Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Saturday, 07-Oct-2023 22:24:50 JST Rich Felker

   in reply to

   @jamesh @pid_eins @mariusor The problem with it being JS (and with none of this being documented or discoverable) isn't a matter of whether the JS code that's present is doing complex stuff that needs Turing completeness.

   It's that it's not comprehensible to the user responsible for managing their own security. There are no limitations on the mechanisms they can use as a shortcut for reasoning (like they could with unix permissions) so they need to read/memorize/understand all that code!