Hacker News Reader

Comment by techntoke | Hacker News Reader

My understanding is that you can use WebRTC and other methods of JavaScript to port scan a computer. Heck, you can literally run BitTorrent on a website using WebTorrent. You could force users to download and share copyrighted movies or other illegal material in the background without their knowledge when they visit your website. The state of the browsers is a disaster and security nightmare. Wasm is only going to make it worse. Soon you'll essentially be running binary blobs when you visit a website. What was supposed to be a permissioned sandbox to protect users, turned into an advertisers and malicious hackers' wet dream.

I think there needs to be more alternatives to JavaScript at this point.

View on HN

> Heck, you can literally run BitTorrent on a website using WebTorrent. You could force users to download and share copyrighted movies or other illegal material in the background without their knowledge when they visit your website

Yes, I wrote this a few times in threads like this but for some reason this is mostly ignored. Having WebRTC enabled by default can get you in legal trouble (at least in a country like Germany where lawyers send you letters based on IP addresses).

Leaving javascript executing by default is the modern version of opening every email attachment.

It is the default for browsers, even after you install privacy protection extensions.

Because the browser standards are defined by ad and spying companies who require it and because in the past it wasn't what it is today: dangerous.

Having all three of: 1) a hypertext document viewing & retrieval system, 2) a shopping and payment system, and 3) a free-form application platform, all mixed together, is simply nuts. Clicking a link in your hypertext document viewer shouldn't load another thing that kinda looks like a hypertext document but is in fact an application, maybe containing malware, without any notification that you're about to start running arbitrary code. We have those "allow download?" prompts and don't auto-run downloaded executables for a reason. JS in the browser has way too much power to be secure. Just letting it ever initiate a remote connection without explicit user say-so, or to modify form contents being sent, any of that stuff, is probably enough to disqualify it as a sensible thing to include in your hypertext browser.

I actually think #2 could probably co-exist with #1 pretty well, and more securely than it could with #3. Would mean building a payment flow and (maybe) a shopping cart directly into the browser. Challenging, but way less work than the 50,000,000 (and counting) implementations of those in HTML+CSS+JS have been been.

The alternative is to promote JS whitelisting, but then you get a bunch of web developers screaming at you because they somehow feel like they have the right to run arbitrary code on their visitor's computers --- even to do things which shouldn't require such invasiveness.

I wonder if popularising banners on sites saying "You have JavaScript enabled, please disable it for a safer browsing experience [link to click that discusses all the negatives and how to do JS whitelisting]", in direct opposition to what some sites are doing, may have an effect...

(I've been doing that for over 2 decades now, and I naturally avoid web-app sites, but that's getting harder these days. Twenty years and I still have less than 100 sites I trust to run JS on.)

> JavaScript

Wouldn’t matter what language it was. It could be Python or Rust or anything that implemented the WebSocket API.

Reply on news.ycombinator.com