▲ 555 ▼ After three months on Linux, I don’t miss Windows at all (www.theverge.com) submitted 6 months ago by cm0002@lemy.lol to c/linux@programming.dev 146 comments fedilink hide all child comments
[–] bearboiblake@pawb.social 5 points 6 months ago (8 children) ...and I just explained to you how you can? permalink fedilink source parent hideshow 8 child comments replies: [–] tux0r@snac.rosaelefanten.org -2 points 6 months ago (7 children) Ok, I'll bite:You can run fully-local resources in a browser, such as browser extensions, locally hosted tools, even just running in a .html file on your local disk somewhere.How would you do that without violating essential security measurements? permalink fedilink source parent hideshow 7 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago (6 children) Create or download an implementation of your preferred encryption algorithm for Javascript (or use some WebAssembly alternative). e.g. https://github.com/ricmoo/aes-js Run the implementation on your local computer and open it in a browser. Hope this helps. permalink fedilink source parent hideshow 6 child comments replies: [–] tux0r@snac.rosaelefanten.org 0 points 6 months ago (5 children) You are aware that WASM requires JS, right?I mean, yes, running the application itself would be secure, but . You cannot trust your browser. Ever. permalink fedilink source parent hideshow 5 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (4 children) You are aware that WASM requires JS, right? I think you're mistaken, there. WASM is often used alongside Javascript, but beyond the one-liner to fetch and load it, there's actually nothing which inherently requires JS beyond that. Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption? permalink fedilink source parent hideshow 4 child comments replies: [–] tux0r@snac.rosaelefanten.org 0 points 6 months ago* (last edited 6 months ago) (3 children) WASM is often used alongside Javascript, but there’s actually nothing which inherently requires it.There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is.Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption?A web browser is the most vulnerable software on your computer.To stick with the one example I brought, namely GnuPG encrypted e-mails: Running GnuPG locally on my machine to encrypt/decrypt/verify an e-mail before pasting the result into (e.g.) my e-mail client is reasonably secure. GnuPG has been audited thoroughly enough, so it's (relatively) safe to assume that no bad actor will read and/or modify the e-mail on the way. I am not aware of any JavaScript alternative with a similar security record.I think we're derailing a bit though. My original comment was:You can’t do that (= secure encryption) in a browser. and are, in real life, mostly different things and I assume you know that. GnuPG in webmail software having used it locally , which is what I was hinting at, just isn't secure. Bed time, might continue this tomorrow after work if I'll find some Lemmy time... good night for now! permalink fedilink source parent hideshow 3 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (2 children) There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is. I thought you meant like you had to use Javascript to marshal between the WASM module and the user interaction. What you really meant is that you're objecting to, basically, a load call. One line of Javascript code to load and run the WASM module. What possible security risk could that pose? And again, I've not heard an adequate explanation as to how locally-running JavaScript encryption code would be any less secure than, for example, running a Python script in the terminal. Locally and in a browser are, in real life, mostly different things and I assume you know that. I think you're basically admitting that you meant that verifiably secure encryption using a website is impossible (other than e.g. TLS), which I would agree with, but that's not what you wrote. Browser extensions are used all the time to handle all sorts of secure encryption in high risk scenarios, such as for password managers. That is a perfectly valid example of encryption within a browser - and it was the first one I mentioned. Please just admit you were wrong, or that you meant to say "website" rather than "browser". It's okay, trust me, people respect you more when you can admit that sort of thing, it makes you look strong and capable of taking criticism. permalink fedilink source parent hideshow 2 child comments replies: [–] tux0r@snac.rosaelefanten.org 1 point 6 months ago (1 child) I might, indeed, have miscommunicated my assumptions. Thank you for pointing it out. permalink fedilink source parent hideshow 1 child comment replies: [–] bearboiblake@pawb.social 1 point 6 months ago No worries! Take care, and sleep well <3 permalink fedilink source parent
