Hacker News Reader

Comment by hackerfromthefu | Hacker News Reader

I think what he is saying is that Javascript is a broken language. Fundamentally un-securable when third party code is used.

View on HN

That's a pretty extreme way to say it. Python is in essentially the same boat, as is bash, Ruby, PHP, dart... Calling languages "broken" is to say that one hard problem makes them unsuitable for use, which is hardly true.

I think the main concern here is that it isn't that the language is too permissive -- but that the primary installer (and what many people cite as one of the greatest strengths of JS, largely responsible for ushering in its Golden Age) -- is structurally (and perhaps irreparably) insecure.

Whether this is really so (and in a significant way compared to its other competitors, out in dynamic programming land) -- is what people seem to be trying to suss out in this thread.

how is it any less problematic than python or ruby in this regard?

The top comment mentions Deno, which doesn't have NPM or even use a package manager. So I'm not sure how the "installer" is the relevant problem

Javascript was designed and intended to be used within the context of a browser to manipulate the DOM and script webpages. It is unsuitable for any other use.

agree, assuming you're talking about language version ES1 circa 1995.

The fact that including a package in your webpage/app, which includes a tree of hundreds of others, one of which can 'dynamically' overwrite/redefine other pieces of the namespace with impunity, is why it's broken in the first place.

ergo it is insecure by design for all uses, and unsuitable for anything important relying on code you wrote doing what you expect.

It's fair to say it's broken in a world where what we do in webpages MATTERS. It was fine in the past where nothing truly important happened in web pages, but that ship has sailed.

So when you include a 3rd party C++ library, how do you know it's not doing some malicious things?

Yup, that's how I read it too. :) Was just wondering what a comprehensive counter-argument would look like.

If there is one, that is.

So which language doesn't have this problem when including 3rd party libraries?

Reply on news.ycombinator.com