Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.
I think the problem is that we've let JS engines become absurdly complex so there's no way to avoid them having really gross bugs.
That said, I think that the V8 team has done a fantastic job of securing their engine. Their heap sandbox feature is really inspiring! It's really wild that (as far as I can understand this issue) someone is able to bypass it.
(Posted from a memory safe browser - WebKit MiniBrowser compiled with Fil-C. Pretty sure this is safer than even V8 and the heap sandbox.)
The additional performance from the JIT is actually really small for most tasks. It should, ideally, be disabled by default. For your average JS you get <10% performance gain. Most of the cost is browser API, not JS, so the performance is underwhelming.
It’s only very heavy calculations that see a boost in performance. But, realistically, how many websites require this or currently use this today? <1%? Maybe <.1%?
This is pretty typical across JIT engines, too. PHP also sees only a slight increase in performance from the JIT. Because of the nature of PHP applications, most time is spend on the network and database. Only very CPU-heavy code sees a significant speed up.
That’s even the case for C#, which is why the dotnet runtime only conditionally JIT compiles code. Only hot path code is eligible for JIT compilation.
That is surely not the case for C#, contrary to most JVM implementations, on the CLR CIL is always jitted before execution since .NET 1.0, and this not taking into account AOT scenarios like NGEN (since .NET 1.0), and everything that came later as AOT toolchains.
The only .NET implementations that interpret CIL were the .NET Compact and Micro frameworks due to hardware limitations, nowadays mostly gone as .NET workloads, and alternative implementations like Mono.
You’re correct, where I got confused is the lazy per-method JIT and the tiers of JIT optimization. My understanding is that dotnet only compiles on first function call, or when it has to for things like generics. So, some code is never compiled if it’s never executed. And then, functions will be re-JIT at higher optimization levels under certain conditions later. You certainly know more about this than me, but yes I was wrong about conditional JIT.
I’ve done that long ago. In fact on iOS it’s simpler: since Apple doesn’t allow third party browsers to use the JIT, using any browser other than Safari will disable the JIT.
In synthetic benchmarks, there was a 40-80% reduction in performance when disabling the JIT. But in a simulated test on YouTube.com, the performance delta was only 6%.
This isn’t the best source as it’s a bit old, and it wasn’t just JIT that was disabled. But the core idea is the same: calculation-heavy code can see an improvement, but most code won’t. Why this matters is how people actually use JS on the web. It’s not for cryptography and such, it’s to manipulate the DOM.
We see a similar pattern: in synthetic benchmarks, the performance gain is large. But Wordpress, by far the largest PHP deployment in the wild, only saw ~3% performance gain. It again comes down to how PHP is used. It’s mostly HTML construction and database calls, neither of which will see any performance gain from a JIT. And, PHP has extensions, where most heavy code is moved to. Things like cryptography are done in PHP extensions, in C, where the JIT doesn’t matter. I’m more familiar with PHP, so I’ve known about the history of PHP not shipping a JIT due to the lackluster performance.
I'm glad I've already done that! I haven't seen any difference in performance like others mention though. Weird. The only override I've made is for a website which needs to run some client-side cryptography code and it would take ages without the JIT.
We live in a world where my laptop is forced to waste tons of computational power on immensely bloated websites even with ad-block, with now even having to worry about agentic bullshit that I didn't ask for, and plenty of others apparently still think throwing computational cycles at cryptocurrency is good for anything.
Complaining about a relatively small performance price for Fil-C in that context honestly feels like that one famous newspaper photo of a smoking pregnant woman drinking a beer with a caption saying she's wbrried about the effects of the loud construction noises next door on her unborn child.
Except even that is wrong, because at least she had a point about the construction noises, while this is more of a "refusing to eat your vegetables" kind of situation.
Using personal websites read by a handful of programmer nerds that work fine if you turn off javascript to justify literally everyone else being forced to navigate bloated, broken company websites isn't particularly convincing as an argument against memory-safe C imo.
When Chromium and V8 are written in a memory-safe language then I might believe this.
Yes, if your JavaScript engine is written in C++, it’s going to be very hard to avoid very gross bugs. We have better options now.
