silverwizardOct 21, 2024

One of the things that is destroying the web is WASM and JavaScript.

This isn't really even a joke - it's literal.

By having all these tools to make a web browser have unfettered access to the system, it becomes unsafe to allow users to generate arbitrary code. We can't have another MySpace or NeoPets User Lookup because we can't allow users to write their own HTML, because that's *dangerous*.

Show threadvalkyrie_pilotOct 21, 2024
@silverwizard is it safe to let users generate even arbitrary HTML? Was it ever safe to do so? Or did these sites just not care?
Show threadsilverwizard
@valk why would styling be unsafe?
Oct 22, 2024 at 12:59amWeb
Show threadliftsOct 22, 2024
@silverwizard @valk It’s rare, but keyloggers and other funny things have happened. (https://css-tricks.com/css-security-vulnerabilities/)
CSS Security Vulnerabilities | CSS-Tricks

Don't read that headline and get worried. I don't think CSS is a particularly dangerous security concern and, for the most part, I don't think you need to

CSS-Tricks
Show threadsilverwizardOct 22, 2024
@lifts @valk right, CSS has grown to madness
Show threadvalkyrie_pilotOct 22, 2024
@silverwizard one could always hide a malicious / phishing link with an A tag. Or abuse image loading to track people (mitigatable now, but not back then.)
Show threadsilverwizardOct 22, 2024
@valk I mean, they could definitely add tracking, definitely. And as long as you wrap the page, phishing is harder. And phishing is so easy these days with hubspot wrapping all email links, and no one properly using URLs. I dunno. I hear the concern, and I get it, but it just feels unconvincing to me. I feel like it's an arguement that only applies to more sophisticated users.
Show threadvalkyrie_pilotOct 22, 2024
@silverwizard i think the point i was trying to make is that you don't need scripts to do bad things. it's really hard to provide the flexibility you want to when allowing custom code without being unreasonably limiting. I don't think this is a fault of javascript, personally.
That said, I've gone on record saying javascript is overhated, so. Make of that what you will.
Show threadsilverwizardOct 22, 2024
@valk I personally think JavaScript is underhated. I think people don't think enough about the ways the Browser is now a platform. People feel safe with browsers, and that's not a good idea imo.
Show threadCyOct 22, 2024
underhated
I am so using that