes a lot of inspiration from E. It's a library so it may feel bolted on to you, but in true lisp fashion it feels like it's part of the language when you're using it: https://docs.racket-lang.org/goblins/ https://docs.racket-lang.org/goblins/
deleted 4y ago
[deleted]

kragen 4y ago

Thanks, Chris! Another interesting thing that came out of the object-capability ferment around E and EROS was Darius Bacon's Idel secure virtual machine: https://github.com/darius/idel https://github.com/darius/idel Though no other software is as influential as JS, other currently influential ocap systems include Genode, most of the current implementations of L4 (including seL4), and CHERI.

bastawhiz 4y ago

> One fundamental aspect of E they brought over in ECMAScript 5 was support for the object-capability security model, he said. .... The provider of the object can populate it with methods that capture internal state variables and can encapsulate that state, so the clients of the object cannot tamper with it. By “freezing,” what’s meant is that the properties of the object can no longer be changed, he added. Calling this "security" is hopefully not serious. "the properties of the object can no longer be changed" yes, unless someone else just unfreezes the object. > That step addressed a security problem: prototype poisoning, in which objects created in traditional JavaScript were all mutable and can be subverted to confuse or surveil other parts of a program by anyone who had access to them. This is still a problem, and the "harden" function that is described doesn't actually help because the things that it relies on could be poisoned. From a practical security perspective, none of this actually accomplished anything or protects against any kind of bad actor doing something nefarious. I guess it's maybe useful as a comparison to E, but this article could have been a lot more direct and a lot less "we once did some stuff that is academically interesting in JavaScript."

naasking 4y ago
Sorry, how do you unfreeze a frozen object? Only references I see online involve cloning it, which preserves the security properties of a frozen object. As for harden(), whether its vulnerable to it's prototype chain in the way you describe depends entirely on how it's written. That said, these aren't amateurs so I expect they know what they're doing, and transitively freezing an object graph does add important security properties.
etc_passwd 4y ago
The security principle is largely based on OCAP-based permission scheme, where implicit access to an object is equal to the right to access, and freezing said object limits its use.
deleted 4y ago
[deleted]
ShredKazoo 4y ago
>"the properties of the object can no longer be changed" yes, unless someone else just unfreezes the object. There doesn't appear to be any unfreeze method. >This is still a problem, and the "harden" function that is described doesn't actually help because the things that it relies on could be poisoned. I think the threat model here is untrusted code which runs after the "harden" function completes. (I think this article would've been better if it had discussed threat models at the beginning.)

oofbey 4y ago

Doesn’t WASM provide a graceful and natural end to JavaScript’s hegemony? People can just use whatever language they want in the browser now.

pjmlp 4y ago
JavaScript is still the language that owns the platform, because WASM doesn't have any capabilities beyond compute, it up to the host to provide callbacks so that WASM code can call into the host, those callbacks are written in JavaScript.
Mikeb85 4y ago
No because most languages don't just compile to WASM... You need to compile and distribute a runtime or, in the case of dynamic languages, full interpreter with the web page. JS is way less code to ship depending on how much interactivity you want...
- berkes 4y ago
  > You need to compile and distribute a runtime or, in the case of dynamic languages, But for all other languages there are easy compilers. Which is why WASM, apparently, is used with such languages mostly[1] I'd expect that these runtimes can be both distributed with browsers when they become really popular, and can be reduced in size. E.g. Python's runtime is relatively large and ships with a large stdlib. Most of which won't be needed in your code, so I'd expect it to be possible to compile a runtime that only includes what your code really needs, for example. [1] https://blog.scottlogic.com/2022/06/20/state-of-wasm-2022.html https://blog.scottlogic.com/2022/06/20/state-of-wasm-2022.ht...
dmitriid 4y ago
> People can just use whatever language they want in the browser now. Except, you know, WASM has zero access to browser APIs, and all interactions have to go through JavaScript. And on top of that you need to load your language's entire runtime to make it work.
- 4y ago

goto11 4y ago

I'm unclear about what kind of threat "freeze" protects against. Is it just protecting against your own mistakes, or against malicious code somehow running in the same JavaScript process?

