undefined | Better HN

0 pointscode_research9y ago0 comments

> but there is a reason no one wants to do that these days

The reason is, that JS is enabled by default, nothing else.

If users had the possibility to actively decide before any remote code will execute on their computer, how many would like to enable it?

We are just one default checkbox setting away from what you call "utopia" here - a word that should be used for much bigger things.

Of utopic naivity in deed is the expectation that such powerful features will not be misused - delivering browsers with code execution enabled by default will be looked at as one of the most funny things of the first internet in a few decades.

Web application development paradigms that enforce JavaScript usage as an absolute necessity are examples of "naive utopian deadends". It is totally anti-avantgarde and anti-progressive, we should not waste so many young talents on that.

0 comments

vroombaprime9y ago

I'll be the first to lament the spread of javascript, SPAs, and the huge hit to accessibility that the web has taken over the years.

None of that changes that js adds incredible power to what webpages can do and there is zero chance of rolling back browser-delivered applications at this point.

I also don't understand why you think html+css doesn't have the same fundamental 'code execution' flaw - you're accepting unseen input from a remote source and feeding it into an execution engine which will have exploits - whether that's css or html or js or xml or *.

Back to your question though: yes, 98% of web users want remote code execution on because they want spotify, facebook, and youtube to work. They would be upset if they even had to manually go in and enable it. And I'm not even sure you could make a quality version of those sites without js.

j / k navigate · click thread line to collapse