You're blaming JavaScript? The language that succeeded at delivering fully sandboxed rich client-side applications better than any other tech? With the worst incidents generally being 'just' various forms of fingerprinting?

Or, if you're thinking server-side JavaScript: would the web have been more secure running PHP and Python?

▲

__MatrixMan__ a day ago | parent | next [-]

The language that made it normal to blindly run code that you found lying around on some page? Elsewhere we'd call that a remote code execution exploit. JavaScript just calls it another day at the office.

And it's not fully sandboxed. It betrays its user all the time by abusing unrestricted access to the network, or activating browser functionality that most of us would disable if we could.

I'm not saying it's THE bad decision, but it is the product of a generation of thinkers who were not thinking about threats the way we do now. If we were to go back in time and have the opportunity to do it differently, I think we would take that opportunity.

But we don't actually need a time machine. We can just accept some sunk costs and move forward anyhow.

▲

saltcured a day ago | parent | next [-]

To be fair, Java applets and the Flash plugin socialized that before Javascript tried to walk us back from the edge just a bit.

And before that, whatever Microsoft "macro" or embedded code variant was popular that week in all those document formats...

▲

ifwinterco a day ago | parent | prev [-]

Blindly running client side code (within a very carefully designed sandbox) is necessary for the modern web to operate, and people like the modern web.

We aren't going back to a page refresh every time you want to update something any time soon

▲

__MatrixMan__ a day ago | parent | next [-]

Are you sure people like the modern web? It's increasingly used as a weapon against them. I don't know anybody under 20 who likes the modern web. As for the others, I think its more about nostalgia.

▲

no-name-here 16 hours ago | parent | next [-]

> Are you sure people like the modern web?

People will often claim to dislike something, even though they would dislike the alternative even more (and they might even be actively choosing against the alternative). Pay more attention to what people’s actions reveal than what they claim.

(This happens not just in tech.)

▲

pwdisswordfishq 12 hours ago | parent [-]

In other news, anyone who has ever claimed to want to quit smoking is lying.

▲

no-name-here 10 hours ago | parent [-]

I guess the far closer(/better?) analogy would be something like people saying they dislike the ad-supported model for newspaper websites, YouTube, etc. However, many of those sites offer (or even heavily promote) options to get rid of the ads. (A number of the highest-regarded newspapers still even offer print versions too.)

	▲	cowlevel 5 hours ago \| parent [-]
		YouTube is currently getting sued because if you pay to remove ads you still get ads

▲

icedchai a day ago | parent | prev [-]

The tech that made the old web still exists. Everything is a GET, a form POST, and needs a page reload. You can still use tables for layout like it's 1996.

	▲	__MatrixMan__ 20 hours ago \| parent [-]
		1. I'm not proposing the users go back and live in the past. I'm proposing that we, the technologists, go back to the drawing board as it existed at that time and build a different future. 2. I'm not going to feel safe if I go make a web site that works that way. I'm going to feel safe if my bank does.

▲

pwdisswordfishq 12 hours ago | parent | prev | next [-]

I would take a page refresh that takes two seconds over waiting half a minute for a page to "hydrate"

▲

BoxwoodSeed a day ago | parent | prev [-]

People do? I loathe the modern web.

Give me a https://motherfuckingwebsite.com/ instead.

▲

JKCalhoun a day ago | parent | prev [-]

Perhaps the web was more secure when it wasn't running anything—just serving up static web pages?

▲

vanviegen a day ago | parent | next [-]

Sure. It was also a lot less functional.

▲

preg_match a day ago | parent [-]

Kind of, but in practice not really. Sure, something like a photo editor would never be possible in Web 1.0.

But 99% of web applications are forms and displaying stuff. All JS accomplished is making it look prettier and enhanced tracking.

I mean, Facebook, my bank, Amazon… these can all be created with no client side code. It would be a lot of refreshes, but it can be done.

▲

no-name-here 15 hours ago | parent | next [-]

> I mean, Facebook, my bank, Amazon… these can all be created with no client side code. It would be a lot of refreshes, but it can be done.

HN could too - perhaps the biggest use on HN is not refreshing when up (or down) voting something. YouTube could do something similar - refreshing when 'liking' a video or getting more comments. But would you really find those to be a better experience for you? Even on actions that HN does refresh on, such as 'Next page', or submitting a comment, HN doesn't freeze sorts, so posts and/or comments you didn't see will often invisibly end up before the new location HN sent you to (or posts/comments you already saw earlier in the list now showing up "again" later in the list).

▲

lloeki 13 hours ago | parent [-]

You can have the buttons in iframes and have that POST and refresh.

Not saying that's exactly what should be done, but an example that there may be another way than full-on generic code execution wrapping XHR.

	▲	no-name-here 13 hours ago \| parent [-]
		Ah, so I guess the idea is that this page (with its ~200 comments) would have ~200 iframes added to it?

▲

__MatrixMan__ a day ago | parent | prev [-]

A declarative approach would go a long way. Like, I'm not evaluating restaurants on the basis of their website quality, so why not have a restaurant browser and they can all just expose data according to some common schema. Same this with banks. Same thing with most things.

If you want a wildly interactive art experience, just load the appropriate browser for that.

▲

pwdisswordfishq 12 hours ago | parent [-]

Because restaurants don't want businesses like DoorFash to scrape it.

	▲	__MatrixMan__ 5 hours ago \| parent [-]
		Is that at all effective? If you want the data to be publicly available, you have no choice but to make it publicly available. Whatever inconvenience a heavily JavaScript experience can add to motivated scrapers is just not significant. I think it's just a keeping-up-with-the-jonses sort of thing: If the restaurant down the street has a flashy website then I guess we need one too. Having restaurants in competition over the quality if their website is a negative sum game because it distracts them from the food.

▲

a day ago | parent | prev [-]

[deleted]