3 ms·
If you did something so horrendously asinine, like make each <script> tag a separate execution context, then you would undo the huge leaps that web interaction
by ahoyhere 17y ago
If you did something so horrendously asinine, like make each <script> tag a separate execution context, then you would undo the huge leaps that web interaction has made - in one fell swoop.
I, for one, remain totally unimpressed by these accusations of insecurity. They don't seem like a big deal at all.
Lazy and/or incompetent programmers will always find a way to write insecure code.
- axod 17y ago>> " then you would undo the huge leaps that web interaction has made - in one fell swoop." Why? Just have them in a separate execution context, and give them specific permissions... eg you can mess with the DOM, but only within this specific element, you can pass me messages, you can't access my execution context etc etc. Such fine grained permissions would allow everything that goes on already, and disallow things you don't want to happen. I agree though, the 'brokenness' is being vastly overplayed here. js isn't "broken", browsers aren't "broken", they just need improving, which is happening.