The ability of adversaries to find and exploit very gross bugs in C++ codebases should have already compelled the industry to move to memory safety. Now that AI has democratized the ability to scour C++ codebases for really gross and exploitable bugs, I should think that our hands are at last being forced. I’m not impressed by what I’ve seen in the industry with respect to taking memory safety seriously.
I believe programmers still write in C(++) after memory safe options, in order to continue being occupied afterwards, fixing the bugs that will arise. Without criminals, police is obsolete.
Which is why I have NoScript in my Firefox and have gotten used to manually enabling javascript for select pages. Small price to pay.
Unfortunately the web is full of trivial websites that have no business running javascript. Recently wanted to read the famed post on Gates Notes. But for some reason Bill requires javascript to render text and images. Which reminded me Bill is not a person with good judgement on matters of IT and policy. Time saved.
Wow... I understand your point but if you feel that strong about gates using js on his personal website, it is a bit harsh isn't it? Could have multiple reasons why it is needed. Especially for someone with such a huge follower base. Lazy loading, tracking, client based adjustments, using a framework, fun [:)]... I could go on with a 100 more points why js might be needed.
I know that this is sarcasm, but there are people who really think this.
They get emotional (usually angry) when you tell them you disable javascript- as if every site that serves any kind of content has an automatic entitlement to run arbitrary code on your computer.
That is true, but it is very basic and depending on the browser how it is implemented. On traffic heavy sites, which I assume gates blog is, js gives you full control over what get loaded when and at the same time enables tracking how far the user read the article and which parts he most likely skipped.
I am not saying that this is good, however if you have these requirements js is a valid choice.
Basically no one has a requirement to track what someone else is looking at. In fact, if not given explicit consent by the person being tracked (like they've specifically sought you tracking it for them, e.g. marking their place), we should frankly criminalize it. Mass surveillance should result in jail time.
This might oversell the agency that practicioners have.
Sandboxed zero-install delivery will outcompete anything with more frictionful installs.
It's probably not the right model for a pacemaker though.
Web/JS has been a double-edged sword for FOSS: sure, I can run a free OS, but if most of my "apps" happen to be JS that I can't practically control, then I have won a battle and lost a war.
I wish Haketilo [1] would have caught on more. There's so many free JavaScript apps but we're mostly just missing a way to actually control which version or derivative of the JavaScript is run.
There's also the problem of most free apps not doing a good job of providing license info and a link to source code, but this could be sidestepped by a trusted repository which provides license info itself.
Running code by itself isn't that bad, it's the fact that browser developers have decided for some reason that this code needs to be as performant as possible, so, JIT.
I don't get it! The way JS is typically used, it doesn't even benefit from JIT all that much. Making ajax requests, doing stuff with strings, and moving DOM elements around doesn't need every CPU clock cycle to be used as optimally as possible. It's exceedingly rare for websites to actually be doing something that needs raw performance. And SPAs will be slow no matter what.
I disagree about JIT performance not mattering. I enabled "Lockdown Mode" on iOS which disables the JIT for the mentioned security reasons, and it causes a very noticeable lagginess on many sites. Of course, the primary cause is the unnecessary JS monstrosities wasting CPU cycles. But practically speaking I can say that disabling the JIT results in a very subpar experience of many JS heavy pages.
That's largely because a lot of developers have made the devil's bargain of replacing standard web stuff with badly re-implemented JS versions of same. People did it because they could, but never considered if they should.
See most of the ecosystem around React, for reference. It's idiotic that things like URL management are done in Javascript. Or form controls. I guarantee that if we stopped doing this kind of stuff, JIT wouldn't matter.
To some extent this is just saying "developers will depend upon the performance given to them", and that's true, but it's also true that as soon as things like V8 and Node appeared, JS became ubiquitous. Pandora's container, if you will.
> See most of the ecosystem around React, for reference.
I've never used React myself, but what I've heard about it makes me question my own sanity. So are you going to tell me that instead of just updating the DOM tree directly I'm going to apply the changes to my data, then pass the entire model to the framework, which would then diff it with the previous version to get the changes back out, it would then call my functions that return components, and it would then diff the virtual DOM to find out what changed, and only then would it update the actual page? Why the fuck would anyone ever want that? What's so hard about simply changing the innerText or inserting elements or whatever?
