Earlier quoted context omitted.
I've never seen an SPA which scales properly and doesn't become a bloated mess, maybe that's possible but it's definitely harder to make it work than using traditional server side template rendering
Plenty of app usecases don’t need to “scale” - immediately or ever!
Actively exploited sandbox RCE in all Chromium versions
451–460 of 527 posts
Re: Actively exploited sandbox RCE in all Chromium versions
#452Re: Actively exploited sandbox RCE in all Chromium versions
#453Earlier quoted context omitted.
Right but the implication of a SPA is that it’s an application which has many logical pages, but only one real page. The logical pages are constructed by dynamically updating the DOM using JavaScript. As opposed to navigating to a new, server-provided page. For example, a search function. For a MPA, each search query would be a new page. For a SPA, each query is a new logical page, served on the same real page. Techn…
> it’s just a site sigh …does someone else want to finish this up?
To expand on what I mean, if the implication isn’t obvious: a SPA with no client side rendering is just a single HTML page. It’s a document, not an application.
So SPA naturally implies client side rendering.
The difference between a SPA and MPA isn’t the amount of pages, they both have about the same amount of logic pages. It’s about where those pages are rendered. Dynamically on the front end, or on the back end.
EDIT: okay okay to expand, my website has a contact form. With JS enabled, the form submit displays a little box that says “thank you for submitting”. With JS disabled, it navigates you to a “thank you for submitting” page.
Both are the same logic page, they have the same function. One page is just rendered client side, and one server side. Most websites or applications are hybrids. There’s very few true single page applications, and very few true multi page applications. Most SPAs have multiple real pages for different things. Most MPAs combine multiple logic pages into one real page.
Re: Actively exploited sandbox RCE in all Chromium versions
#454Google has the means and ability to rewrite Chromium ; bug for bug in Rust from C++ using Astra & Fable. Same for the Linux kernel. Considering the Fermat's Last Theorem lean proof was 13MLoC and cost $300,000 it would cost $2M to rewrite Chromium & Linux in Rust going purely of combined LoC.
Why don't you do it and post it here then?
Re: Actively exploited sandbox RCE in all Chromium versions
#455Earlier quoted context omitted.
I think it makes more sense to verify that the jit is correct than to verify that it's output is correct at runtime.
Nah It's damn near impossible to verify that the JIT is correct. But it is possible to verify at runtime that the code that the JIT emitted obeys some memory safety law. (V8's heap sandbox is an example of this; a sarcastic JIT would be an arguably stronger example of this.)
Re: Actively exploited sandbox RCE in all Chromium versions
#456Earlier quoted context omitted.
"Aiding and Abetting" crime is also a crime. Free speech has nothing to do with it.
"this vulnerability is being sold for research purposes only and must never be used outside of a tightly controlled research sandbox"
Re: Actively exploited sandbox RCE in all Chromium versions
#457Earlier quoted context omitted.
Has anyone actually been convicted of abetting a crime by selling a vulnerability, by itself, not conspiring with the buyer to commit a crime using said vulnerability? Not as far as I can see. It would be absurd to jail someone for accurately describing a bug.
It would be absurd to jail someone for accurately describing a bug on their blog or whatever. Not so much for taking money from someone who the buyer should know has no reason to be interested in buying the information. And either you know who your counterparty is, in which case you know that they are using it nefariously, or you don't know who your counterparty is, in which case you know that they are using it nefar…
Re: Actively exploited sandbox RCE in all Chromium versions
#458Re: Actively exploited sandbox RCE in all Chromium versions
#459Earlier quoted context omitted.
Who is to say they didn’t already do that?
you're not allowed to burn exploits like that if you've signed a deal, and who would risk that for $1k? of course it could be a colleague or someone with access to such tools
Re: Actively exploited sandbox RCE in all Chromium versions
#460Earlier quoted context omitted.
There’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs. I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.
Is Firefox actually safer than Chromium-based browsers though? I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.ht... but has the situation changed substantially in favor of Firefox?
https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial...