Comment by axod | Hacker News Reader

Comment by axod | Hacker News Reader

Parent Full thread

>> "because people make all sorts of mistakes and they would have to understand what it means."

I think this sums it up really. People make mistakes and make insecure software. Whatever language it is. I fail to see how swapping out js for anything else would solve anything. It's all pretty moot also, since it'd never happen.

The JSON attack again, isn't any inherent insecurity in the language, just in the way it is used within browsers.

Lets improve browser security rather than focusing on a language which has pretty much nothing to do with security issues. None of the examples you give had anything to do with the core javascript language. They were all about how it is used in the context of browsers.

Just to get this straight, one of your arguments is that since some browsers apparently execute the javascript inside css "url('javascript:...", the solution is to change javascript for some other language? Do you understand how ridiculous that seems?

Given that I object to the use of Javascript outside of browsers, you've basically negated (for me) any reason to treat the issue of language security versus browser security separately.

>> "Given that I object to the use of Javascript outside of browsers"

Fine. You seem to have something odd and bizarre against the language. Good luck to you and your quest.

You also don't seem to realize that swapping out js for some other language would mean exactly the same security issues, unless you actually fixed those security issues where they are - in the BROWSER.

If you would like to learn about the language, I'd recommend "O'Reilly Definitive Javascript". Also checkout Rhino.

> You seem to have something odd and bizarre against the language.

It's not "odd and bizarre" - it's a belief that the language is fundamentally unsuitable for the things that people insist upon using it for, and reasonably well supported by my own experiences of the language, as well as the reported experiences of others.

> You also don't seem to realize that swapping out js for some other language would mean exactly the same security issues, unless you actually fixed those security issues where they are - in the BROWSER.

I take it you didn't read my reasonably concrete proposals for the use of proof carrying code? It becomes a largely mechanical process to verify that the browser and the language implement "security" in a sensible way at that point.

> If you would like to learn about the language, I'd recommend "O'Reilly Definitive Javascript". Also checkout Rhino.

Thanks. If you would like to learn about Horse and Pony care, I recommend "BHS Complete Horse and Pony Care".

Reply on news.ycombinator.com