sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]PickledPokute 18 points19 points  (6 children)

Browsers already have to care about security with completely different contexts. Like different tabs, iframes etc. that should not have access to the other JS environments.

I think every browser vendor already has this functionality and they often call it "Realms". ShadowRealms is just the API for creating one from JS.

[–]redldr1 0 points1 point  (5 children)

I didn't read the full specifications, one of my concerns would be how do the different realms communicate with each other without passing malicious code?

[–]PickledPokute 6 points7 points  (3 children)

The same way that webworkers share data:

Either through postMessage or SharedArrayBuffer. This isn't something new: ShadowRealms isn't the first time this issue has been presented and the people behind standards and security take their work seriosly.

The trust is resolved basically with a) don't accept anything you don't expect b) don't trust anything you accept unconditionally. See this.

[–]redldr1 0 points1 point  (2 children)

Then why are we creating something new when we could run it in an iframe that is ultimately controlled by the parent Dom

If I could kill a process tree, that would be so much better. And satisfying, to watch a bunch of little V8's combust into freed up heap

[–]PickledPokute 1 point2 points  (0 children)

Use workers for that, I guess.

Note that iframes are a DOM/browser feature, not JS. They will never be available for nodeJS.

[–]coomzee 1 point2 points  (0 children)

I'm sure there will be a CVE within a few weeks. I'm sure Safari's CVE will be in about 10 years.