News for hackers. Stuff that matters.

A comment on A Secure Runtime for JavaScript and TypeScript Built with V8, Rust, and Tokio. Parent comment

Re:A Secure Runtime for JavaScript and TypeScript Built with... by pvg on Sunday July 07, 2019 @03:00AM (#20373909)
It is very interesting although I didn't really understand the 'security' part. The motivation seems to be twofold - some bad things have happened because of compromised npm packages and v8 happens to have a robust sandbox. This sounds like a solution looking for a vaguely defined problem. The illustrative example he gives is 'malicious linter'. Is malicious linter that important a threat?
[ Parent | on HN ]
Re:A Secure Runtime for JavaScript and TypeScript Built with... by ricardobeat on Sunday July 07, 2019 @12:34PM (#20375931)
In the example the linter itself is not malicious, but used to deliver a malicious program that can have unrestricted filesystem access. Not vague at all, see recent news on the ‘event-stream’ package being used to steal cryptocurrency wallets.
[ Parent | on HN ]
Re:A Secure Runtime for JavaScript and TypeScript Built with... by pvg on Sunday July 07, 2019 @02:08PM (#20376614)
The 'vague' part is not that it doesn't happen - see the comment you are replying to.
[ Parent | on HN ]