4 ms·

I would argue that a world that didn't have JS would make these types of attacks more common, not less common. Because in that world, people would have to downl

I would argue that a world that didn't have JS would make these types of attacks more common, not less common. Because in that world, people would have to download desktop apps for everything, which would make people used to downloading desktop apps from random Web pages, which would make malware easier to distribute. In fact, we don't have to imagine that world: it was the world of the late 90s.

WhyNotHugo 3y ago
Native applications should be downloaded via your distributions' channels, not from random websites.
- slikrick 3y ago
  but realistically they aren't, so why are you even mentioning it? not every app is on the windows or Mac App store, not every app is on the Linux package managers. even so there is no sandboxing so you're just waiting until one of them gets compromised and hope nothing bad happens sandboxing hostile apps is the only true way to protect yourself, and even that isn't perfect
  - hollerith 3y ago
    >even so there is no sandboxing Lenovo sells all-in-one PCs that run Android, and in a world without Javascript, you can imagine such a thing having become much more common that it actually has become so far in our world (e.g., with more enhancements done to Android to work well with a mouse) and of course Android has very solid sandboxing of apps.
livueta 3y ago
That's a very real problem, but one would hope that package managers would be a lot more widely adopted in that counterfactual world. Maybe that's a naive hope.
- yesco 3y ago
  Most people call them app stores these days
- hnlmorg 3y ago
  Desktop software runs with fewer protections than web applications. So unless everyone is planning on becoming SELinux experts tomorrow, the web still makes sense for a lot of stuff. Hence why exploits like these are always about getting software installed onto the host rather than being 100% JS. And before anyone says “but package managers solve this problem”, no they don’t. There have been numerous cases of compromised software leaking into office repositories. It happened with a Ubuntu package were an attacker hacked the upstream repository. It’s happened with npm. Browser extensions from Google and Firefox repos are frequently a source for Trojans. Android and iOS have lots of apps that appear to be free torches or other such utilities but are actually just harvesting all your data. Just because a software package is published to an official repository, it doesn’t make that package safe.
vhcr 3y ago
In an ideal world, native apps shouldn't be able to compromise your whole system.
- lazide 3y ago
  And how would that ideal world come to pass? Hell, we even tried applets!
  - quickthrower2 3y ago
    Webassembly will get us there
    - littlestymaar 3y ago
      It's still not native apps by any means though…

WhyNotHugo 3y ago

Native applications should be downloaded via your distributions' channels, not from random websites.

slikrick 3y ago
but realistically they aren't, so why are you even mentioning it? not every app is on the windows or Mac App store, not every app is on the Linux package managers. even so there is no sandboxing so you're just waiting until one of them gets compromised and hope nothing bad happens sandboxing hostile apps is the only true way to protect yourself, and even that isn't perfect
- hollerith 3y ago
  >even so there is no sandboxing Lenovo sells all-in-one PCs that run Android, and in a world without Javascript, you can imagine such a thing having become much more common that it actually has become so far in our world (e.g., with more enhancements done to Android to work well with a mouse) and of course Android has very solid sandboxing of apps.

livueta 3y ago

That's a very real problem, but one would hope that package managers would be a lot more widely adopted in that counterfactual world. Maybe that's a naive hope.

yesco 3y ago
Most people call them app stores these days
hnlmorg 3y ago
Desktop software runs with fewer protections than web applications. So unless everyone is planning on becoming SELinux experts tomorrow, the web still makes sense for a lot of stuff. Hence why exploits like these are always about getting software installed onto the host rather than being 100% JS. And before anyone says “but package managers solve this problem”, no they don’t. There have been numerous cases of compromised software leaking into office repositories. It happened with a Ubuntu package were an attacker hacked the upstream repository. It’s happened with npm. Browser extensions from Google and Firefox repos are frequently a source for Trojans. Android and iOS have lots of apps that appear to be free torches or other such utilities but are actually just harvesting all your data. Just because a software package is published to an official repository, it doesn’t make that package safe.

vhcr 3y ago

In an ideal world, native apps shouldn't be able to compromise your whole system.

lazide 3y ago
And how would that ideal world come to pass? Hell, we even tried applets!
- quickthrower2 3y ago
  Webassembly will get us there
  - littlestymaar 3y ago
    It's still not native apps by any means though…