[–] tux0r@snac.rosaelefanten.org -2 points 6 months ago (7 children) Ok, I'll bite:You can run fully-local resources in a browser, such as browser extensions, locally hosted tools, even just running in a .html file on your local disk somewhere.How would you do that without violating essential security measurements? permalink fedilink source parent hideshow 7 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago (6 children) Create or download an implementation of your preferred encryption algorithm for Javascript (or use some WebAssembly alternative). e.g. https://github.com/ricmoo/aes-js Run the implementation on your local computer and open it in a browser. Hope this helps. permalink fedilink source parent hideshow 6 child comments replies: [–] tux0r@snac.rosaelefanten.org 0 points 6 months ago (5 children) You are aware that WASM requires JS, right?I mean, yes, running the application itself would be secure, but . You cannot trust your browser. Ever. permalink fedilink source parent hideshow 5 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (4 children) You are aware that WASM requires JS, right? I think you're mistaken, there. WASM is often used alongside Javascript, but beyond the one-liner to fetch and load it, there's actually nothing which inherently requires JS beyond that. Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption? permalink fedilink source parent hideshow 4 child comments replies: [–] tux0r@snac.rosaelefanten.org 0 points 6 months ago* (last edited 6 months ago) (3 children) WASM is often used alongside Javascript, but there’s actually nothing which inherently requires it.There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is.Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption?A web browser is the most vulnerable software on your computer.To stick with the one example I brought, namely GnuPG encrypted e-mails: Running GnuPG locally on my machine to encrypt/decrypt/verify an e-mail before pasting the result into (e.g.) my e-mail client is reasonably secure. GnuPG has been audited thoroughly enough, so it's (relatively) safe to assume that no bad actor will read and/or modify the e-mail on the way. I am not aware of any JavaScript alternative with a similar security record.I think we're derailing a bit though. My original comment was:You can’t do that (= secure encryption) in a browser. and are, in real life, mostly different things and I assume you know that. GnuPG in webmail software having used it locally , which is what I was hinting at, just isn't secure. Bed time, might continue this tomorrow after work if I'll find some Lemmy time... good night for now! permalink fedilink source parent hideshow 3 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (2 children) There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is. I thought you meant like you had to use Javascript to marshal between the WASM module and the user interaction. What you really meant is that you're objecting to, basically, a load call. One line of Javascript code to load and run the WASM module. What possible security risk could that pose? And again, I've not heard an adequate explanation as to how locally-running JavaScript encryption code would be any less secure than, for example, running a Python script in the terminal. Locally and in a browser are, in real life, mostly different things and I assume you know that. I think you're basically admitting that you meant that verifiably secure encryption using a website is impossible (other than e.g. TLS), which I would agree with, but that's not what you wrote. Browser extensions are used all the time to handle all sorts of secure encryption in high risk scenarios, such as for password managers. That is a perfectly valid example of encryption within a browser - and it was the first one I mentioned. Please just admit you were wrong, or that you meant to say "website" rather than "browser". It's okay, trust me, people respect you more when you can admit that sort of thing, it makes you look strong and capable of taking criticism. permalink fedilink source parent hideshow 2 child comments replies: [–] tux0r@snac.rosaelefanten.org 1 point 6 months ago (1 child) I might, indeed, have miscommunicated my assumptions. Thank you for pointing it out. permalink fedilink source parent hideshow 1 child comment replies: [–] bearboiblake@pawb.social 1 point 6 months ago No worries! Take care, and sleep well <3 permalink fedilink source parent
[–] bearboiblake@pawb.social 3 points 6 months ago (6 children) Create or download an implementation of your preferred encryption algorithm for Javascript (or use some WebAssembly alternative). e.g. https://github.com/ricmoo/aes-js Run the implementation on your local computer and open it in a browser. Hope this helps. permalink fedilink source parent hideshow 6 child comments replies: [–] tux0r@snac.rosaelefanten.org 0 points 6 months ago (5 children) You are aware that WASM requires JS, right?I mean, yes, running the application itself would be secure, but . You cannot trust your browser. Ever. permalink fedilink source parent hideshow 5 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (4 children) You are aware that WASM requires JS, right? I think you're mistaken, there. WASM is often used alongside Javascript, but beyond the one-liner to fetch and load it, there's actually nothing which inherently requires JS beyond that. Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption? permalink fedilink source parent hideshow 4 child comments replies: [–] tux0r@snac.rosaelefanten.org 0 points 6 months ago* (last edited 6 months ago) (3 children) WASM is often used alongside Javascript, but there’s actually nothing which inherently requires it.There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is.Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption?A web browser is the most vulnerable software on your computer.To stick with the one example I brought, namely GnuPG encrypted e-mails: Running GnuPG locally on my machine to encrypt/decrypt/verify an e-mail before pasting the result into (e.g.) my e-mail client is reasonably secure. GnuPG has been audited thoroughly enough, so it's (relatively) safe to assume that no bad actor will read and/or modify the e-mail on the way. I am not aware of any JavaScript alternative with a similar security record.I think we're derailing a bit though. My original comment was:You can’t do that (= secure encryption) in a browser. and are, in real life, mostly different things and I assume you know that. GnuPG in webmail software having used it locally , which is what I was hinting at, just isn't secure. Bed time, might continue this tomorrow after work if I'll find some Lemmy time... good night for now! permalink fedilink source parent hideshow 3 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (2 children) There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is. I thought you meant like you had to use Javascript to marshal between the WASM module and the user interaction. What you really meant is that you're objecting to, basically, a load call. One line of Javascript code to load and run the WASM module. What possible security risk could that pose? And again, I've not heard an adequate explanation as to how locally-running JavaScript encryption code would be any less secure than, for example, running a Python script in the terminal. Locally and in a browser are, in real life, mostly different things and I assume you know that. I think you're basically admitting that you meant that verifiably secure encryption using a website is impossible (other than e.g. TLS), which I would agree with, but that's not what you wrote. Browser extensions are used all the time to handle all sorts of secure encryption in high risk scenarios, such as for password managers. That is a perfectly valid example of encryption within a browser - and it was the first one I mentioned. Please just admit you were wrong, or that you meant to say "website" rather than "browser". It's okay, trust me, people respect you more when you can admit that sort of thing, it makes you look strong and capable of taking criticism. permalink fedilink source parent hideshow 2 child comments replies: [–] tux0r@snac.rosaelefanten.org 1 point 6 months ago (1 child) I might, indeed, have miscommunicated my assumptions. Thank you for pointing it out. permalink fedilink source parent hideshow 1 child comment replies: [–] bearboiblake@pawb.social 1 point 6 months ago No worries! Take care, and sleep well <3 permalink fedilink source parent
[–] tux0r@snac.rosaelefanten.org 0 points 6 months ago (5 children) You are aware that WASM requires JS, right?I mean, yes, running the application itself would be secure, but . You cannot trust your browser. Ever. permalink fedilink source parent hideshow 5 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (4 children) You are aware that WASM requires JS, right? I think you're mistaken, there. WASM is often used alongside Javascript, but beyond the one-liner to fetch and load it, there's actually nothing which inherently requires JS beyond that. Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption? permalink fedilink source parent hideshow 4 child comments replies: [–] tux0r@snac.rosaelefanten.org 0 points 6 months ago* (last edited 6 months ago) (3 children) WASM is often used alongside Javascript, but there’s actually nothing which inherently requires it.There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is.Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption?A web browser is the most vulnerable software on your computer.To stick with the one example I brought, namely GnuPG encrypted e-mails: Running GnuPG locally on my machine to encrypt/decrypt/verify an e-mail before pasting the result into (e.g.) my e-mail client is reasonably secure. GnuPG has been audited thoroughly enough, so it's (relatively) safe to assume that no bad actor will read and/or modify the e-mail on the way. I am not aware of any JavaScript alternative with a similar security record.I think we're derailing a bit though. My original comment was:You can’t do that (= secure encryption) in a browser. and are, in real life, mostly different things and I assume you know that. GnuPG in webmail software having used it locally , which is what I was hinting at, just isn't secure. Bed time, might continue this tomorrow after work if I'll find some Lemmy time... good night for now! permalink fedilink source parent hideshow 3 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (2 children) There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is. I thought you meant like you had to use Javascript to marshal between the WASM module and the user interaction. What you really meant is that you're objecting