Hacker News Reader

Comment by gue5t | Hacker News Reader

Javascript is turing-complete. That's a /lot/ of power and that means that security-conscious users (especially given the proliferation of more-powerful JS apis allowing the possibility for exploits in file, GPU, etc. access, along with JIT-enabled exploits as opposed to the old simple interpreting) will have it turned off whenever possible.

Using CSS for non-turing-complete interactions which are limited in their computational ability to a simple automaton means that CSS can be trusted much more than JS, and that there are stricter guarantees on performance. It's also semantically cleaner when used for things like visual effects on windows, because even if CSS doesn't load, the markup representing the menu will be intact. JS systems have the ability to load markup asynchronously or generate it from other data in the page and destroy all notion of graceful degradation.

View on HN

CSS is technically Turing complete too: http://lambda-the-ultimate.org/node/4222

It has nothing to do with turing completeness.

More complexity leading to bigger surface area for potential attacks, yes. GPU and file access, yes. But nothing to do with turing completeness.

Here's a non turing complete language I wouldn't like to be able to run in a web context. It has a single command: rm {path}

On the other hand a turing complete language that has no access to any IO, DOM manipulation etc. I would be perfectly happy to let run.

It isn't the power that comes from turing completeness that makes javascript a potential security vulnerability, it's the interactions it can have outside of computation.

Its imperative nature (mutation, side effects) and potential non-termination makes it unattractive as a catch-all hypertext document language.

By using the language of Least Power (timbl@w3c.org) that still accomplishes your task, you achieve a more concise and more analyzable document.

I wouldn't call that "nothing to do with TC".

Its imperative nature is unrelated to TC.

Non TC languages can be sufficiently complex as to make analysis difficult.

I don't see any of the risks of js as linked to TC in any meaningful way beyond a very hand-wavey "TC tends to lead to complexness".

Let's be clear: "security-conscious users" who turn off Javascript are a very small minority. If a site is geared towards serving developers or small startups, it might be serving this minority. If not, SEO ("how do I make this site readable by search engines?") will be a much larger concern than "graceful degradation for the benefit of the tiny few who care about security enough to disable Javascript or use NoScript but not whitelist my sites' scripts". Often designing something to gracefully degrade will serve both SEO and security-conscious users, but in cases where it won't (this case for example -- where Google decidedly doesn't care about the layout of the navigation items, as long as they're accessible to it), there's not much incentive to find a pure-CSS approach when a pure-JS approach might be simpler.

Reply on news.ycombinator.com