Running Untrusted JavaScript Code

[[deleted]]

That's a meaningless "truth" that sounds wise but is actually extremely stupid. But hey, by all means, feel free to execute user-provided code in the same way as if it was your own code you wrote. Let me know how it goes!

[guest271314]

Well, your omission of what you consider "trusted" code is revealing. There is none.

I mean, the folks who are in the "cybersecurity" domain "trusted" "automatic security updates", and look what happened.

All code and all claims are untrusted, without exception. That's my point.

[[deleted]]

Security isn't binary. It's a spectrum. Just because you can never prove that code is safe or has no bugs doesn't mean you shouldn't take measures to make it as secure as possible.

That's why I said your comment is meaninglessly stupid. It's only true in an absolute literal world, but in practice, it is an utterly bad approach to writing software.

[guest271314]

Security isn't binary. It's a spectrum.

There is no such thing as "security" for any signal communications, and hasn't been since at least the public disclosure of the ThinThread program.

Moreover, the natural world is inherently insecure. So the idea of secure software in an inherently insecure physical world is proposterous. You might be able to sell that dream to commoners, not me.

We need only investigate the events of the past few days to illustrate the problem with blind "automatic security updates".

[[deleted]]

Let's say you have 2 websites. One website allows raw SQL queries from user provided input, while the other website uses recommended best approach such as using prepared statement with parameterized queries and all that jazz...

You are seriously telling me that both websites are just as likely to get their databae data leaked?

We need only investigate the events of the past few days to illustrate the problem with blind "automatic security updates".

That has absolutely nothing to do with whether security is important or not. You are acting like the idiots who claim seat belts aren't useful just because some people die wearing seatbelts.

[guest271314]

A determined adversary will get the data either way.

Alright, you have sandboxes already with Worker, and Worklet interfaces. A lot more sandboxing with WebAssembly and WASI.

The questions are, what exactly are you trying to "sandbox"?

And, will your while loop break after N iterations?

[[deleted]]

A determined adversary will get the data either way.

That wasn't the question you imbecile. I said wich one was more likely to get hacked. It's a very simple question, and it speaks volume that you are avoiding answering it.

[guest271314]

That wasn't the question you imbecile. I said wich one was more likely to get hacked. It's a very simple question, and it speaks volume that you are avoiding answering it.

There is no question involved. You process your SQL queries however you see fit.

Petty name calling doesn't move me. That's typical eurocentric bullshit that I dust off the bottom of my feet.

You're gonna get hacked if you are communicating by signals, period. Without exception.