Thread

1. superkuh · 1790470684 · focus · HN ↗

   This shouldn't be a problem right? Javascript is by default allowed to execute on your PC in every modern browser. The days where people did not blindly execute arbitrary code from unknown and random sources are far in the past. Now if you don't do that you are considered weird and no websites actually display anything when you attempt to view them.

   This is not a bug. This is the the entire design architecture's intent for modern JS application execution based "web". If this was the correct choice for the web then this should not be a problem at all. But we all know it is. The architecture choice forces this. Until we stop arbitrarily executing random third party code this will always happen. And the consequences will get worse and worse as more bare metal features are exposed in to browsers JS virtual machines.

   Be the change in the world you want to see. Turn javascript off. Use real native applications that cannot change underneath you.

   1. UqWBcuFx6NV4r · 1790471115 · focus · HN ↗

      In a word, no. If you’re all “ra ra ra JavaScript!” you’re going to be shocked to find out what evil one can accomplish (either now or at various points in the past due to since-patched browser exploits or web platform security oversights) with just HTTP, HTML and CSS. Not only is your pipe dream a pipe dream, and a misinformed one at that, it won’t even come close to completely protecting you. Terms like “code” and “execute” are largely arbitrary. If you want safety, stop letting untrusted payloads enter your machine at all, and that includes Hacker News.

      1. doodlesdev · 1790471261 · focus · HN ↗

            > If you’re all “ra ra ra JavaScript!” you’re going to be shocked to find out what evil one can accomplish (either now or at various points in the past due to since-patched browser exploits or web platform security oversights) with just HTTP, HTML and CSS.
         

         There's such a thing as an attack surface. JavaScript with JIT enabled has an attack surface so much larger than HTML and CSS that I cannot believe you're saying this in good faith.

Unofficial Hacker News client; not affiliated with Y Combinator.