Or, maybe downloading arbitrary code from the internet without even a same-origin check, and being able to dynamically construct executable JavaScript from downloaded binary data masked as image and then have a whole generation of developers depend on this model wasn't so good an idea after all.

It enables SaaS and makes economic sense and sadly the latter is the only thing that matters when it comes to mass human behaviour.

Makes economic sense for cloud providers that is. For users, developers, content creators, and all others, not so much.

eval() has no economic purpose. It hasn't been removed by browsers purely because that would break backward compatibility.

Non-same origin Javascript does not have economic purpose either. I believe, that it will be completely eradicated from browsers within this century (if not in couple of decades).

Well the smartest talents of the previous generations built and exploded hundreds of nuclear weapons including a couple on innocent civilians, created ICBMs that can destroy civilization in a few minutes and created situations that brought the world to a brink several times, drove a massive population explosion anda fossil fuel consumption binge that may yet destroy civilization.

So I definitely think the smartest of more recent generations who are employing their skills in these software hacks and ad tracking are perhaps saintly in comparison :-)

It's not limited to "our generation", these lyrics are from 1966: https://www.azlyrics.com/lyrics/frankzappa/hungryfreaksdaddy...

Or maybe society isn't providing them an accessible application for their talents.

One good application that comes to mind in this case would be the Google Chrome bug bounty program.

The writer of this exploit was almost certainly paid more than the bug bounty reward.

Yeah, that’s a hard thing. Because the exploit is almost certainly worth more to the buyer than having it fixed is worth to Google.

> having it fixed is worth to Google

For now, I hope. Google can and should pay equivalent amounts.

Sure. I'm not saying that the moral way is just as profitable as the alternative; only that it exists.

Agreed, exploits on the deep Web pay 10x what the big bounty programs do, the mismatch is laughable

Don't improve the product, just find dumber customers!

Don’t lose weight, just buy bigger trousers!

Don’t take personal responsibility, just blame society!

Of course it's both.

Personal responsibility is important. And even if you're bored, there are things to do other than hacking.

But working mind-numbing jobs , way below one's skills and talents happens to such a large share of people.

Maybe it's a sign to a problem with society ?

Sadly, i had a big argue with my team and they kept pressing me into doing exactly the first thing. "Success depends on optimizing the sales and optimization is done by money/brains metric". Something i'm not really ready to accept (yet).

In this day and age, it could also be well paid nation state hackers. It is well understood that places like the NSA actively seek out zero day exploits and use them to perform whatever operations they need to do. They don't report them to software devs that can patch them.

His statement remains true.

> can't find better uses for their talents.

Why would they. People who break DRMs for fun and profit look with disdain at their whitehat counterparts.

Same with ad fraud. People in that particular business take pride at being able to fool boatload of best and brightest computer scientists who work at bot detection

As for people in good old browser exploit scene, I think they have good time laughing at vain efforts, and ineptness of their counterparts too

I think people are wrong thinking of it as a money thing