News for hackers. Stuff that matters.

A comment on Build Cross-Platform Applications for desktop using HTML, CSS, Javascript. Parent comment

Re:Build Cross-Platform Applications for desktop using HTML,... by flomo on Sunday May 13, 2012 @05:14AM (#3966478)
The obvious different is that you don't want to execute arbitrary C code just because a compromised ad network is serving malformed HTML. The ease of attack is much greater on the web.

Mozilla has used "no IE-like privileged mode" as a marketing point in the past. There's obvious benefits, but I hope any modern browser is going to be careful about the sandbox is implemented.

[ Parent | on HN ]
Re:Build Cross-Platform Applications for desktop using HTML,... by gliese1337 on Sunday May 13, 2012 @02:38PM (#3967833)
You're comparing incomparable things. Serving a web page in an unsecured environment is an obvious security problem, but completely unrelated to whether you have written a native application in HTML+JavaScript or something more traditional like C.

Would the C version of your native desktop app download code from an online ad network? Then it is just as problematic as a web app in an unsandboxed browser. If the C implementation of your desktop app wouldn't do that, then the HTML+JavaScript implementation of the same application shouldn't either, and there is no problem.

[ Parent | on HN ]
Re:Build Cross-Platform Applications for desktop using HTML,... by flomo on Sunday May 13, 2012 @04:52PM (#3968268)
Actually, you the one making this strange comparison to C code.

My point is simple: IE's sandbox was broken repeatedly, creating a bad reputation and scoring marketing points for other vendors.

[ Parent | on HN ]