to, basically, a load call. One line of Javascript code to load and run the WASM module. What possible security risk could that pose? And again, I've not heard an adequate explanation as to how locally-running JavaScript encryption code would be any less secure than, for example, running a Python script in the terminal. Locally and in a browser are, in real life, mostly different things and I assume you know that. I think you're basically admitting that you meant that verifiably secure encryption using a website is impossible (other than e.g. TLS), which I would agree with, but that's not what you wrote. Browser extensions are used all the time to handle all sorts of secure encryption in high risk scenarios, such as for password managers. That is a perfectly valid example of encryption within a browser - and it was the first one I mentioned. Please just admit you were wrong, or that you meant to say "website" rather than "browser". It's okay, trust me, people respect you more when you can admit that sort of thing, it makes you look strong and capable of taking criticism. permalink fedilink source parent hideshow 2 child comments replies: [–] tux0r@snac.rosaelefanten.org 1 point 6 months ago (1 child) I might, indeed, have miscommunicated my assumptions. Thank you for pointing it out. permalink fedilink source parent hideshow 1 child comment replies: [–] bearboiblake@pawb.social 1 point 6 months ago No worries! Take care, and sleep well <3 permalink fedilink source parent
[–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (4 children) You are aware that WASM requires JS, right? I think you're mistaken, there. WASM is often used alongside Javascript, but beyond the one-liner to fetch and load it, there's actually nothing which inherently requires JS beyond that. Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption? permalink fedilink source parent hideshow 4 child comments replies: [–] tux0r@snac.rosaelefanten.org 0 points 6 months ago* (last edited 6 months ago) (3 children) WASM is often used alongside Javascript, but there’s actually nothing which inherently requires it.There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is.Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption?A web browser is the most vulnerable software on your computer.To stick with the one example I brought, namely GnuPG encrypted e-mails: Running GnuPG locally on my machine to encrypt/decrypt/verify an e-mail before pasting the result into (e.g.) my e-mail client is reasonably secure. GnuPG has been audited thoroughly enough, so it's (relatively) safe to assume that no bad actor will read and/or modify the e-mail on the way. I am not aware of any JavaScript alternative with a similar security record.I think we're derailing a bit though. My original comment was:You can’t do that (= secure encryption) in a browser. and are, in real life, mostly different things and I assume you know that. GnuPG in webmail software having used it locally , which is what I was hinting at, just isn't secure. Bed time, might continue this tomorrow after work if I'll find some Lemmy time... good night for now! permalink fedilink source parent hideshow 3 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (2 children) There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is. I thought you meant like you had to use Javascript to marshal between the WASM module and the user interaction. What you really meant is that you're objecting to, basically, a load call. One line of Javascript code to load and run the WASM module. What possible security risk could that pose? And again, I've not heard an adequate explanation as to how locally-running JavaScript encryption code would be any less secure than, for example, running a Python script in the terminal. Locally and in a browser are, in real life, mostly different things and I assume you know that. I think you're basically admitting that you meant that verifiably secure encryption using a website is impossible (other than e.g. TLS), which I would agree with, but that's not what you wrote. Browser extensions are used all the time to handle all sorts of secure encryption in high risk scenarios, such as for password managers. That is a perfectly valid example of encryption within a browser - and it was the first one I mentioned. Please just admit you were wrong, or that you meant to say "website" rather than "browser". It's okay, trust me, people respect you more when you can admit that sort of thing, it makes you look strong and capable of taking criticism. permalink fedilink source parent hideshow 2 child comments replies: [–] tux0r@snac.rosaelefanten.org 1 point 6 months ago (1 child) I might, indeed, have miscommunicated my assumptions. Thank you for pointing it out. permalink fedilink source parent hideshow 1 child comment replies: [–] bearboiblake@pawb.social 1 point 6 months ago No worries! Take care, and sleep well <3 permalink fedilink source parent
