4 ms·
If we follow the idea of killing everything that's "insecure" then we will end up killing everything, because nothing is 100% secure. I vote for improving JavaS
by amix 17y ago
If we follow the idea of killing everything that's "insecure" then we will end up killing everything, because nothing is 100% secure. I vote for improving JavaScript, for example, by sourcing external code via Google Caja. We should also improve defense against XSS and CSRF attacks in today's most popular frameworks (because, a lot of the times it's not the JavaScript that's insecure, but the frameworks that developers use - - i.e. making it possible to source arbitrary HTML is a very bad idea, no matter if JavaScript is used or not [e.g. one can do malicious attacks via an image tag as well]).
- gdp 17y ago> If we follow the idea of killing everything that's "insecure" then we will end up killing everything, because nothing is 100% secure Perhaps, but killing off the stuff that is obviously and demonstrably broken seems like a pretty sensible policy.
- amix 17y agoKilling one of the most popular languages isn't a solution, it's only wishful thinking. The situation with JavaScript isn't that bad, we just needs better tools such as a secure way to source external JavaScript and better protection against XSS and CSRF attacks... If these issues are solved, then 90% of the problems are solved.
- gdp 17y agoWe're entitled to wishful thinking. Wishful thinking gives us something to aim for, and then we can evaluate in realistic terms how far towards that goal we can get.
- thismat 17y agoIndeed, everyday I'm using this wishful thinking thing in hopes they won't give me a COBOL project that day. :(