Hacker News new | past | comments | ask | show | jobs | submit
vanviegen | on: Is this the new cyber normal?
You're blaming JavaScript? The language that succeeded at delivering fully sandboxed rich client-side applications better than any other tech? With the worst incidents generally being 'just' various forms of fingerprinting?

Or, if you're thinking server-side JavaScript: would the web have been more secure running PHP and Python?

__MatrixMan__ | parent | next
The language that made it normal to blindly run code that you found lying around on some page? Elsewhere we'd call that a remote code execution exploit. JavaScript just calls it another day at the office.

And it's not fully sandboxed. It betrays its user all the time by abusing unrestricted access to the network, or activating browser functionality that most of us would disable if we could.

I'm not saying it's THE bad decision, but it is the product of a generation of thinkers who were not thinking about threats the way we do now. If we were to go back in time and have the opportunity to do it differently, I think we would take that opportunity.

But we don't actually need a time machine. We can just accept some sunk costs and move forward anyhow.

saltcured | root | parent | next
To be fair, Java applets and the Flash plugin socialized that before Javascript tried to walk us back from the edge just a bit.

And before that, whatever Microsoft "macro" or embedded code variant was popular that week in all those document formats...

ifwinterco | root | parent
Blindly running client side code (within a very carefully designed sandbox) is necessary for the modern web to operate, and people like the modern web.

We aren't going back to a page refresh every time you want to update something any time soon

loading story #50219150
loading story #50212597
loading story #50215084
JKCalhoun | parent
Perhaps the web was more secure when it wasn't running anything—just serving up static web pages?
vanviegen | root | parent | next
Sure. It was also a lot less functional.
preg_match | root | parent
Kind of, but in practice not really. Sure, something like a photo editor would never be possible in Web 1.0.

But 99% of web applications are forms and displaying stuff. All JS accomplished is making it look prettier and enhanced tracking.

I mean, Facebook, my bank, Amazon… these can all be created with no client side code. It would be a lot of refreshes, but it can be done.

loading story #50218647
__MatrixMan__ | root | parent
A declarative approach would go a long way. Like, I'm not evaluating restaurants on the basis of their website quality, so why not have a restaurant browser and they can all just expose data according to some common schema. Same this with banks. Same thing with most things.

If you want a wildly interactive art experience, just load the appropriate browser for that.

pwdisswordfishq | root | parent
Because restaurants don't want businesses like DoorFash to scrape it.
| root | parent
{"deleted":true,"id":50210782,"parent":50209065,"time":1792769778,"type":"comment"}