6 ms·

> In contrast, JavaScript is a core part of the web and is executed within the browser in a sandboxed environment. This means that JavaScript operates with limi

> In contrast, JavaScript is a core part of the web and is executed within the browser in a sandboxed environment. This means that JavaScript operates with limited access to the system's resources, reducing the risk of system-level security breaches. Flash (and probably ActiveX) were also executed in a "sandboxed environment", including "limited access to the system's resources". All 3 have (or well, had, in the case of Flash and ActiveX) regular vulnerabilities - including JavaScript. JavaScript is not any better than Flash or ActiveX and I really don't understand why people pretend it is. BTW, Flash was definitely a core part of the web in its heyday, too. ETA: Oh, and Java was also executed in a sandbox (and a virtual machine!) and had plenty of vulnerabilities back when applets were a thing. At least with Flash, ActiveX, and Java you could choose not to install them and most sites would continue working. For JavaScript you have to install (and trust) some third party extension to block it and then no sites work...

cesarb 3y ago
> Flash (and probably ActiveX) were also executed in a "sandboxed environment", including "limited access to the system's resources". IIRC, the main issue with ActiveX was that it did not execute in a sandboxed environment, unlike Flash and Java. With ActiveX, all you had was a cryptographic signature saying it came from a trusted publisher; past that, the full Win32 API was available, with complete access to the operating system.
- Amigo5862 3y ago
  That wouldn't particularly surprise me. I never used ActiveX, so I can't really speak to that one. But then, there also weren't many (public) websites that I ever ran into that wanted to use it.
  - technion 3y ago
    As someone who still has to support users of several ActiveX apps, turning off the "block unsigned ActiveX" setting goes with the territory of using it.
  - josephg 3y ago
    > But then, there also weren't many (public) websites that I ever ran into that wanted to use it. As I understand it there were weird pockets where organisations went hard in to activeX. IIRC it was used heavily by the South Korean government, and a lot of internal corporate intranet projects for all sorts of things. That obviously caused massive problems a few years later when Microsoft tried to discontinue activex and make IE/Edge a normal web browser.
acdha 3y ago
Flash was never a core part of the web. That was the problem: it was loosely bolted onto browsers but the company behind it didn’t understand or care about the web, spent their time inventing random new things for demos trying to get you to build on top of their platform INSTEAD of the web, and was never willing to spend time on support. > JavaScript is not any better than Flash or ActiveX and I really don't understand why people pretend it is. Because it is. Both of those were hard to use without crashing the browser - the primary selling point for Chrome originally was that it used process sandboxing and so when Flash crashed you wouldn’t lose every open window - whereas what we’re seeing now are complex attacks requiring considerable investment finding ways to get around the layers of precautions. It’s like saying that there’s no difference between leaving your money under the mattress and putting it in the bank because banks still get robbed.
- Amigo5862 3y ago
  [flagged]
  - refulgentis 3y ago
    Way too condescending and hyperbolic in turn, the general excuse being you believe the other post was hyperbolic. Even if the every assertion was 100% correct...D-. Revise and edit and please come see me after class.
    - Amigo5862 3y ago
      No, actually I just don't have time for idiots who make unfalsifiable statements when they've been shown they're wrong. (BTW, uncrashable Chrome just "crashed" for me: all windows, across two profiles, stopped accepting input properly. But hey, Flash bad!)
  - acdha 3y ago
    > That was most definitely not the primary selling point of Chrome. It was very popular, especially for people who did support or were the “tech guy” for their friends & family. Chrome had multiple nice features but the one which most frequently got people to switch permanently was not losing all of your work when Flash crashed. Not having to tell people that the big comment they’d been working on for an hour was permanently gone because some ad in a different windows crashed Flash lead to a lot of installs. This was especially bad for anyone developing in Flash because Adobe was motivated to sell licenses and only cared about reliability to the extent that it impacted sales. Their vision was that instead of using web technologies you’d target Flash and run things maybe on the web, desktops, mobile, or set top boxes but always Flash. The problem with that was that they mostly focused on shiny new things which demoed well but didn’t spend money on QA or support. I shipped a couple of Flash apps in the 2000s where we hit basic bugs in their library code, and the support process was basically that you filed a bug report with a ton of details, didn’t hear anything back until the next major release, and then the issue would be automatically closed with a generic suggestion that you try buying the new version and reporting if it wasn’t fixed. $800 later, you could repeat the process as they never once fixed a bug even with a simple reproducible test case.

