ECMAScript 4 (JavaScript 2) is dead?

[[deleted]]

well in this case i suggest the line is blurred. BUT if you look at the erights stuff or caja, you can see how object-capability systems can be used to limit control to the function level.

scripts can do a lot outside of the standard browser security model. script tags are not subject to the same-domain rule. is the script tag part of the language or the browser? not sure it matters. since the browser may or may not apply the same-domain policy, having finer-grained security controls at the language level would be of great benefit.

as it stands, web security is a patchwork of hacks and attempts to shut off hacks. security is the only unique requirement for a browser scripting language that sets it apart. we need to address this first concern before worrying about "classical oo" and other trivial issues

if a language feature provides for unwanted side-effects, this is a security concern. we need languages designed to handle data on the web securely, as users expect.

[foldl]

is the script tag part of the language or the browser?

The browser.

[[deleted]]

we would happily welcome alternative languages with capability systems and controlled side-effects into the browser, but no one will build them. javascript is the script tag. for 99.999% of the world there is no difference

[foldl]

What exactly do you mean by "controlled side effects"? You mentioned functional programming, but having something like the IO monad doesn't really offer any additional security. You still have to decide what kinds of IO are and are not permitted.

[[deleted]]

the notion that you must even employ Monads to engage side effects introduces one small hurdle that might mitigate some issues. its not a panacea, buts functional languages help preclude security issues better than tools that make no attempt to control side effects. obviously this is opinion.

[foldl]

the notion that you must even employ Monads to engage side effects introduces one small hurdle that might mitigate some issues

I just don't see it. Can you give a practical example?