4 ms·

I completely agree that we should aim for more secure languages, and I even concede that IF javascript had pervasive use of these (E based) security ideas both

by j-pb 4y ago

I completely agree that we should aim for more secure languages, and I even concede that IF javascript had pervasive use of these (E based) security ideas both in libraries and culture, that it'd be a good thing. However, I'd argue that the security concept introduced by E is at fundamental odds with the reality of javascript programmers. There are other language construct that would have really improved security, such as persistent data structures, good functional programming capabilities that focus on pure functions, even E's actors could be used as isolated execution contexts that communicate via said persistent data-structures. Having just one isolation mechanism, and making it very hard to use wrong, would really address existing security concerns, instead of just throwing a bunch of security primitives that are easy to misuse at a community that neither has the capacity to use them correctly, nor really cares.

7373737373 4y ago
I agree that hoisting these onto an existing language, especially such a "mutable" one as Javascript is difficult and introduces unfortunate complexity. The intuition (and perhaps hope) that Javascript already has such a large install base and that, once the changes are available in all major browsers, a cultural change is possible through it seems to be the main motivator for them to focus on this language. Even if the syntax of the language cannot be adapted to it, and people won't create constructs themselves with these primitives, there may be a chance that programmers who do not know the fundamental concepts of the theory can still enjoy its security properties by using third party libraries (heh) like SES that provide higher level primitives, e.g. to isolate other imported libraries. I'm still skeptical myself if the focus on Javascript is the right approach, but i'd prefer their intuition to be right on this. Creating a new language will always be cleaner, but adoption is where E failed.

by j-pb 4y ago

7373737373 4y ago

I agree that hoisting these onto an existing language, especially such a "mutable" one as Javascript is difficult and introduces unfortunate complexity. The intuition (and perhaps hope) that Javascript already has such a large install base and that, once the changes are available in all major browsers, a cultural change is possible through it seems to be the main motivator for them to focus on this language. Even if the syntax of the language cannot be adapted to it, and people won't create constructs themselves with these primitives, there may be a chance that programmers who do not know the fundamental concepts of the theory can still enjoy its security properties by using third party libraries (heh) like SES that provide higher level primitives, e.g. to isolate other imported libraries. I'm still skeptical myself if the focus on Javascript is the right approach, but i'd prefer their intuition to be right on this. Creating a new language will always be cleaner, but adoption is where E failed.