etc_passwd 4y ago
the ability to create and send an object that cannot be modified
beebeepka 4y ago
I think Object.freeze is insufficient but there is value in immutable properties of objects. I wish TS understood this
kragen 4y ago
Malicious code running in the same JS process, specifically malicious code that modifies an object you give it (that you retain references to) or that gives you an object and then changes it later. Running multiple mutually untrusting pieces of code in the same process was the main point of E, and that's what the modifications to JS being discussed here are aimed at. The reason for such "frozen" objects is explained in http://www.erights.org/elang/kernel/auditors/index.html http://www.erights.org/elang/kernel/auditors/index.html.
- goto11 4y ago
  Interesting! But I have a hard time understanding the use case in the context of a web page. If you import malicious code in a web app, wouldn't it be able to wreck all kinds of havoc anyway?
  - kragen 4y ago
    The objective of Jessie and the other capability-secure dialects of JS is precisely to allow you to import malicious code in a web app without allowing it to either wreak or wreck any havoc. You can imagine lots of ways this could be useful. One of the most boring but profitable was Crockford's original application for one such dialect at Yahoo — interactive banner ads: https://www.crockford.com/adsafe/ https://www.crockford.com/adsafe/ More generally, what if you want to drop a poll into a chat channel, upload a trading bot to a cryptocurrency exchange, run an image-filtering plugin for your paint program without giving its author access to your imagery, etc.? There are lots of scenarios where fine-grained security permits useful kinds of collaboration.

j-pb 4y ago

That whole E "security model" is a really annoyingly academic endeavour. It's pretty absurd that they managed to push something into the standard only for the gain of their own obscure consulting company. Nobody else uses it and no library utilizes it, most people haven't even heard of it. Yet it has expensive ramifications for the rest of the language. Proxies for example are super cripled, and extremely hard to use, e.g. to build seamless database integrations (OOM), and super slow, with an added equality checks and whatnot on every access, because they are supposed to also serve as an API gateways within that security framework.

7373737373 4y ago
Internal encapsulation is essential to be able to import and run (partially) untrusted code, to limit its potential side effects, and it has to be implemented in the language itself. How many more decades do you want to wait before programming languages and with them, actual programming practice, become secure? All major languages have failed us in this aspect - and avoiding their shortcomings won't be possible without these primitives. Until people realize this, the world will have to suffer a million hacks that could have been avoided otherwise. https://medium.com/agoric/pola-would-have-prevented-the-event-stream-incident-45653ecbda99 https://medium.com/agoric/pola-would-have-prevented-the-even... It does require a different mindset, perhaps even a conceptual inversion to understand and apply the security model, but that doesn't make it purely academic. Yes, it will remain that way if its logical truths are not implemented, but their applications and the consequences of ignoring them are very real. To suggest that they only do it for their own sake is incredibly presumptuous.
- j-pb 4y ago
  I completely agree that we should aim for more secure languages, and I even concede that IF javascript had pervasive use of these (E based) security ideas both in libraries and culture, that it'd be a good thing. However, I'd argue that the security concept introduced by E is at fundamental odds with the reality of javascript programmers. There are other language construct that would have really improved security, such as persistent data structures, good functional programming capabilities that focus on pure functions, even E's actors could be used as isolated execution contexts that communicate via said persistent data-structures. Having just one isolation mechanism, and making it very hard to use wrong, would really address existing security concerns, instead of just throwing a bunch of security primitives that are easy to misuse at a community that neither has the capacity to use them correctly, nor really cares.

dang 4y ago

Related: Capability Myths Demolished (2003) - https://news.ycombinator.com/item?id=22753464 https://news.ycombinator.com/item?id=22753464 - April 2020 (30 comments) E Programming Language - https://news.ycombinator.com/item?id=19981720 https://news.ycombinator.com/item?id=19981720 - May 2019 (53 comments) Satan Comes to Dinner (1997) - https://news.ycombinator.com/item?id=16512555 https://news.ycombinator.com/item?id=16512555 - March 2018 (14 comments) Concurrency Among Strangers: Programming in E as Plan Coordination (2005) [pdf] - https://news.ycombinator.com/item?id=13653503 https://news.ycombinator.com/item?id=13653503 - Feb 2017 (2 comments) Vats – Monte documentation - https://news.ycombinator.com/item?id=13295071 https://news.ycombinator.com/item?id=13295071 - Jan 2017 (1 comment) E Programming Language: Write Secure Distributed Software - https://news.ycombinator.com/item?id=11608985 https://news.ycombinator.com/item?id=11608985 - May 2016 (21 comments) Capability Based Security - https://news.ycombinator.com/item?id=10684129 https://news.ycombinator.com/item?id=10684129 - Dec 2015 (35 comments) The E programming language - https://news.ycombinator.com/item?id=2497941 https://news.ycombinator.com/item?id=2497941 - April 2011 (9 comments) E, the secure distributed pure-object platform and p2p scripting language - https://news.ycombinator.com/item?id=809714 https://news.ycombinator.com/item?id=809714 - Sept 2009 (7 comments) The E Language in a Walnut - https://news.ycombinator.com/item?id=70712 https://news.ycombinator.com/item?id=70712 - Oct 2007 (1 comment) Other threads?

