4 ms·
> A much better point against JS would have been about XSS or similar. I don't think anyone was making a point against JavaScript in terms of vulnerabilities i
by apotheon 17y ago
> A much better point against JS would have been about XSS or similar.
I don't think anyone was making a point against JavaScript in terms of vulnerabilities in the JavaScript interpreter itself. If you read the statement to which you reply, you might notice that the parent comment referred to people wanting to avoid execution of code from the Internet on the machine -- not about whether JavaScript is itself directly vulnerable.
> the local-machine arbitrary-code-execution exploit you seemed to allude to.
I didn't get that impression at all.
- sho 17y ago"I didn't get that impression at all." Sorry - as mentioned in my other reply at this level, I really was imagining a certain type of person (in fact, a certain person) as I typed that, and kind of went off on my own. Still: "you might notice that the parent comment referred to people wanting to avoid execution of code from the Internet on the machine" I maintain this is a largely irrational fear. The very phrase "execution of code" is very blurry when it comes to the web browser. And one hitherto unknown bug in an image or (closed source) PDF library and you're "executing code from the internet" too, and at a far more dangerous level of access than anything inside the JS sandbox.
- apotheon 17y agoI don't really see how the equivalent of "I'm already at risk, so I may as well be at further risk" is an effective counterargument.