2 ms·

I am happy this one died. It was just another attempt by Microsoft to sidestep open web standards in favor of a proprietary platform. The other notorious exampl

I am happy this one died. It was just another attempt by Microsoft to sidestep open web standards in favor of a proprietary platform. The other notorious example is Flash, and both should be considered malware.

ugh123 1y ago
Did Silverlight have the same security issues as Flash?
- cube00 1y ago
  Yes, even using C# couldn't save them. > A remote code execution vulnerability exists when Microsoft Silverlight decodes strings using a malicious decoder that can return negative offsets that cause Silverlight to replace unsafe object headers with contents provided by an attacker. In a web-browsing scenario, an attacker who successfully exploited this vulnerability could obtain the same permissions as the currently logged-on user. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-006 https://learn.microsoft.com/en-us/security-updates/securityb...
- klabetron 1y ago
  Probably didn’t have the level of adoption needed for the nefarious types to justify spending time finding Silverlight exploits.
Rohansi 1y ago
Open web standards are great but consider where we could have been if competition drove them a different way? We're still stuck with JavaScript today (wasm still needs it). Layout/styling is caught up now but where would we be if that came sooner?
- motorest 1y ago
  > Open web standards are great but consider where we could have been if competition drove them a different way? We're still stuck with JavaScript today (wasm still needs it). Layout/styling is caught up now but where would we be if that came sooner? Why do you think JavaScript is a problem? And a big enough problem to risk destroying open web standards.
  - deleted 1y ago
    [deleted]
  - piskov 1y ago
    The same reason Typescript exists
    - motorest 1y ago
      > The same reason Typescript exists TypeScript exists for the same reason things like mypy exists, and no one in their right mind claims that python's openness should be threatened just because static typing is convenient.
      - nurbl 1y ago
        Though in principle they serve similar purposes there are some big differences though. Python with types is still just python. Typescript is a different language from JS (guess it a superset?) and it being controlled by a large company could be considered problematic. I suppose JS could go in the same direction and adopt the typing syntax from TS as a non-runtime thing. Then the typescript compiler would become something like mypy, an entirely optional part of the ecosystem.
        motorest 1y ago
        > Python with types is still just python. Typescript is a different language from JS (guess it a superset?) No, it's the exact same thing. TypeScript adds support for type annotations, and removing these annotations leads to JavaScript. See how Node.js added support for TypeScript by implementing type stripping in v22. https://nodejs.org/api/typescript.html#type-stripping https://nodejs.org/api/typescript.html#type-stripping
piskov 1y ago
What web standards? :-) Stuff like angularjs was basically created for the same reason flash/silverlight went down — iphone
adabyron 1y ago
Flash & Silverlight were both ahead of the current open web standards at the time. They also didn't suffer as much from the browser wars. Flash's ActionScript helped influence changes to modern JS that we all enjoy. You sometimes need alternative ideas to promote & improve ideas for open web standards.

ugh123 1y ago

Did Silverlight have the same security issues as Flash?

cube00 1y ago
Yes, even using C# couldn't save them. > A remote code execution vulnerability exists when Microsoft Silverlight decodes strings using a malicious decoder that can return negative offsets that cause Silverlight to replace unsafe object headers with contents provided by an attacker. In a web-browsing scenario, an attacker who successfully exploited this vulnerability could obtain the same permissions as the currently logged-on user. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-006 https://learn.microsoft.com/en-us/security-updates/securityb...
klabetron 1y ago
Probably didn’t have the level of adoption needed for the nefarious types to justify spending time finding Silverlight exploits.

Rohansi 1y ago

Open web standards are great but consider where we could have been if competition drove them a different way? We're still stuck with JavaScript today (wasm still needs it). Layout/styling is caught up now but where would we be if that came sooner?

motorest 1y ago
> Open web standards are great but consider where we could have been if competition drove them a different way? We're still stuck with JavaScript today (wasm still needs it). Layout/styling is caught up now but where would we be if that came sooner? Why do you think JavaScript is a problem? And a big enough problem to risk destroying open web standards.
- deleted 1y ago
  [deleted]
- piskov 1y ago
  The same reason Typescript exists
  - motorest 1y ago
    > The same reason Typescript exists TypeScript exists for the same reason things like mypy exists, and no one in their right mind claims that python's openness should be threatened just because static typing is convenient.
    - nurbl 1y ago
      Though in principle they serve similar purposes there are some big differences though. Python with types is still just python. Typescript is a different language from JS (guess it a superset?) and it being controlled by a large company could be considered problematic. I suppose JS could go in the same direction and adopt the typing syntax from TS as a non-runtime thing. Then the typescript compiler would become something like mypy, an entirely optional part of the ecosystem.
      - motorest 1y ago
        > Python with types is still just python. Typescript is a different language from JS (guess it a superset?) No, it's the exact same thing. TypeScript adds support for type annotations, and removing these annotations leads to JavaScript. See how Node.js added support for TypeScript by implementing type stripping in v22. https://nodejs.org/api/typescript.html#type-stripping https://nodejs.org/api/typescript.html#type-stripping

piskov 1y ago

What web standards? :-) Stuff like angularjs was basically created for the same reason flash/silverlight went down — iphone

adabyron 1y ago

Flash & Silverlight were both ahead of the current open web standards at the time. They also didn't suffer as much from the browser wars. Flash's ActionScript helped influence changes to modern JS that we all enjoy. You sometimes need alternative ideas to promote & improve ideas for open web standards.