Embed Notice

@jamesh @pid_eins @mariusor The problem with it being JS (and with none of this being documented or discoverable) isn't a matter of whether the JS code that's present is doing complex stuff that needs Turing completeness.

It's that it's not comprehensible to the user responsible for managing their own security. There are no limitations on the mechanisms they can use as a shortcut for reasoning (like they could with unix permissions) so they need to read/memorize/understand all that code!