3 ms·

While the sentiment is understandable, this solution is technical drivel. The concern is security, and could be solved by further restricting permissions in the

by ynniv 15y ago

While the sentiment is understandable, this solution is technical drivel. The concern is security, and could be solved by further restricting permissions in the browser. Anyone familiar with computabiliy would know that changing the language will not help. You could improve the situation today with a restrictive browser plugin.

deleted 15y ago
[deleted]
- ynniv 15y ago
  [The parent was deleted, but doesn't matter.] The post is riddled with technical inaccuracies. because JavaScript is Turing-complete, which any antivirus researcher can tell you is why they still have a job Viruses exploit security vulnerabilities to self replicate and assume control. They can be written in non Turning complete languages. the facet of JavaScript's behaviour I'm interested in preventing is in the family of cross-site scripting and request forgeries Gimping JS would have no effect on this. Increasing browser security would. We have XSS/XSRF because we explicitly allow some cross site communication. Reduce or disallow it and your problem is solved. The way to get what I want would be to look into the code before running it and selectively disable certain behaviour. You don't need to fully understand a piece of code to restrict it's actions. This is what a sandbox is. I hear tell that there's even a company that brokers distributed computing tasks, taking money on one end from customers and paying website owners on the other end to pass on to their users to execute for free. There is nothing you can do about this, short of personally inspecting the source code. Which in this case will certainly be obfuscated to prevent you from easily understanding it. His response was probably, but I'd still have the problem of proving code correctness—a perfectly legitimate concern. The person who defined the idea that the author defers to told him that it wouldn't solve the problem. Why are we still talking? But the point is, this is totally doable. The theory is sound, Where was this shown? there's high-profile demand for it Where was this shown? I personally would not use a web browser that wasn't compatible with the web. To top it off, the email link provides the brogrammer subject "yo dawg i herd u like TFP" I don't see how anyone has upvoted this article. If you care about browser security, you might be interested in building better sandboxes based on Capabilities[1]. What the poster has shown is a misunderstanding for both the technical problem as well as the reality of why we run JavaScript in the browser: because web pages are written in JavaScript. All attempts to do anything about that have failed the market. [1 | http://en.wikipedia.org/wiki/Capability-based_security http://en.wikipedia.org/wiki/Capability-based_security]

by ynniv 15y ago

deleted 15y ago

[deleted]

ynniv 15y ago
[The parent was deleted, but doesn't matter.] The post is riddled with technical inaccuracies. because JavaScript is Turing-complete, which any antivirus researcher can tell you is why they still have a job Viruses exploit security vulnerabilities to self replicate and assume control. They can be written in non Turning complete languages. the facet of JavaScript's behaviour I'm interested in preventing is in the family of cross-site scripting and request forgeries Gimping JS would have no effect on this. Increasing browser security would. We have XSS/XSRF because we explicitly allow some cross site communication. Reduce or disallow it and your problem is solved. The way to get what I want would be to look into the code before running it and selectively disable certain behaviour. You don't need to fully understand a piece of code to restrict it's actions. This is what a sandbox is. I hear tell that there's even a company that brokers distributed computing tasks, taking money on one end from customers and paying website owners on the other end to pass on to their users to execute for free. There is nothing you can do about this, short of personally inspecting the source code. Which in this case will certainly be obfuscated to prevent you from easily understanding it. His response was probably, but I'd still have the problem of proving code correctness—a perfectly legitimate concern. The person who defined the idea that the author defers to told him that it wouldn't solve the problem. Why are we still talking? But the point is, this is totally doable. The theory is sound, Where was this shown? there's high-profile demand for it Where was this shown? I personally would not use a web browser that wasn't compatible with the web. To top it off, the email link provides the brogrammer subject "yo dawg i herd u like TFP" I don't see how anyone has upvoted this article. If you care about browser security, you might be interested in building better sandboxes based on Capabilities[1]. What the poster has shown is a misunderstanding for both the technical problem as well as the reality of why we run JavaScript in the browser: because web pages are written in JavaScript. All attempts to do anything about that have failed the market. [1 | http://en.wikipedia.org/wiki/Capability-based_security http://en.wikipedia.org/wiki/Capability-based_security]