| ▲ | publlus_enigma 5 hours ago |
| Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made. |
|
| ▲ | pizlonator 3 hours ago | parent | next [-] |
| I think the problem is that we've let JS engines become absurdly complex so there's no way to avoid them having really gross bugs. That said, I think that the V8 team has done a fantastic job of securing their engine. Their heap sandbox feature is really inspiring! It's really wild that (as far as I can understand this issue) someone is able to bypass it. (Posted from a memory safe browser - WebKit MiniBrowser compiled with Fil-C. Pretty sure this is safer than even V8 and the heap sandbox.) |
|
| ▲ | grishka 3 hours ago | parent | prev | next [-] |
| Running code by itself isn't that bad, it's the fact that browser developers have decided for some reason that this code needs to be as performant as possible, so, JIT. I don't get it! The way JS is typically used, it doesn't even benefit from JIT all that much. Making ajax requests, doing stuff with strings, and moving DOM elements around doesn't need every CPU clock cycle to be used as optimally as possible. It's exceedingly rare for websites to actually be doing something that needs raw performance. And SPAs will be slow no matter what. |
| |
| ▲ | varenc 2 hours ago | parent | next [-] | | I disagree about JIT performance not mattering. I enabled "Lockdown Mode" on iOS which disables the JIT for the mentioned security reasons, and it causes a very noticeable lagginess on many sites. Of course, the primary cause is the unnecessary JS monstrosities wasting CPU cycles. But practically speaking I can say that disabling the JIT results in a very subpar experience of many JS heavy pages. | | |
| ▲ | Rohansi an hour ago | parent [-] | | It will also increase power consumption because your CPU has to do more work to run the same code. |
| |
| ▲ | cute_boi 3 hours ago | parent | prev | next [-] | | Agree. Chrome should just disable JIT by default and boom many website owner will start to optimize their website. | | |
| ▲ | andrekandre 2 hours ago | parent [-] | | jira and confluence come to mind... | | |
| ▲ | macintux 2 hours ago | parent | next [-] | | I suspect the people who agree to buy Jira & Confluence are not particularly heavy users of them. At least, that's the only explanation I can fathom for their continued sales. | |
| ▲ | DANmode 2 hours ago | parent | prev [-] | | Is it their app’s features that are slow, or the analytics bolted on top? | | |
| ▲ | shakna 40 minutes ago | parent [-] | | Both. And all the dependencies of both are slow. And the dependencies of those are slow, too. |
|
|
| |
| ▲ | DANmode 2 hours ago | parent | prev [-] | | > SPAs will be slow no matter what. Uh…no? You’re presumably talking about specific terrible prebuilt frameworks - not someone building a nice vanilla SPA. | | |
| ▲ | grishka an hour ago | parent [-] | | At this point SPA pretty much implies React. But even if you optimize everything the best you could and avoid any third-party runtime dependencies, it's still going to be significantly more work to make API requests and do client-side rendering vs just rendering HTML server-side. |
|
|
|
| ▲ | flippingheck 3 hours ago | parent | prev | next [-] |
| > decision we have made This might oversell the agency that practicioners have. Sandboxed zero-install delivery will outcompete anything with more frictionful installs. It's probably not the right model for a pacemaker though. Web/JS has been a double-edged sword for FOSS: sure, I can run a free OS, but if most of my "apps" happen to be JS that I can't practically control, then I have won a battle and lost a war. |
| |
| ▲ | JacobKfromIRC 2 hours ago | parent | next [-] | | I wish Haketilo [1] would have caught on more. There's so many free JavaScript apps but we're mostly just missing a way to actually control which version or derivative of the JavaScript is run. There's also the problem of most free apps not doing a good job of providing license info and a link to source code, but this could be sidestepped by a trusted repository which provides license info itself. [1] https://haketilo.koszko.org/ | |
| ▲ | jewsdienow 23 minutes ago | parent | prev [-] | | [dead] |
|
|
| ▲ | asveikau 5 hours ago | parent | prev | next [-] |
| I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking. |
| |
| ▲ | Espressosaurus 4 hours ago | parent | next [-] | | It became insane because nothing bloody worked without Javascript some time in the early 2010s. Like cellphones, javascript became necessary if you want to use webmail, access your bank's website, or whatever. | | |
| ▲ | ThunderSizzle 4 hours ago | parent | next [-] | | I still run with u matrix though, and most third party requests can be limited, but I no longer have enough patience when a required page doesn't work - I'll just rely on ublock origin to work. | |
| ▲ | nixosbestos 4 hours ago | parent | prev [-] | | I say this as someone does NOT disable JS in my main browser (because like, I have a job), but also knows a fair bit about why Firefox inside Tails now restarts in some cases... It's the classic thing. Across every gdmf metric, excluding with "true empathy", no one *gives a fuck* until it affects them, or someone within (1-3) degrees of separatation. And having broad empathy is generally a good way to get yourself labeled/astrocized: both about as obvious "compriate" and obvious "adversary". |
| |
| ▲ | bawolff 4 hours ago | parent | prev | next [-] | | In fairness, in the early 2000s they were probably right. Early browser security model was a bit of a mess. The fact that this article is even talked about is a sign of how much better things are. | | | |
| ▲ | l00sed 3 hours ago | parent | prev | next [-] | | It's so ubiquitous and unavoidable at this point.. I was at a conference lecture in 2020 where someone was suggesting disabling JavaScript and I thought the same thing— how absurd. The times have really changed... | |
| ▲ | whizzter 4 hours ago | parent | prev | next [-] | | I still do "random" browsing in FF with NoScript, that said, I'll acknowledge the frequency of updates of Chrome,etc and years of hardening. It's not the Bonzi-buddy and driveby-installed IE toolbars wild west of the early 00s. | | |
| ▲ | nik282000 3 hours ago | parent [-] | | The browsers on the computers at work show that it is very much still the driveby tool-bar install days. |
| |
| ▲ | jewsdienow 22 minutes ago | parent | prev [-] | | [dead] |
|
|
| ▲ | eru 5 hours ago | parent | prev | next [-] |
| In the future we can ask that your JaveScript and Wasm comes with a proof of being benign. |
| |
|
| ▲ | tcdent 4 hours ago | parent | prev [-] |
| V8 as a runtime goes far deeper than just webpages. |