cesarb 3y ago

> Flash (and probably ActiveX) were also executed in a "sandboxed environment", including "limited access to the system's resources". IIRC, the main issue with ActiveX was that it did not execute in a sandboxed environment, unlike Flash and Java. With ActiveX, all you had was a cryptographic signature saying it came from a trusted publisher; past that, the full Win32 API was available, with complete access to the operating system.

Amigo5862 3y ago
That wouldn't particularly surprise me. I never used ActiveX, so I can't really speak to that one. But then, there also weren't many (public) websites that I ever ran into that wanted to use it.
- technion 3y ago
  As someone who still has to support users of several ActiveX apps, turning off the "block unsigned ActiveX" setting goes with the territory of using it.
- josephg 3y ago
  > But then, there also weren't many (public) websites that I ever ran into that wanted to use it. As I understand it there were weird pockets where organisations went hard in to activeX. IIRC it was used heavily by the South Korean government, and a lot of internal corporate intranet projects for all sorts of things. That obviously caused massive problems a few years later when Microsoft tried to discontinue activex and make IE/Edge a normal web browser.

acdha 3y ago

Flash was never a core part of the web. That was the problem: it was loosely bolted onto browsers but the company behind it didn’t understand or care about the web, spent their time inventing random new things for demos trying to get you to build on top of their platform INSTEAD of the web, and was never willing to spend time on support. > JavaScript is not any better than Flash or ActiveX and I really don't understand why people pretend it is. Because it is. Both of those were hard to use without crashing the browser - the primary selling point for Chrome originally was that it used process sandboxing and so when Flash crashed you wouldn’t lose every open window - whereas what we’re seeing now are complex attacks requiring considerable investment finding ways to get around the layers of precautions. It’s like saying that there’s no difference between leaving your money under the mattress and putting it in the bank because banks still get robbed.

Amigo5862 3y ago
[flagged]
- refulgentis 3y ago
  Way too condescending and hyperbolic in turn, the general excuse being you believe the other post was hyperbolic. Even if the every assertion was 100% correct...D-. Revise and edit and please come see me after class.
  - Amigo5862 3y ago
    No, actually I just don't have time for idiots who make unfalsifiable statements when they've been shown they're wrong. (BTW, uncrashable Chrome just "crashed" for me: all windows, across two profiles, stopped accepting input properly. But hey, Flash bad!)
- acdha 3y ago
  > That was most definitely not the primary selling point of Chrome. It was very popular, especially for people who did support or were the “tech guy” for their friends & family. Chrome had multiple nice features but the one which most frequently got people to switch permanently was not losing all of your work when Flash crashed. Not having to tell people that the big comment they’d been working on for an hour was permanently gone because some ad in a different windows crashed Flash lead to a lot of installs. This was especially bad for anyone developing in Flash because Adobe was motivated to sell licenses and only cared about reliability to the extent that it impacted sales. Their vision was that instead of using web technologies you’d target Flash and run things maybe on the web, desktops, mobile, or set top boxes but always Flash. The problem with that was that they mostly focused on shiny new things which demoed well but didn’t spend money on QA or support. I shipped a couple of Flash apps in the 2000s where we hit basic bugs in their library code, and the support process was basically that you filed a bug report with a ton of details, didn’t hear anything back until the next major release, and then the issue would be automatically closed with a generic suggestion that you try buying the new version and reporting if it wasn’t fixed. $800 later, you could repeat the process as they never once fixed a bug even with a simple reproducible test case.