Hacker News Reader

But the client side code in a web-app is run within the browser sandbox, which is not equivalent to running a random exe... Unless you meant something else?

View on HN

Speculative execution, sandbox exploits, etc, etc. I thought everyone (myself included) stopped believing in the power of VMs/containers/sandboxes to protect you when all that happened (and kept happening). And it's just getting worse as the JS engine(s) get access to more and more bare metal features and become a true OS in more than just spirit.

Thus all the crazy insistence on CA TLS in modern web protocols like HTTP/3 which can't even establish an connection without CA based TLS hand-holding.

The fact that exploits exist doesn't imply that using sandboxes is equivalent to running untrusted code directly.

Reply on news.ycombinator.com