Oh and now Google and Apple are insisting that this is the way to do UIs in native apps as well, with Compose and SwiftUI respectively.
The way the front end developer community seems to largely encourage learning top-down isn't helping either. I'll forever remember that one guy we made a small project with. He learned React but had no clue what "send a request" and "pass a parameter" means, and I had to explain him how to use XHR.
The DOM is the slowest part of the browser. It's not Javascript, it's the DOM. React is an attempt to manage the slowness of the DOM. One seemingly small change to a page (like setting innerText) can have many ripple effects with reflow on mamy parts of a page.
With thousands of DOM elements on a page, the DOM becomes a bottleneck. This isn't the fault of front-end developers, and it's not really the fault of browser developers. HTML/CSS/JS is a very powerful system, but it's also complex and can cost a lot of compute. When you understand this, then the reasons for React and other front-end frameworks become easier to accept.
> One seemingly small change to a page (like setting innerText) can have many ripple effects with reflow on mamy parts of a page.
I haven't looked into how browsers actually do it, but my mental model for it is that if something changes, this merely sets a flag on that element or its parent that its layout is not valid any more. Then, on next vsync, all the elements that have this flag set have their layout recalculated, potentially going up the tree as necessary. The only exception is if your script tries to get any layout-related property, e.g. offsetWidth. Then, as if as part of the getter of such a property, the layout recalculation will run immediately.
That is to say, if you need to make a lot of changes to the DOM, you should make them within one JS invocation so only one layout pass happens sometime after you're done.
OP here. The steel-man argument for React is not that it is faster at rendering. It cannot be, because it ultimately relies on the same DOM that everyone else does to do the job, and it has to set up a massive JS data structure to do what it does, which uses a lot of memory and has big GC costs. Arguments that assert that the React virtual DOM are faster than the native/shadow DOM are simply wrong [1]. Even the React team admits this [2] (though back in the day, they made a number of puffed-up claims about speed that never made sense).
The principle argument in favor of React today are developer ergonomics. People don't have to manually alter individual elements anymore -- they just describe state, and React takes care of the UI change set. On top of that, you have components, etc., that are debatably more pleasant to work with, and at the least create an ecosystem advantage for users of the framework. One can certainly see the argument for something like facebook, where there are probably dozens of different things changing independently at any given time.
But that said, one really has to question whether React makes sense anymore, given LLMs. Back when the alternative was that someone had to bespoke code every UI component, it might have been worth taking the hit of having to adopt the entire React ecosystem. But now that LLMs are writing the code, there's really no argument for developer ergonomics, and suddenly, things like "rewriting URL handling in JS" are pure liabilities.
[1] Though sadly, many front-end devs don't know this.
Well, I'm an old-school guy. I'm all for developer ergonomics, as long as they don't affect the runtime. I use PostCSS and TypeScript in my own projects precisely for this reason, because they both make things more convenient for me yet leave no trace in the finished product that the users see.
> But now that LLMs are writing the code
Hopefully that's a temporary state of affairs and everyone will eventually go back to writing code by hand. I've never even considered using an LLM to get my job done, the whole idea is as alien to me as are these types of UI frameworks. To me, the best language to describe what you want from a computer isn't English, it's a programming language.
>But now that LLMs are writing the code, there's really no argument for developer ergonomics, and suddenly, things like "rewriting URL handling in JS" are pure liabilities.
The popular coding AIs go down all the time. Last week all of them were down at the same time. If there's a bug causing losses of thousands or millions of dollars per minute, do we really want to let the LLM write incomprehensible code?
You may not need react. If you want to make the smallest possible change to the dom to reduce latency, then make the smallest possible change to the dom. Choose solidjs. (Not a sponsored post).
> Why the fuck would anyone ever want that? What's so hard about simply changing the innerText or inserting elements or whatever?
It's so that you have the page reflecting your data at all times.
The browsers should have been written this way, instead of having byzantine update functions with all forms and a pair of *Text to rule them all. But creating it in Javascript is a really bad idea.
