W3C home > Mailing lists > Public > public-script-coord@w3.org > October to December 2011

Re: All ECMAScript attributes should be non-configurable

From: David Bruant <david.bruant@labri.fr>
Date: Tue, 11 Oct 2011 12:26:05 +0200
Message-ID: <4E9419BD.2020904@labri.fr>
To: Erik Arvidsson <arv@chromium.org>
CC: Alex Russell <slightlyoff@google.com>, public-script-coord@w3.org
Le 30/09/2011 20:33, Erik Arvidsson a écrit :
> Configurability is part of JavaScript and the web. If you don't want 
> this I suggest using (...) Caja (...)
This particular argument stayed in my mind for quite a long time.
Currently, what SES does is, based on a "configurable environment", is 
to turn most things non-configurable (with initSES.js).

> To allow subclassing and allow using monkey patching to fix bugs in implementations.
But SES does not prevent monkey-patching to fix implementations. It 
would be still possible to:
1) load fixes
2) load initSES.js

I think that none of us want configurability. What we want is 
"configurability once", because it offers the potential to fix 
implementation bugs. But when bugs are fixed, I'm not really sure we 
need configurability anymore. Reading a program where things are 
redefined all the time would be a nightmare. Moreover, it leaves 
security holes.
But anyway, "configurability once" means configurability, so I join the 
side of attributes being configurable in the end. Even more since I 
discovered that WebIDL does type enforcement on the getter and setters 
which i'm sure at some point or another one browser will get wrong.

David
Received on Tuesday, 11 October 2011 10:26:44 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 8 May 2013 19:30:04 UTC