Javascript is written around the expectation that developers are flawless, having total knowledge of their codebase and never making any mistake. Looks like there exist people that share that expectation, that's news to me.
> And the world was using dynamic languages for decades on the internet (old ASP, old Actionscript, old JS, PHP4 anyone?)
Are you claiming that that code has a low bug density? Those languages are famous for low quality code.
Please recall that my claim is for simple type errors. PHP SQL injection attacks, for example, were caused not by type errors but simply by a lack of enough education on how to safely use SQL (i.e. by using prepared statements, etc.)
No javascript or PHP system will prevent those. And that's my point, the really serious, time-consuming, havoc-creating bugs are the ones no static type check will save you from.
> PHP SQL injection attacks, for example, were caused not by type errors
Great example: SQL injection are catchable with types.
Instead of using "String", whatever risks getting SQL injection attacks should only accept "EscapedString".
Besides flavio81's comment about SQL injection, Django has a very similar system for avoiding XSS too, where strings are automatically quoted when displaying, and only SafeString objects can create HTML tags.
> And the world was using dynamic languages for decades on the internet (old ASP, old Actionscript, old JS, PHP4 anyone?)
Are you claiming that that code has a low bug density? Those languages are famous for low quality code.