The problem is not url management. That should happen just once or twice during the life cycle of a page. If it takes 0.1ms or 1ms doesn't have any impact on the usability.
One of my problems was that I wanted to show data in the browser. It is a convenient delivery platform, after all. However, Chrome (and Chrome in particular) has tremendous trouble displaying large pages. A 400x400 table takes a long time to render. I could solve that in JavaScript. I had to, really.
So, as practically always, the problems stem from a combination of factors, and bad programming definitely is one of them.
That's largely because a lot of developers have made the devil's bargain of replacing standard hardware and OS primitives with badly re-implemented C versions of same. People did it because they could, but never considered if they should.
See most of the ecosystem around modern systems software, for reference. It's idiotic that things like memory layout and bit-level hardware management are done in C abstractions. I guarantee that if we stopped doing this kind of stuff, compiler optimizations wouldn't matter.
To some extent this is just saying "developers will depend upon the performance given to them", and that's true, but it's also true that as soon as things like compilers and standard libraries appeared, C became ubiquitous. Pandora's container, if you will.
> It's idiotic that things like memory layout and bit-level hardware management are done in C abstractions. I guarantee that if we stopped doing this kind of stuff, compiler optimizations wouldn't matter.
Cute, but no, not even close to a good metaphor. The C example is abstracting away fundamental complexity in a new platform. The other is completely re-writing -- in duplicate and slightly broken -- what the platform gives you for free. There's nothing about implementing form controls or URL management in JS that is more abstract. It's just different; a downstream bad decision that branches off a long tree of other bad decisions.
The equivalent level of idiocy in a C-related metaphor would be...I dunno...if you decided that you didn't like the way that header files worked, and decided to keep the C compiler, but build an external header-file management system in Fortran [1] that calls the C compiler for you. Or even closer to the JS metaphor, you shipped a special C compiler that had an embedded interpreted language that only activated at compile time, and you then used that language to allow any user to fundamentally change the syntax of C.
(It hopefully shouldn't be lost on you that this exact approach to language features has been repeatedly tried in the javascript world, including right now, with package management. But see also: typescript, coffeescript before that, Dart, etc. Javascript is a mess, and history repeats itself with regularity about every 5 years.)
[1] ...and then you re-write that about sixty times, each time being slightly incompatible with the last, and all having different fundamental incompatibilities with C headers.
Sites are slow because with all that excess performance they do more tracking, instead of keeping the website as-is.
Because that's the only thing business managers can come up with in that situation. It's a misaligned goal of users vs businesses.
In my opinion the "user agent" behavior of browsers is long gone, because they're not acting on behalf of their users anymore. They're acting on behalf of businesses.
I suspect the people who agree to buy Jira & Confluence are not particularly heavy users of them. At least, that's the only explanation I can fathom for their continued sales.
I've never seen an SPA which scales properly and doesn't become a bloated mess, maybe that's possible but it's definitely harder to make it work than using traditional server side template rendering
I don't only mean "scale" in terms of users but also scale in terms of features.
So you have to guarantee that your product will stay low users and low features forever or spend a very high effort to try to partially overcome that block when you change your mind.
And guaranteeing that it will stay low features is much harder than low users I think.
In exchange for that you get a better talent pool for recruiting but does that matter if your product has to stay low scale anyways?
Or you have to distribute your code in such a fashion, and structure your business model in such a way, that “scale” doesn’t require you doing things that have nothing to do with providing the feature set (most SaaS).
I'm currently working on a SaaS at my company and we have a lot of issues because of the SPA, I estimate we spend around 5% at least, maybe 10% of the workforce just on SPA complexity.
It can work for some SaaS but if you stay low employee count, low users and you have a core feature used everywhere in the whole product and nothing else
I don't have a final opinion on the subject, it's just the results I witnessed after a long time in the industry. The ones I've seen with Angular suffered from the same issues.
I'm sure counter examples of well managed SPAs do exist somewhere, it's just that it seems much easier to do the wrong thing compared to a traditional stack. This is why I'd not advise for it unless you have a very good reason.
The good stacks should make the good choices the natural way to do things, again my opinion.
At this point SPA pretty much implies React. But even if you optimize everything the best you could and avoid any third-party runtime dependencies, it's still going to be significantly more work to make API requests and do client-side rendering vs just rendering HTML server-side.
Not always. Consider an SPA that connects via WebSockets and streams in data, adding points to a chart. The JS-less alternative would be refreshing an SVG or even the whole page once a second. The SPA is clearly more efficient here (unless someone screws it up badly).
I wouldn't consider that an SPA at all, it's just a page with an interactive element. An SPA is something that renders everything client-side and uses a generic client API to talk to the backend. A telltale sign of an SPA is that the first thing you see when you open it is some sort of loading indicator instead of the actual page you're visiting.
Right but the implication of a SPA is that it’s an application which has many logical pages, but only one real page. The logical pages are constructed by dynamically updating the DOM using JavaScript. As opposed to navigating to a new, server-provided page.
For example, a search function. For a MPA, each search query would be a new page. For a SPA, each query is a new logical page, served on the same real page.
Technically yes, a SPA may have minimal client side rendering. But then it’s not doing much of anything at all - it’s just a site. When people say SPA, they typically mean an application with client side rendering.
This reply means basically nothing to me or anyone.
To expand on what I mean, if the implication isn’t obvious: a SPA with no client side rendering is just a single HTML page. It’s a document, not an application.
So SPA naturally implies client side rendering.
The difference between a SPA and MPA isn’t the amount of pages, they both have about the same amount of logic pages. It’s about where those pages are rendered. Dynamically on the front end, or on the back end.
EDIT: okay okay to expand, my website has a contact form. With JS enabled, the form submit displays a little box that says “thank you for submitting”. With JS disabled, it navigates you to a “thank you for submitting” page.
Both are the same logic page, they have the same function. One page is just rendered client side, and one server side. Most websites or applications are hybrids. There’s very few true single page applications, and very few true multi page applications. Most SPAs have multiple real pages for different things. Most MPAs combine multiple logic pages into one real page.
The features of HTML are still greatly limited. You can’t really create applications with just one HTML page and no client-side rendering. You can play a video, sure, but that’s not an application. You can also do magic with CSS but that’s an experimental fun thing, not a thing people actually do.
As soon as you, say, use JS to update the DOM or a canvas, I consider that client-side rendering. That you can do, and that would be a SPA.
But I’m curious, what are some examples, even hypothetical, of applications consisting of one HTML page? I don’t think I’ve ever seen it.
CSS (.css)
JavaScript (.js)
Plain Text (.txt)
HTML (.html)
SVG (.svg)
Raster Images (.png, .jpg, .jpeg, .gif, .webp, .bmp)
Audio (.mp3, .wav, .ogg)
Video (.mp4, .webm)
JSON (.json)
PDF (.pdf)
plus bring in other source resources as needed.
To answer your question:
The installer for GrapheneOS / Google Pixel phones is an “SPA” (or “webapp”).
I’ve seen bespoke fitness trackers of all kinds,
appliance control apps,
budget and pace-tracking stuff,
basically all of what computer programs used to do - before we started dynamically loading a ton of extra stuff onto the screen that nobody needed to do the task they came to do.
Right, but if you’re dynamically changing the HTML from JS, like the graphemeos website does, then that’s client-side rendering, which is my whole argument. Embedding the JS in HTML makes zero difference, it’s the same thing.
So, they are truly inseparable IMO. You can’t have a SPA without some amount of client side rendering, your example demonstrates that. So, what makes a SPA a SPA is the rendering. A SPA is “single page”, but only in literal meaning. Logically, every SPA is many pages, you just render them purely client-side.
By that definition, Smithereen, my fediverse server software, is also an SPA, since it does what I call "ajax navigation" on desktop, so that the notifications websocket doesn't get disconnected and reconnected every time you click a link. It's technically a single page that gets most of its content replaced at runtime when you click a link, after all, right?
That's basically the comment I was just going to write but you made me not need to.
We need simpler protocols and formats, especially those that are used over the internet.
I want everyone to really start fighting for this.
I always use a browser that doesn't run any scripts (w3m) for both this reason and others.
It hurts when I see websites that don't work without js.
