4 ms·
If including JIT in a system renders its developer incapable of guaranteeing memory safety, then perhaps that developer’s approach to JIT is not yet mature enou
by odyssey7 28d ago
If including JIT in a system renders its developer incapable of guaranteeing memory safety, then perhaps that developer’s approach to JIT is not yet mature enough to ethically distribute to non-technical consumers who are not positioned to evaluate that their security is being traded off by the developer on their behalf.
We’re past the era where security issues emanating from memory-unsafe code were tolerated due to being unavoidable — continuing to expose your software’s users to them in this present day and age is simply a choice.
- jaen 28d agoYou're just offering non-helpful ivory tower criticism without even understanding the problem space (which is actually one of the hardest open research problems in software engineering, cs.PL + formal methods). But if I'm wrong, dare say, how would you write a production memory-safe JIT compiler today?
- odyssey7 28d agoIf I couldn't guarantee memory safety, I wouldn't. We're talking about an optional feature for JavaScript engines. Security is where the rubber hits the road. It's whether customers' identities get stolen. It's whether leaders of undemocratic countries can monitor communications, locations, and social networks of people whom they oppress. Calling this an "ivory tower" criticism is, ironically, a lack of acknowledgement of reality and that our actions have consequences to others.
- deleted 26d ago[deleted]