WebKit

Like, I think we used to sometimes think the way to get the best possible design is do the most review, and I think what we found is review is useful, um, but not as useful as actual experimentation, actually trying things in the wild, especially with real custom- Um, and so the best way to find product market fit and good API design, I think we've learned kind of painfully from some failed experiments, is to actually let people try things and learn from where it doesn't work and, and work really hard to shorten your feedback cycle time.

Um, and so this is what WebKit prefixes, not just WebKit, but Moz and, you know, prefixed APIs were designed to be that.

Let's have a, you know, a, a low overhead way of shipping out some ideas that people can try, um, but we won't really bake them into the web until we really understand them.

Um, and, you know, as many people know, that kind of failed miraculously in, in...

But, like, we really struggled with that tension, and that my recollection, I'm sure there's multiple people have different stories on this, but let me just tell you the story I remember from, uh, starting.

And I, I gotta credit, again, I'm sure lots of people deserve some credit, but I'm gonna credit Jacob Rossi from the Edge team.

Uh, I remember a TPAC in, um, in, uh, near San Francisco Airport, uh, I think it was 2014 TPAC, and it was one of the breakout sessions, and Jacob proposed a breakout session to talk about this problem, uh, what do we do about prefixes? So shortly after Blink forked from WebKit, and we had said in, we had said that, like, we weren't gonna be doing prefixed APIs anymore, um, we were gonna, like, focus on the standards path, and Jacob was really pushing this, well, how do we, how do we actually give ourselves a tight feedback loop? How do we make it safe to fail? It's something Alex Russell talks about a lot, is you want to get a tight feedback loop and great API design.

You want to make it really cheap to fail, 'cause most ideas are bad ideas.

13 malicious theme packages on Packagist inject JavaScript into every site that installs them.

And on unpatched iPhones, that script runs a WebKit chain that installs spyware.

Audit your composer dependencies and get managed phones current.

16.

Once you land onto a page, and it's because it's a one-click exploit, once you land onto a page, it then executes and exploits on iOS devices.

It exploits the WebKit vulnerability.

Now, the WebKit vulnerability leverages what's called just-in-time, and just-in-time is a JavaScript compilation.

Basically, what happens is Apple has decided that they were going to keep this door open because they want web pages to load faster for a better end user experience.

But what it does is that it bypasses the need for checking to see if the code is malicious or not by just rendering the code.

Yeah, absolutely.

So listen, Lockdown mode is useful, but it's all about timing, right? So earlier I explained JIT, which is just in time.

It's a JavaScript compilation capability that is leveraged by the WebKit.

All our current software is powered by open source.

And I believe that's the biggest unfair, like companies like Microsoft, Apple, like Chrome built on top of the WebKit, which was built by Apple.

They redo the KHTML from Linux KDE project, which was created by, was open source project.

All the web now powered by open source project.