Hacker News Reader

Comment by Eikon | Hacker News Reader

> But researchers found that the bug could allow malicious JavaScript to run outside of the browser on the host computer.

The phrasing may unfortunately mislead the less technical readers of their audience.

JavaScript always runs “on the host computer”, this should be described as a sandbox escape.

View on HN

I’d say “allowing the code to run on the host computer” is way less confusing for the less technical people than “allowing the code to run outside the sandbox”. Most people have absolutely no idea what sandboxing means.

IHMO lying / being vague is never good when trying to educate someone. Non-technical people are not dumb and can understand what a sandbox is.

How would they know what it is if nobody explains it to them? It's not like the term is obvious.

Not knowing something is better than "knowing" something false.

Whats is false in this case?

https://news.ycombinator.com/item?id=22011910

Have you ever read a summary of a license or a legal document? It's the same idea.

Simplifying terms and using approximations so that the uninitiated can understand is not lying, it's good communication. We can't use jargon all the time.

You can still cut the jargon and tell the essence. E.g. "the exploit allows malicious code to run without the confines of the browser, giving it access to everything the user normally has access to".

> JavaScript always runs “on the host computer”

But they carefully qualified it with "outside of the browser [meaning sandbox]" and you left that out of your quote.

“Browser” does not mean “sandbox” though.

I think they're using it short for 'browser's sandbox.' Try reading it charitably rather than bending over backwards to find fault and making wild accusations of 'lying.'

Not really, I think. "[O]utside of the browser on the host computer" implies that there are other possible ways in which JavaScript could execute, one of those inside of the browser on the host computer, which is pretty much the expected thing and tangentially covers the concept of sandboxing.

Reply on news.ycombinator.com