MattPalmer1086 4y ago

Fascinating! I had no idea that Mark Miller had brought in ideas from E into JavaScript. I used to play with E back when I was studying infosec. I was very interested in capability based security. Also not a little ironic that a language often regarded as one of least secure has elements from one of the most secure languages ever designed!

edg5000 4y ago

I'm not sure why nobody is talking about TypeScript? If browsers were to natively support it, that would be a game changer. We could phase out quirky features of JS and mark them as obsolete in IDEs. More use of the Map class for example would avoid some quirks of using objects.

toxicFork 4y ago
I guess we would not need to compile it down to js and instead evaluate or jit it directly? Could someone do this on an open source browser perhaps? Or would it require some initial big chunk of work?
indy 4y ago
I'm surprised that Microsoft haven't already done this with their Edge browser. At least offer a 'developer' mode which enables TypeScript support only during development
- deleted 4y ago
  [deleted]
- mlajtos 4y ago
  Don't give them ideas. https://en.wikipedia.org/wiki/JScript https://en.wikipedia.org/wiki/JScript
  - protomolecule 4y ago
    Why not? https://en.wikipedia.org/wiki/XMLHttpRequest#History https://en.wikipedia.org/wiki/XMLHttpRequest#History
neongreen 4y ago
Map is in JS: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... TypeScript is designed in such a way that type annotations can't influence the runtime behavior. This is unlike e.g. Haskell, where types can drive code generation. Happy to elaborate more if necessary. This means that transpiling TypeScript to JavaScript consists merely of stripping the type annotations + transpiling some of the syntactic features that might not be supported by the target JS version. The "Type Annotations" proposal (https://github.com/tc39/proposal-type-annotations https://github.com/tc39/proposal-type-annotations), IIRC championed partly by the TS team, will allow type annotations with almost-TS-like-syntax in plain JavaScript, which will make the "stripping type annotations" step unnecessary. You would still use the TS tooling to actually type-check the code, though. Which exact part of TS do you want to be built into browsers?

replygirl 4y ago

these sites without scrollbars are terrible

berkes 4y ago
I see a scrollbar here, though. Firefox, desktop.

schickm11 4y ago

Can someone demonstrate the “objects as closures” concept they mention? I can’t find any references to it elsewhere online

gildas 4y ago
See "Crockford Objects" here for example: https://levelup.gitconnected.com/crockford-objects-in-javascript-9947a65fc5e8#0795 https://levelup.gitconnected.com/crockford-objects-in-javasc...
- schickm11 4y ago
  Thanks, that’s super clear. That’s such a simple technique when you compare it to using prototypes.
kragen 4y ago
This function creates a closure with a private variable, "n". When invoked the closure will increase n by the specified amount, but there is no way to decrease it. const incfac = () => { let n = 0; return m => (m > 0 ? n += m : n) }; A more extensive example due to Norm Hardy, presuming a multiuser Scheme interpreter that supports ocap security, is this Scheme program for voting on where to have lunch: http://cap-lore.com/CapTheory/Language/Lunch.html http://cap-lore.com/CapTheory/Language/Lunch.html (define (mocntr) (let ((x 0)) (cons (lambda () (let ((yet #t)) (lambda () (if yet (begin (set! yet #f) (set! x (+ 1 x)) x))))) (lambda () x)))) (define lunchcrowd (list (lambda (x) (write (cons "for Bill" x))) (lambda (x) (write (cons "for Bob" x)) ((cdr (assoc "Mandarin" (cdr x))))))) (define restaurants (list "Mandarin" "Casa Lupe" "Coffee Shop")) (define (noontime) (let ((bb (map (lambda(r) (cons r (mocntr))) restaurants))) (for-each (lambda (e) (e (cons "Lunchtime!" (map (lambda(r)(cons (car r) ((cadr r)))) bb)))) lunchcrowd) (lambda ()(map (lambda(x) (cons (car x) ((cddr x)))) bb)))) You can translate this into current versions of ES straightforwardly but it doesn't get much more readable. Norm explains: > An invocation of mocntr is made each day for each restaurant. It returns a source of options, one of which will be offered to each of the lunch crowd. The second lambda in the definition produces such an option. The variable yet in that proc remembers if the option has been taken. The third lambda produces the getter for the count. > bb is created each day for lunch and constitutes the ballot box. It is a list of pairs <restuarant name, <option source, count getter>>. This list is iterated over first to send each vote solicitation, and then later to count the votes. Unfortunately he's vitrified now, so if you send him questions he will answer after a long delay, if ever.