Ecmascript was made to standardize JavaScript, but it isn't based on JavaScript. Actionscript is then based on ecmascript, making Actionscript a sibling to JavaScript, not a subset.

Arbitrary code execution is a vulnerability where you write and execute arbitrary code outside of the intended environment

Just because Actionscript is a language doesn't mean it has the functionality to do whatever to your machine. It lacks most of those functions because it is mostly a graphics library. It would have to run an already prepared external script via some improper memory pointer somewhere for it to be arbitrary code execution.

And Actionscript is not built on top of JavaScript. Both JavaScript and ActionScript are based on ecmascript. They are different, just like Typescript and JavaScript are different.

Actionscript was object oriented and had proper types unlike JavaScript which to this day is one of the worst programming languages.

Are you sure I'm the one misunderstanding the problem of evercookie? Was the problem that you could access the same cookies from multiple browsers because of ActionScript, or was it that evercookie maliciously restored said deleted cookies after they were supposed to no longer be used? One is a feature that allows transferring sessions between browsers on the same computer. The other is essentially malware.

Flash didn't allow arbitrary code to run. It had a very limited scripting language (which design-wise is superior to JavaScript, by the way) to control canvas elements and playing sound. You couldn't execute programs on your computer.

If by late you mean right before action script 2. I was making flash games back then and I remember it being unable to access virtually anything without first triggering a prompt, which you could disable by right clicking, and going into properties.

Your legitimate concerns about JavaScript are blockable by the browser.

Yes, through NoScript. And it should be blocked, not blockable.

It is funny you mention evercookie because that was a JavaScript library, and affected all cookies, not just flash cookies.

Flash cookies being sharable between browsers was bad, but you could still easily clear those cookies, that is until a certain JavaScript library started restoring them automatically.

You really can't. If it was only HTML and CSS, any accessibility program would be able to select any part of the page, and easily alter the CSS and HTML. That is next to impossible now because of JavaScript.

It shouldn't be up to the website developer. It should be up to the browser developer. You don't blame a lemmy instance for poor accessibility with Jerboa.

We still use plugins. In fact you most likely have one installed right now for video encoding. JavaScript not being a plugin is the reason we only have two major browser cores. Chromium and gecko. JavaScript prevents new browsers from entering the ecosystem due to how hard it is to implement unlike how easy it would have been as a plugin.

Flash had vulnerabilities because of neglect from adobe. The core design of flash and its earlier stages made by Macromedia were great. It had a sandboxes environment, and later it even was integrated into a browser sandbox just like JavaScript, eliminating most vulnerabilities.

Flash was very limited in the malicious code it could run, as opposed to JavaScript which can automatically redirect you to malicious websites, install tracking cookies, access the browser canvas to install tracking pixels, freeze your entire browser, take control of your cursor, look at your entire clipboard history, collect enough information about you to competely identify and track your footprint over the entire internet.

Flash couldn't access your clipboard or files unless you clicked allow every time, couldn't access anything outside of its little window, and if it froze, the browser was mostly unaffected, and flash had almost no ability to collect any data about your browser.

Accessibility is orthogonal to JavaScript if the site is being built to modern standards.

In other words, accessibility is in the hands of the developers, not the visitor. And the developer really wants that scrolling background and non-selectable text, so tough luck, people with no hands, I guess.

It takes 2 clicks to get a website to work. It took a few minutes for me to get all my most commonly visited websites to work. And you can backup and restore so it takes a few minutes to sync the customization to all devices.

Flash was containerized, and completely safe until adobe just stopped supporting it. A million times better than what JavaScript has become in terms of privacy. There is a reason noscript is bundled with Tor.

And preference is definitely a reality. It is niche at the moment but I see a future where more and more people see JavaScript for what it is. Bloat.

I've been using noscript for years. I don't even have to open up the blocklist anymore because I've successfully unblocked only the necessary scripts on all sites I ever visit. I get no trackers, no bloat, no google analytics, no Facebook, no microsoft, no ads, and no adblocker notifications.

Drink verification can