A bit funny though that this page is one of them so I was not able to read it.
Wikipedia is basically the most popular application of all time and it doesn't rely on javascript. People just generally don't give a shit about where their money goes.
There is no possible interpretation under which JS fits “simpler protocols and formats,” and no world in which JS could form part of a truly secure network client environment.
And people ask me why I complain about web pages failing to display basic content without JS.
(I keep WASM and WebGL disabled in Firefox settings, too. Yes, I had another post ITT questioning why those things are any less secure than the JavaScript, given that they're supposed to be in a sandbox. But you know, defense in depth. It's insane that we're expected to put up with these grossly unnecessary risks all the time. Just like how it's insane that frontier models are being tested in environments that are physically capable of connecting to the Internet at large.)
Things such as WASM and WebGL should really be click-to-play, just like media files are.
I am decidedly uninterested in those features for most web pages I visit. Should they be able to spin up my CPU fan just for that I would consider it a misfeature. Just like a movie on high volume would be.
If anyone familiar with Firefox could implement that or point in the right direction, that would be most welcome.
Before JS and WASM we had arbitrary code delivered in the form of ActiveX components, Java applets and Flash applications, which were much worse. At least now we have multiple open source implementations of the runtime.
Rubbish, it was a great decision. So many websites wouldn't have been possible otherwise - Google maps, YouTube, ChatGPT, WhatsApp, etc. etc.
Do you remember what the alternative was? Flash, Java, ActiveX. No thank you.
Sure security is difficult but vulnerabilities of this magnitude are rare. If anything the lesson is don't write highly security sensitive software in C/C++.
I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking.
I still run with u matrix though, and most third party requests can be limited, but I no longer have enough patience when a required page doesn't work - I'll just rely on ublock origin to work.
I say this as someone does NOT disable JS in my main browser (because like, I have a job), but also knows a fair bit about why Firefox inside Tails now restarts in some cases...
It's the classic thing. Across every gdmf metric, excluding with "true empathy", no one *gives a fuck* until it affects them, or someone within (1-3) degrees of separatation. And having broad empathy is generally a good way to get yourself labeled/astrocized: both about as obvious "compriate" and obvious "adversary".
The end of that post came out in such a mess, it must be a typo for something - "compatriot" maybe? I like the other standout neologism in there though, I can see it in a dictionary now:
In fairness, in the early 2000s they were probably right. Early browser security model was a bit of a mess. The fact that this article is even talked about is a sign of how much better things are.
It's so ubiquitous and unavoidable at this point.. I was at a conference lecture in 2020 where someone was suggesting disabling JavaScript and I thought the same thing— how absurd. The times have really changed...
What would that even look like? What is "benign"? The browser environment already has pretty strict rules for what the JS can do. It's not allowed to read your files, see your webcam without permission, know about other tabs or windows etc.
The problem here is that the browser failed to correctly implement those rules. If the chromium team cannot do that, what makes you think they can implement any other kind of "benign code" verification with zero bugs?
To give an example that goes beyond what you already suggested:
You can prove that your code terminates (or rather responds to events in a finite time, even if the event loop itself runs forever.) Or you can even prove that your code reacts quickly, ie within some time limit. You can also prove memory limits.
> The problem here is that the browser failed to correctly implement those rules. If the chromium team cannot do that, what makes you think they can implement any other kind of "benign code" verification with zero bugs?
Defense in depth. And you can have competing implementations relatively easily for this, and another way to find and report bugs. Especially if the verifier is open source.
The verifier itself can be pretty simple: it's the prover that's complicated and needs smarts, but that's being run on the author's computer, not in the user's browser.
I'll believe this when it's done. Nothing I've seen so far indicates that this would be feasible.
As a practical counterexample, the Linux kernel has a verifier for eBPF code that is loaded by untrusted users. That is a much more constrained environment than JS, but they still constantly have verifier bugs. It's so bad that distros almost universally distrust the verifier and instead set things up s.t. only root can load any eBPF code.
Yes it's been a disaster for accessibility, compatibility, interoperability, energy efficiency and computing freedom (good luck using a Browser not approved by Buttflare).
The security implications are just the cherry on top.
