Comment by UqWBcuFx6NV4r | Hacker News Reader

Comment by UqWBcuFx6NV4r | Hacker News Reader

Parent Full thread

In a word, no. If you’re all “ra ra ra JavaScript!” you’re going to be shocked to find out what evil one can accomplish (either now or at various points in the past due to since-patched browser exploits or web platform security oversights) with just HTTP, HTML and CSS. Not only is your pipe dream a pipe dream, and a misinformed one at that, it won’t even come close to completely protecting you. Terms like “code” and “execute” are largely arbitrary. If you want safety, stop letting untrusted payloads enter your machine at all, and that includes Hacker News.

   > If you’re all “ra ra ra JavaScript!” you’re going to be shocked to find out what evil one can accomplish (either now or at various points in the past due to since-patched browser exploits or web platform security oversights) with just HTTP, HTML and CSS.

There's such a thing as an attack surface. JavaScript with JIT enabled has an attack surface so much larger than HTML and CSS that I cannot believe you're saying this in good faith.

Look at how many browser exploits need JS, and how many don't. The latter tend to be far more memorable too, specifically for that reason.

JS is a huge attack surface. It's better if it isn't used where it isn't actually needed.

Reply on news.ycombinator.com