Re:Build Cross-Platform Applications for desktop using HTML,...
by flomo on Sunday May 13, 2012 @05:14AM
(#3966478)
The obvious different is that you don't want to execute arbitrary C code just because a compromised ad network is serving malformed HTML. The ease of attack is much greater on the web.
Mozilla has used "no IE-like privileged mode" as a marketing point in the past. There's obvious benefits, but I hope any modern browser is going to be careful about the sandbox is implemented.
Re:Build Cross-Platform Applications for desktop using HTML,...
by gliese1337 on Sunday May 13, 2012 @02:38PM
(#3967833)
You're comparing incomparable things. Serving a web page in an unsecured environment is an obvious security problem, but completely unrelated to whether you have written a native application in HTML+JavaScript or something more traditional like C.
Would the C version of your native desktop app download code from an online ad network? Then it is just as problematic as a web app in an unsandboxed browser. If the C implementation of your desktop app wouldn't do that, then the HTML+JavaScript implementation of the same application shouldn't either, and there is no problem.
Re:Build Cross-Platform Applications for desktop using HTML,...
by flomo on Sunday May 13, 2012 @04:52PM
(#3968268)
Actually, you the one making this strange comparison to C code.
My point is simple: IE's sandbox was broken repeatedly, creating a bad reputation and scoring marketing points for other vendors.
Now, security is important, and it would be nice if all applications could be verified as to security. But they aren't. So while it would be good to figure out how to properly sandbox desktop HTML+JavaScript applications, I don't see as how failure in that regard should retard their adoption anymore than it retards the adoption of native applications written in C.