zlacker

[parent] [thread] 2 comments
1. mmis10+(OP)[view] [source] 2026-02-02 04:44:55
Like… browser? Or anything with script loading capabilities like script engine in games. Executing remote script is almost unavoidable nowadays.

And there isn't really a way to confirm if it is configured in a secure way.

You either trust the developer or not.

replies(2): >>einr+r3 >>g-b-r+k8
◧
2. einr+r3[view] [source] 2026-02-02 05:19:36
>>mmis10+(OP)
At least JS code in a browser is sandboxed. A Notepad++ update is just rawdogging an executable on your bare metal, perhaps with admin privs even, and hoping for the best.
◧
3. g-b-r+k8[view] [source] 2026-02-02 06:19:14
>>mmis10+(OP)
First, it wasn't even the developer who compromised people, here; second, scripts in most cases are orders of magnitude less dangerous than a windows executable.

And, in many cases you can get some protection from a developer going rogue (or not writing perfect code), it's not an all or nothing.

[go to top]