Hacker News Reader

Comment by mccr8 | Hacker News Reader

JIT bugs like this are not easily solved simply by writing a browser in a typesafe language.

Here's the commit that fixes this issue: https://chromium.googlesource.com/v8/v8/+/e0562d87ad9c17042b...

If including JIT in a system renders its developer incapable of guaranteeing memory safety, then perhaps that developer’s approach to JIT is not yet mature enough to ethically distribute to non-technical consumers who are not positioned to evaluate that their security is being traded off by the developer on their behalf.

We’re past the era where security issues emanating from memory-unsafe code were tolerated due to being unavoidable — continuing to expose your software’s users to them in this present day and age is simply a choice.

You're just offering non-helpful ivory tower criticism without even understanding the problem space (which is actually one of the hardest open research problems in software engineering, cs.PL + formal methods).

But if I'm wrong, dare say, how would you write a production memory-safe JIT compiler today?

If I couldn't guarantee memory safety, I wouldn't. We're talking about an optional feature for JavaScript engines.

Security is where the rubber hits the road. It's whether customers' identities get stolen. It's whether leaders of undemocratic countries can monitor communications, locations, and social networks of people whom they oppress.

Calling this an "ivory tower" criticism is, ironically, a lack of acknowledgement of reality and that our actions have consequences to others.

Reply on news.ycombinator.com