On Tue, Mar 19, 2013 at 5:06 PM, Andrea Giammarchi <
[email protected]> wrote:
> this is probably going to be easier .. let's see if somebody can
> understand what I mean:
>
> var public = (function(){
> var private = {
> // everything I know about security in ES
> // is that everything able to accesses
> // the private scopes has been removed...
> // Here I have my own, private, object
> // and nobody out there should be reach it.
> // but it's impossible to grant such achievement
> // if the instance is used through inheritance
> // so that outside there could be simply puppets
> // all of them managed behind the scene
> };
> return Object.freeze(
> Object.create(private)
> );
> }());
>
>
> alert(public.test); // undefined
>
> // why I cannot avoid this? I'd **LOVE** to!
> Object.getPrototypeOf(public).test = 123;
>
> alert(public.test); // 123
>
> I hope this is more clear now but feel free to ask more.
>
When I freeze the private object, it silently rejects the attempt to define
an expando:
var public = (function() {
var private = {};
Object.freeze(private);
return Object.freeze(
Object.create(private)
);
}());
console.log(public.test); // undefined
Object.getPrototypeOf(public).test = 123;
console.log(public.test); // undefined
Not sure if that covers all of the cases you had in mind.
Rick
>
> Best Regards
>
>
> On Tue, Mar 19, 2013 at 1:54 PM, Andrea Giammarchi <
> [email protected]> wrote:
>
>> "does not allow runtime modification of all instances at once" meant
>> through inheritance, through the proto, and its methods ...
>>
>>
>> On Tue, Mar 19, 2013 at 1:53 PM, Andrea Giammarchi <
>> [email protected]> wrote:
>>
>>> traits are not private classes, are constant overwrites or the
>>> equivalent of Object.create(Object.prototype, instanceDescriptors); which
>>> does not allow runtime modification of all instances at once so it does not
>>> make state-machines easy and secure to develop via JS.
>>>
>>> Is there any mechanism in any future specs that does **not** let
>>> Object.getPrototypeOf(object) return the prototype and return null instead ?
>>>
>>> Object.hidePrototypeOf(object)
>>>
>>> I believe no, that's why I've raised the question in first place.
>>>
>>> thanks
>>>
>>>
>>>
>>>
>>>
>>> On Tue, Mar 19, 2013 at 1:41 PM, Brendan Eich <[email protected]>wrote:
>>>
>>>> Andrea Giammarchi wrote:
>>>>
>>>>> so is __parent__ ... in the Mozilla world, not in every browser.
>>>>>
>>>>
>>>> That's irrelevant and also it was never writable.
>>>>
>>>>
>>>> So your point is that __proto__ is a good thing I guess, I thought it
>>>>> was rather a mistake.
>>>>>
>>>>
>>>> I didn't say that. I just said it is old.
>>>>
>>>>
>>>> Moreover, I am talking about the standard Object.getPrototypeOf()
>>>>> which has been introduced recently, not in 1998, and there's no mechanism
>>>>> to prevent it to return the prototype.
>>>>>
>>>>
>>>> SES and similar "prepared environment" dialects can and do handle
>>>> things like Object.getPrototypeOf (and __proto__).
>>>>
>>>>
>>>> I understand now security is highly subjective here and private
>>>>> classes should not exist in a programming language.
>>>>>
>>>>
>>>> No one said private classes should not exist. David mentioned traits.
>>>> ES5 provides tools for high-integrity abstractions. See
>>>> http://traitsjs.org/.
>>>>
>>>> /be
>>>>
>>>>
>>>>> Again, **good to know**
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Tue, Mar 19, 2013 at 1:13 PM, Brendan Eich <[email protected]<mailto:
>>>>> [email protected]>> wrote:
>>>>>
>>>>> Andrea Giammarchi wrote:
>>>>>
>>>>> It is not possible to secure or make a class hidden, it was
>>>>> possible before the introduction of __proto__ and
>>>>> Object.getPrototypeOf in ES3, now this is gone, and this was
>>>>> my security concern.
>>>>> ...
>>>>>
>>>>> Again, it was possible, now it's not possible anymore.
>>>>>
>>>>>
>>>>> By "anymore" you mean since 1998 or so? __proto__ is very old.
>>>>>
>>>>> /be
>>>>>
>>>>>
>>>>>
>>>
>>
>
> _______________________________________________
> es-discuss mailing list
> [email protected]
> https://mail.mozilla.org/listinfo/es-discuss
>
>
_______________________________________________
es-discuss mailing list
[email protected]
https://mail.mozilla.org/listinfo/es-discuss
