upvote
I think the problem is that we've let JS engines become absurdly complex so there's no way to avoid them having really gross bugs.

That said, I think that the V8 team has done a fantastic job of securing their engine. Their heap sandbox feature is really inspiring! It's really wild that (as far as I can understand this issue) someone is able to bypass it.

(Posted from a memory safe browser - WebKit MiniBrowser compiled with Fil-C. Pretty sure this is safer than even V8 and the heap sandbox.)

reply
> Posted from a memory safe browser - WebKit MiniBrowser compiled with Fil-C. Pretty sure this is safer than even V8 and the heap sandbox.

It's easy to be safer, as long as performance can be sacrificed for it.

reply
Running code by itself isn't that bad, it's the fact that browser developers have decided for some reason that this code needs to be as performant as possible, so, JIT.

I don't get it! The way JS is typically used, it doesn't even benefit from JIT all that much. Making ajax requests, doing stuff with strings, and moving DOM elements around doesn't need every CPU clock cycle to be used as optimally as possible. It's exceedingly rare for websites to actually be doing something that needs raw performance. And SPAs will be slow no matter what.

reply
I disagree about JIT performance not mattering. I enabled "Lockdown Mode" on iOS which disables the JIT for the mentioned security reasons, and it causes a very noticeable lagginess on many sites. Of course, the primary cause is the unnecessary JS monstrosities wasting CPU cycles. But practically speaking I can say that disabling the JIT results in a very subpar experience of many JS heavy pages.
reply
It will also increase power consumption because your CPU has to do more work to run the same code.
reply
That's largely because a lot of developers have made the devil's bargain of replacing standard web stuff with badly re-implemented JS versions of same. People did it because they could, but never considered if they should.

See most of the ecosystem around React, for reference. It's idiotic that things like URL management are done in Javascript. Or form controls. I guarantee that if we stopped doing this kind of stuff, JIT wouldn't matter.

To some extent this is just saying "developers will depend upon the performance given to them", and that's true, but it's also true that as soon as things like V8 and Node appeared, JS became ubiquitous. Pandora's container, if you will.

reply
That's largely because a lot of developers have made the devil's bargain of replacing standard hardware and OS primitives with badly re-implemented C versions of same. People did it because they could, but never considered if they should.

See most of the ecosystem around modern systems software, for reference. It's idiotic that things like memory layout and bit-level hardware management are done in C abstractions. I guarantee that if we stopped doing this kind of stuff, compiler optimizations wouldn't matter.

To some extent this is just saying "developers will depend upon the performance given to them", and that's true, but it's also true that as soon as things like compilers and standard libraries appeared, C became ubiquitous. Pandora's container, if you will.

reply
> See most of the ecosystem around modern systems software, for reference. It's idiotic that things like memory layout and bit-level hardware management are done in C abstractions. I guarantee that if we stopped doing this kind of stuff, compiler optimizations wouldn't matter.

Cute, but no, not even close to a good metaphor. The C example is abstracting away complexity. The other is competely re-writing -- in duplicate -- what the platform gives you for free.

The equivalent level of idiocy in a C-related metaphor would be...I dunno...if you decided that you didn't like the way that header files worked, and decided to keep the C compiler, but build an external header-file management system in Fortran.

(It hopefully shouldn't be lost on you that this exact approach to language features has been repeatedly tried in the javascript world, including right now, with package management.)

reply
you are talking about the effect, not the cause.

Sites are slow because with all that excess performance they do more tracking, instead of keeping the website as-is.

Because that's the only thing business managers can come up with in that situation. It's a misaligned goal of users vs businesses.

In my opinion the "user agent" behavior of browsers is long gone, because they're not acting on behalf of their users anymore. They're acting on behalf of businesses.

reply
Agree. Chrome should just disable JIT by default and boom many website owner will start to optimize their website.
reply
jira and confluence come to mind...
reply
I suspect the people who agree to buy Jira & Confluence are not particularly heavy users of them. At least, that's the only explanation I can fathom for their continued sales.
reply
Is it their app’s features that are slow, or the analytics bolted on top?
reply
Both. And all the dependencies of both are slow. And the dependencies of those are slow, too.
reply
> SPAs will be slow no matter what.

Uh…no?

You’re presumably talking about specific terrible prebuilt frameworks - not someone building a nice vanilla SPA.

reply
At this point SPA pretty much implies React. But even if you optimize everything the best you could and avoid any third-party runtime dependencies, it's still going to be significantly more work to make API requests and do client-side rendering vs just rendering HTML server-side.
reply
> decision we have made

This might oversell the agency that practicioners have.

Sandboxed zero-install delivery will outcompete anything with more frictionful installs.

It's probably not the right model for a pacemaker though.

Web/JS has been a double-edged sword for FOSS: sure, I can run a free OS, but if most of my "apps" happen to be JS that I can't practically control, then I have won a battle and lost a war.

reply
I wish Haketilo [1] would have caught on more. There's so many free JavaScript apps but we're mostly just missing a way to actually control which version or derivative of the JavaScript is run.

There's also the problem of most free apps not doing a good job of providing license info and a link to source code, but this could be sidestepped by a trusted repository which provides license info itself.

[1] https://haketilo.koszko.org/

reply
Apple made it illegal to install an app - you have to use their store and pay a 30% extra tax, or do without, or make a web app. No surprise which option is most appealing.
reply
I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking.
reply
It became insane because nothing bloody worked without Javascript some time in the early 2010s.

Like cellphones, javascript became necessary if you want to use webmail, access your bank's website, or whatever.

reply
I still run with u matrix though, and most third party requests can be limited, but I no longer have enough patience when a required page doesn't work - I'll just rely on ublock origin to work.
reply
I say this as someone does NOT disable JS in my main browser (because like, I have a job), but also knows a fair bit about why Firefox inside Tails now restarts in some cases...

It's the classic thing. Across every gdmf metric, excluding with "true empathy", no one *gives a fuck* until it affects them, or someone within (1-3) degrees of separatation. And having broad empathy is generally a good way to get yourself labeled/astrocized: both about as obvious "compriate" and obvious "adversary".

reply
In fairness, in the early 2000s they were probably right. Early browser security model was a bit of a mess. The fact that this article is even talked about is a sign of how much better things are.
reply
Plus add in Flash and Java applets.
reply
I still do "random" browsing in FF with NoScript, that said, I'll acknowledge the frequency of updates of Chrome,etc and years of hardening.

It's not the Bonzi-buddy and driveby-installed IE toolbars wild west of the early 00s.

reply
The browsers on the computers at work show that it is very much still the driveby tool-bar install days.
reply
It's so ubiquitous and unavoidable at this point.. I was at a conference lecture in 2020 where someone was suggesting disabling JavaScript and I thought the same thing— how absurd. The times have really changed...
reply
In the future we can ask that your JaveScript and Wasm comes with a proof of being benign.
reply
V8 as a runtime goes far deeper than just webpages.
reply