Is there actually a secure way to add support for other languages to the web? No matter what it will need to run in a hardware agnostic VM. So let's say for the sake of argument they added built-in support for Java (just the language not the APIs) in browsers. Would that come free of any security costs or would the added schematics grow the attack barrier or make vulnerability testing more difficult?
Yep. just compile it to javascript/asm.js and you get basically native speed, same security sandbox as javascript, and all the same problems with the web; the vast majority of which have absolutely nothing to do with javascript.
While I believe you are correct in that supporting more languages by won't fix the issues people have with developing for it as they would really want the APIs/frameworks for those languages and in that regard compile to JavaScript tools would better serve them since the only secure way to give developers multiple API's to work with is through a translation tool.
But several people seem to insist that's a poor solution. It sounds like they want direct support for other languages in the browser but how can they securely directly support other languages?
Yes, wanting some other language in the browser is a very common wish on hacker news. It's just completely and utterly impractical in real life.
Even if you found some way to get some other language into the browser without translating to javascript; (and this has been done before. remember vbscript?)...
the new guest language has to co-exist with any javascript that might also run on the page, share the same memory, share the same dom objects, share the same GC, and avoid all the multiple potential nasty browser crashing bugs that could result from trying to do that. And you have to ship the runtime for that language along with the browser, or as sigh another plugin. And guess what, no backwards compatibility.
Given that, you then have to cope with the fact that javascript's GC might not totally make sense for your language, and do all the workarounds that requires.
Compiling to ASM.js gets around this by essentially giving you a low level VM whose bytecode just happens to look like javascript, and whose behavior when interpreted as javascript happens to be correct. When run in firefox, the code is short circuited and ahead-of-time compiled. It doesn't have to deal with the javascript GC since it allocates a heap for the guest program ahead of time as well.
This is really cool if you think about it. You get javascript's more or less secure sandboxing, you get access to all the apis, you can interact just fine with existing javascript libraries, with about the lowest amount of overhead you can get just short of the NaCl approach (which is basically just a revisit of activeX)
The only downside to all this:
it's not the web.
This is not web. It runs in a web browser, but it's downloading a blob up front, ahead of time compiling, and playing a raw executable inside a browser host.
There's considerable advantages to zero-install programs and games. But you know, exchanging one kind of opaque inaccessible blob in a webpage for a different kind that just happens to not need plugins is not that great.
Accessibility is a good thing, and we shouldn't be too eager to throw it away for the shiny.
