The web as we know it was never securable. LLMs made it obvious. We made a wrong turn somewhere back around JavaScript. Eventually we'll get fed up with the quick fixes and design something better. I don't blame the LLMs for this. I blame whoever made that wrong turn back in the 90's (and us, for not turning around sooner).
You're blaming JavaScript? The language that succeeded at delivering fully sandboxed rich client-side applications better than any other tech? With the worst incidents generally being 'just' various forms of fingerprinting?
Or, if you're thinking server-side JavaScript: would the web have been more secure running PHP and Python?
The language that made it normal to blindly run code that you found lying around on some page? Elsewhere we'd call that a remote code execution exploit. JavaScript just calls it another day at the office.
And it's not fully sandboxed. It betrays its user all the time by abusing unrestricted access to the network, or activating browser functionality that most of us would disable if we could.
I'm not saying it's THE bad decision, but it is the product of a generation of thinkers who were not thinking about threats the way we do now. If we were to go back in time and have the opportunity to do it differently, I think we would take that opportunity.
But we don't actually need a time machine. We can just accept some sunk costs and move forward anyhow.
loading story #50213967
loading story #50211261
Perhaps the web was more secure when it wasn't running anything—just serving up static web pages?
loading story #50212590
loading story #50210782