Fine. You seem to have something odd and bizarre against the language. Good luck to you and your quest.
You also don't seem to realize that swapping out js for some other language would mean exactly the same security issues, unless you actually fixed those security issues where they are - in the BROWSER.
If you would like to learn about the language, I'd recommend "O'Reilly Definitive Javascript". Also checkout Rhino.
It's not "odd and bizarre" - it's a belief that the language is fundamentally unsuitable for the things that people insist upon using it for, and reasonably well supported by my own experiences of the language, as well as the reported experiences of others.
> You also don't seem to realize that swapping out js for some other language would mean exactly the same security issues, unless you actually fixed those security issues where they are - in the BROWSER.
I take it you didn't read my reasonably concrete proposals for the use of proof carrying code? It becomes a largely mechanical process to verify that the browser and the language implement "security" in a sensible way at that point.
> If you would like to learn about the language, I'd recommend "O'Reilly Definitive Javascript". Also checkout Rhino.
Thanks. If you would like to learn about Horse and Pony care, I recommend "BHS Complete Horse and Pony Care".
I think this sums it up really. People make mistakes and make insecure software. Whatever language it is. I fail to see how swapping out js for anything else would solve anything. It's all pretty moot also, since it'd never happen.
The JSON attack again, isn't any inherent insecurity in the language, just in the way it is used within browsers.
Lets improve browser security rather than focusing on a language which has pretty much nothing to do with security issues. None of the examples you give had anything to do with the core javascript language. They were all about how it is used in the context of browsers.
Just to get this straight, one of your arguments is that since some browsers apparently execute the javascript inside css "url('javascript:...", the solution is to change javascript for some other language? Do you understand how ridiculous that seems?