News for hackers. Stuff that matters.

A comment on On node-ipc and the importance of trusting trust. Parent comment

Re:On node-ipc and the importance of trusting trust by klabb3 on Friday March 25, 2022 @12:48AM (#30798738)
Sure, but languages aren't designed to provide secure isolation on a module-by-module level. The encapsulation that exists (e.g. private fields) isn't for security.

Or is there some security feature of node or JS that I'm missing?

[ Parent | on HN ]
Re:On node-ipc and the importance of trusting trust by ryukafalz on Friday March 25, 2022 @07:53AM (#30800972)
You’re right that in most languages, encapsulation isn’t strong enough to be used for security in this way. However, there are languages in which it is; scheme I believe has strict enough lexical scope and encapsulation to be used like this. (And of course there are languages designed specifically for this purpose, though they’re not often used: E and Monte come to mind.)

Of the popular languages, though, JavaScript is the closest to being strict enough for this style of programming, and there’s been active work for a while towards that goal:

https://agoric.com/blog/technology/ses-securing-javascript/

[ Parent | on HN ]