4 ms·

This raises another issue I have been concerned with for a while. The WWW model is broken, namely the use of Javascript. I'm not talking about the language itse

This raises another issue I have been concerned with for a while. The WWW model is broken, namely the use of Javascript. I'm not talking about the language itself, it has been getting enough love lately as it is. Just the idea of a webserver sending me code, obfuscated code at that [1], that my browser executes by default; how did this idea prevail on the web, I wonder. Am I the only one to see the horrendous security flaw? "Come to my website, I'll distract you with my pretty pictures while my code roams freely on your computer[2]". [1] - I know obfuscation is minification meant for minimizing bandwith consumption. It's still obfuscated code, despite best intent. [2] - I understand that the code execution is sandboxed inside the web browser, but really is it at all possible that, you know, these guys let the occasional security flaw slip?

omgtehlion 15y ago
Javascript has nothing to do with auto fill
- pagekalisedown 15y ago
  You're correct, but the parent brings up a valid (if a bit off topic) point. Eye candy is great, but Javascript has often been a vector for privacy issues. Hence the popularity of Noscript and most browsers having an option to disable Javascript.
Jach 15y ago
> Am I the only one to see the horrendous security flaw? No, every user of NoScript sees it. At the end of the day, your computer has executed billions upon billions of instructions, most of which you have no idea what their purpose is or if they leak your security or privacy. Even those of us running a Linux box have this problem. I trust a lot of code, I trust my CPU and my BIOS and my OS, and my NoScript whitelist has only grown, it doesn't shrink. (It does gain temporary permissions every so often when I don't quite trust the source but figure the risks are negligible.) The vast majority of people (and website owners) don't want to harm you or your computer or society as a whole (There is a lot of low-hanging fruit for the studious domestic terrorist.) People have good reason to think they'll be safe executing unknown code. The model caught on because it's useful and because the web of trust extends far. NoScript is still used by the minority and that's unlikely to change.

omgtehlion 15y ago

Javascript has nothing to do with auto fill

pagekalisedown 15y ago
You're correct, but the parent brings up a valid (if a bit off topic) point. Eye candy is great, but Javascript has often been a vector for privacy issues. Hence the popularity of Noscript and most browsers having an option to disable Javascript.

Jach 15y ago

> Am I the only one to see the horrendous security flaw? No, every user of NoScript sees it. At the end of the day, your computer has executed billions upon billions of instructions, most of which you have no idea what their purpose is or if they leak your security or privacy. Even those of us running a Linux box have this problem. I trust a lot of code, I trust my CPU and my BIOS and my OS, and my NoScript whitelist has only grown, it doesn't shrink. (It does gain temporary permissions every so often when I don't quite trust the source but figure the risks are negligible.) The vast majority of people (and website owners) don't want to harm you or your computer or society as a whole (There is a lot of low-hanging fruit for the studious domestic terrorist.) People have good reason to think they'll be safe executing unknown code. The model caught on because it's useful and because the web of trust extends far. NoScript is still used by the minority and that's unlikely to change.