Hacker News Reader

Comment by pcwalton | Hacker News Reader

I would argue that a world that didn't have JS would make these types of attacks more common, not less common. Because in that world, people would have to download desktop apps for everything, which would make people used to downloading desktop apps from random Web pages, which would make malware easier to distribute.

In fact, we don't have to imagine that world: it was the world of the late 90s.

View on HN

In an ideal world, native apps shouldn't be able to compromise your whole system.

And how would that ideal world come to pass?

Hell, we even tried applets!

Webassembly will get us there

It's still not native apps by any means though…

That's a very real problem, but one would hope that package managers would be a lot more widely adopted in that counterfactual world. Maybe that's a naive hope.

Most people call them app stores these days

Desktop software runs with fewer protections than web applications. So unless everyone is planning on becoming SELinux experts tomorrow, the web still makes sense for a lot of stuff.

Hence why exploits like these are always about getting software installed onto the host rather than being 100% JS.

And before anyone says “but package managers solve this problem”, no they don’t. There have been numerous cases of compromised software leaking into office repositories. It happened with a Ubuntu package were an attacker hacked the upstream repository. It’s happened with npm. Browser extensions from Google and Firefox repos are frequently a source for Trojans. Android and iOS have lots of apps that appear to be free torches or other such utilities but are actually just harvesting all your data. Just because a software package is published to an official repository, it doesn’t make that package safe.

Native applications should be downloaded via your distributions' channels, not from random websites.

but realistically they aren't, so why are you even mentioning it?

not every app is on the windows or Mac App store, not every app is on the Linux package managers. even so there is no sandboxing so you're just waiting until one of them gets compromised and hope nothing bad happens

sandboxing hostile apps is the only true way to protect yourself, and even that isn't perfect

>even so there is no sandboxing

Lenovo sells all-in-one PCs that run Android, and in a world without Javascript, you can imagine such a thing having become much more common that it actually has become so far in our world (e.g., with more enhancements done to Android to work well with a mouse) and of course Android has very solid sandboxing of apps.

Reply on news.ycombinator.com