[–] tux0r@snac.rosaelefanten.org 0 points 6 months ago* (last edited 6 months ago) (3 children) WASM is often used alongside Javascript, but there’s actually nothing which inherently requires it.There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is.Can you explain why you feel that locally running Javascript is more insecure than using, say, locally running Python code, for encryption?A web browser is the most vulnerable software on your computer.To stick with the one example I brought, namely GnuPG encrypted e-mails: Running GnuPG locally on my machine to encrypt/decrypt/verify an e-mail before pasting the result into (e.g.) my e-mail client is reasonably secure. GnuPG has been audited thoroughly enough, so it's (relatively) safe to assume that no bad actor will read and/or modify the e-mail on the way. I am not aware of any JavaScript alternative with a similar security record.I think we're derailing a bit though. My original comment was:You can’t do that (= secure encryption) in a browser. and are, in real life, mostly different things and I assume you know that. GnuPG in webmail software having used it locally , which is what I was hinting at, just isn't secure. Bed time, might continue this tomorrow after work if I'll find some Lemmy time... good night for now! permalink fedilink source parent hideshow 3 child comments replies: [–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (2 children) There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is. I thought you meant like you had to use Javascript to marshal between the WASM module and the user interaction. What you really meant is that you're objecting to, basically, a load call. One line of Javascript code to load and run the WASM module. What possible security risk could that pose? And again, I've not heard an adequate explanation as to how locally-running JavaScript encryption code would be any less secure than, for example, running a Python script in the terminal. Locally and in a browser are, in real life, mostly different things and I assume you know that. I think you're basically admitting that you meant that verifiably secure encryption using a website is impossible (other than e.g. TLS), which I would agree with, but that's not what you wrote. Browser extensions are used all the time to handle all sorts of secure encryption in high risk scenarios, such as for password managers. That is a perfectly valid example of encryption within a browser - and it was the first one I mentioned. Please just admit you were wrong, or that you meant to say "website" rather than "browser". It's okay, trust me, people respect you more when you can admit that sort of thing, it makes you look strong and capable of taking criticism. permalink fedilink source parent hideshow 2 child comments replies: [–] tux0r@snac.rosaelefanten.org 1 point 6 months ago (1 child) I might, indeed, have miscommunicated my assumptions. Thank you for pointing it out. permalink fedilink source parent hideshow 1 child comment replies: [–] bearboiblake@pawb.social 1 point 6 months ago No worries! Take care, and sleep well <3 permalink fedilink source parent
[–] bearboiblake@pawb.social 3 points 6 months ago* (last edited 6 months ago) (2 children) There is no established way to load WASM in your browser without JavaScript code that does it for you, so there actually is. I thought you meant like you had to use Javascript to marshal between the WASM module and the user interaction. What you really meant is that you're objecting to, basically, a load call. One line of Javascript code to load and run the WASM module. What possible security risk could that pose? And again, I've not heard an adequate explanation as to how locally-running JavaScript encryption code would be any less secure than, for example, running a Python script in the terminal. Locally and in a browser are, in real life, mostly different things and I assume you know that. I think you're basically admitting that you meant that verifiably secure encryption using a website is impossible (other than e.g. TLS), which I would agree with, but that's not what you wrote. Browser extensions are used all the time to handle all sorts of secure encryption in high risk scenarios, such as for password managers. That is a perfectly valid example of encryption within a browser - and it was the first one I mentioned. Please just admit you were wrong, or that you meant to say "website" rather than "browser". It's okay, trust me, people respect you more when you can admit that sort of thing, it makes you look strong and capable of taking criticism. permalink fedilink source parent hideshow 2 child comments replies: [–] tux0r@snac.rosaelefanten.org 1 point 6 months ago (1 child) I might, indeed, have miscommunicated my assumptions. Thank you for pointing it out. permalink fedilink source parent hideshow 1 child comment replies: [–] bearboiblake@pawb.social 1 point 6 months ago No worries! Take care, and sleep well <3 permalink fedilink source parent
[–] tux0r@snac.rosaelefanten.org 1 point 6 months ago (1 child) I might, indeed, have miscommunicated my assumptions. Thank you for pointing it out. permalink fedilink source parent hideshow 1 child comment replies: [–] bearboiblake@pawb.social 1 point 6 months ago No worries! Take care, and sleep well <3 permalink fedilink source parent
[–] bearboiblake@pawb.social 1 point 6 months ago No worries! Take care, and sleep well <3 permalink fedilink source parent