I see this claim often. I'm not seeing how JavaScript is anything like Scheme. Scheme still ingests s-expressions and you can build compile time macros and manipulate those s-expressions at compile time before you get to runtime. What is the equivalent in JavaScript?

JavaScript is literally a Scheme “implementation”, as in it started as Scheme in a browser but they removed the s-exprs (the interface) and kept the implementation.

It does still have the other similarities; it has closures and a prototype based object system. In the 90s we only had boring Blub languages, so most of the influence that allowed such powerful concepts came from Lisp. (Though I think the prototypes are from Self.)

You say it yourself, js is part scheme part self, and the algol { clothing } shift it a large step away from scheme since the functional aspects became culturally secondary for more than a decade. The imperative aspects are the one causing bugs IMO.

Well remember “functional vs imperative” isn’t a real distinction - Lisp is imperative. That showed up elsewhere where the “pure functional” languages like Haskell are the not-imperative ones.

JS has other differences on the “correctness” spectrum, like all numbers are doubles instead of bignums. But even if that’s “incorrect”, just imagine how much more memory your Chrome tabs would use if you let people use bignums everywhere.

Scheme pushed for functional much more than early lisp (and Id love for early lispers to pitch in about the imperative traits of lisp, it's a bit fuzzy if it was a desired trait or a commercially necessary addition facing fortan).

Bye, why would a fully numeric tower js only use the least machine friendly format everywhere ? Did I miss something ?

> JavaScript is literally a Scheme “implementation”, as in it started as Scheme in a browser but they removed the s-exprs (the interface) and kept the implementation.

do you have any link to a source for this claim?

AFAIK JavaScript started as a language called Mocha, which was hacked together in a few days: Java syntax, Scheme functions + Self object system + plus a bunch of other things.

At that time: no symbols, no s-expressions, no cons cells, no lists, no macros, no tail call optimization, ...

Do you mean of a programming language specification (e.g., ANSI Common Lisp, RnRS Scheme), or of a specific implementation?

There is no the implementation of JavaScript. There are several, all with their own issues, security and otherwise.

Any arbitrary implementation. Do specifications have security issues?

(The implementation is usually the one with the security issues, not the programs you run on it. Of course, either one’s possible if it crosses a trust boundary.)

Open-source projects like Steel Bank Common Lisp (SBCL) and commercial projects like Allegro Common Lisp alike respond to bugs reports of all manners, including security issues. I can't speak for Google, but looking at their commit history on SBCL, you can see various security-improving enhancements through the years, especially around the runtime written in C.

I don't think anybody has done a formal study or written some kind of report on the security of said implementations, however.

A gentleman named Paul Dietz implemented something called the "ANSI compliance test suite" [1], which is an implementation-agnostic battery of tests that examines how well an implementation adheres to the ANSI specification of Common Lisp. Dietz is also known for his prolific fuzz and randomized testing of Common Lisp implementations. He's been a source of obscure bug reports for years, and those bugs are always promptly fixed.

[1] https://ansi-test.common-lisp.dev/

Thanks, that is informative, although now I’m confused why Google cares about SBCL. That seems like a Yegge-only thing.

I did think of a specification-level security issue - bignums reduce math errors but mean operations are O(N), which puts you at great risk of DoS issues and sidechannel leaks in security-sensitive math.

And of course Lisp’s features like macros tend to be powerful, and security has a “rule of least power” meaning those are harder to verify if you can’t statically analyze them.

Google cares about SBCL because their flight search software that powers Google Flights, Orbitz, Kayak, etc. is written in Common Lisp.

> Do specifications have security issues?

Sure, the Common Lisp standard specifies a default syntax mode, where the s-expression reader (-> the function READ) can execute arbitrary code at read time.