Arbitrary code execution is a vulnerability where you write and execute arbitrary code outside of the intended environment

Just because Actionscript is a language doesn’t mean it has the functionality to do whatever to your machine. It lacks most of those functions because it is mostly a graphics library. It would have to run an already prepared external script via some improper memory pointer somewhere for it to be arbitrary code execution.

And Actionscript is not built on top of JavaScript. Both JavaScript and ActionScript are based on ecmascript. They are different, just like Typescript and JavaScript are different.

Actionscript was object oriented and had proper types unlike JavaScript which to this day is one of the worst programming languages.

Are you sure I’m the one misunderstanding the problem of evercookie? Was the problem that you could access the same cookies from multiple browsers because of ActionScript, or was it that evercookie maliciously restored said deleted cookies after they were supposed to no longer be used? One is a feature that allows transferring sessions between browsers on the same computer. The other is essentially malware.

Flash didn’t allow arbitrary code to run. It had a very limited scripting language (which design-wise is superior to JavaScript, by the way) to control canvas elements and playing sound. You couldn’t execute programs on your computer.

If by late you mean right before action script 2. I was making flash games back then and I remember it being unable to access virtually anything without first triggering a prompt, which you could disable by right clicking, and going into properties.

Your legitimate concerns about JavaScript are blockable by the browser.

Yes, through NoScript. And it should be blocked, not blockable.

It is funny you mention evercookie because that was a JavaScript library, and affected all cookies, not just flash cookies.

Flash cookies being sharable between browsers was bad, but you could still easily clear those cookies, that is until a certain JavaScript library started restoring them automatically.

You really can’t. If it was only HTML and CSS, any accessibility program would be able to select any part of the page, and easily alter the CSS and HTML. That is next to impossible now because of JavaScript.

It shouldn’t be up to the website developer. It should be up to the browser developer. You don’t blame a lemmy instance for poor accessibility with Jerboa.

We still use plugins. In fact you most likely have one installed right now for video encoding. JavaScript not being a plugin is the reason we only have two major browser cores. Chromium and gecko. JavaScript prevents new browsers from entering the ecosystem due to how hard it is to implement unlike how easy it would have been as a plugin.

Flash had vulnerabilities because of neglect from adobe. The core design of flash and its earlier stages made by Macromedia were great. It had a sandboxes environment, and later it even was integrated into a browser sandbox just like JavaScript, eliminating most vulnerabilities.

Flash was very limited in the malicious code it could run, as opposed to JavaScript which can automatically redirect you to malicious websites, install tracking cookies, access the browser canvas to install tracking pixels, freeze your entire browser, take control of your cursor, look at your entire clipboard history, collect enough information about you to competely identify and track your footprint over the entire internet.

Flash couldn’t access your clipboard or files unless you clicked allow every time, couldn’t access anything outside of its little window, and if it froze, the browser was mostly unaffected, and flash had almost no ability to collect any data about your browser.

Accessibility is orthogonal to JavaScript if the site is being built to modern standards.

In other words, accessibility is in the hands of the developers, not the visitor. And the developer really wants that scrolling background and non-selectable text, so tough luck, people with no hands, I guess.

Flash was containerized, and completely safe until adobe just stopped supporting it. A million times better than what JavaScript has become in terms of privacy. There is a reason noscript is bundled with Tor.

And preference is definitely a reality. It is niche at the moment but I see a future where more and more people see JavaScript for what it is. Bloat.

I definitely prefer using no-script enabled pages. If it were me, I would prefer a fully non-JavaScript internet with static pages.

JavaScript introduces so many vulnerabilities, it makes adobe flashplayer look like a security suite. JavaScript also breaks all accessibility features like speech recognition and font size and color control.

His record should be expunged when he turns 18 because it was a crime he committed as a child. I understand their frustrations, but they’re asking to jail a child over some photoshopped images.

Making a deepfake is definitely not a heavy crime that deserves jailtime or a permanent mark unless he was an adult doing it.