Re:JavaScript must die
by amix on Friday September 25, 2009 @07:30AM
(#843259)
If we follow the idea of killing everything that's "insecure" then we will end up killing everything, because nothing is 100% secure. I vote for improving JavaScript, for example, by sourcing external code via Google Caja. We should also improve defense against XSS and CSRF attacks in today's most popular frameworks (because, a lot of the times it's not the JavaScript that's insecure, but the frameworks that developers use - - i.e. making it possible to source arbitrary HTML is a very bad idea, no matter if JavaScript is used or not [e.g. one can do malicious attacks via an image tag as well]).
[ Parent
| on HN ]
> If we follow the idea of killing everything that's "insecure" then we will end up killing everything, because nothing is 100% secure
Perhaps, but killing off the stuff that is obviously and demonstrably broken seems like a pretty sensible policy.
Killing one of the most popular languages isn't a solution, it's only wishful thinking. The situation with JavaScript isn't that bad, we just needs better tools such as a secure way to source external JavaScript and better protection against XSS and CSRF attacks... If these issues are solved, then 90% of the problems are solved.
We're entitled to wishful thinking. Wishful thinking gives us something to aim for, and then we can evaluate in realistic terms how far towards that goal we can get.