3 ms·

It's true that some languages, by their very nature, make exploits like buffer overflows impossible, but if a browser was to be built with entirely new code for

by rikkus 12y ago

It's true that some languages, by their very nature, make exploits like buffer overflows impossible, but if a browser was to be built with entirely new code for this reason, I'd be much happier to see it built on a VM such as a JVM or a CLR, so more widely-known language[s] could be used for development.

lmm 12y ago
Both the JVM and CLR have heap compaction pauses that make them unsuitable for even soft realtime (e.g. video streaming), which is something we want browsers to be capable of. You need either pauseless mutable heap compaction (something only Azul's super-expensive JVM does AIUI, and it requires a modified kernel to do it), a mostly-immutable language (OCaml, Haskell etc.), or explicit but safe memory management (pretty much a new thing in Rust).
edwintorok 12y ago
The Java plugin used to have a lot of security advisories (well maybe not as many as browsers, but still) and Mozilla had to blacklist certain versions: https://addons.mozilla.org/en-US/firefox/blocked/ https://addons.mozilla.org/en-US/firefox/blocked/ If the Java plugin itself has security vulnerabilities how can we expect a full browser written in Java to have none?
- lmm 12y ago
  The Java plugin was trying to do the approximately impossible: run untrusted code that had direct access to all the primitives of a full, first-class programming language. Flaws in the VM security would not compromise the security of a browser written in Java (they might make it hard to e.g. implement a secure plugin system for your browser - but Mozilla doesn't even try to not trust extensions, they rely on signing and allow a signed extension to do anything)
- Lawtonfogle 12y ago
  The Java plugin was trying to give the ability to use Java, which could control all aspects of your machine, without them being able to control all those aspects of your machine. I can't create a javascript that installs a C&C silently in the background, but Java by default would allow all sorts of issues as it isn't sandboxed. The Java plugin was the attempt to build a sandbox. The problems occurred because it is vastly easier to build a sandboxed language from the ground up than to sandbox a language with full access.

by rikkus 12y ago

lmm 12y ago

Both the JVM and CLR have heap compaction pauses that make them unsuitable for even soft realtime (e.g. video streaming), which is something we want browsers to be capable of. You need either pauseless mutable heap compaction (something only Azul's super-expensive JVM does AIUI, and it requires a modified kernel to do it), a mostly-immutable language (OCaml, Haskell etc.), or explicit but safe memory management (pretty much a new thing in Rust).

edwintorok 12y ago

The Java plugin used to have a lot of security advisories (well maybe not as many as browsers, but still) and Mozilla had to blacklist certain versions: https://addons.mozilla.org/en-US/firefox/blocked/ https://addons.mozilla.org/en-US/firefox/blocked/ If the Java plugin itself has security vulnerabilities how can we expect a full browser written in Java to have none?

lmm 12y ago
The Java plugin was trying to do the approximately impossible: run untrusted code that had direct access to all the primitives of a full, first-class programming language. Flaws in the VM security would not compromise the security of a browser written in Java (they might make it hard to e.g. implement a secure plugin system for your browser - but Mozilla doesn't even try to not trust extensions, they rely on signing and allow a signed extension to do anything)
Lawtonfogle 12y ago
The Java plugin was trying to give the ability to use Java, which could control all aspects of your machine, without them being able to control all those aspects of your machine. I can't create a javascript that installs a C&C silently in the background, but Java by default would allow all sorts of issues as it isn't sandboxed. The Java plugin was the attempt to build a sandbox. The problems occurred because it is vastly easier to build a sandboxed language from the ground up than to sandbox a language with full access.