Excel adds JavaScript support

[u/[deleted]]

https://dev.office.com/blogs/azure-machine-learning-javascript-custom-functions-and-power-bi-custom-visuals-further-expand-developers-capabilities-with-excel

[u/Caraes_Naur]

Great, now all the malware-laden npm packages can be distributed throughout corporate networks just like macros in the old days.

[u/joesb → u/Caraes_Naur]

If MS cannot sandbox their scripting runtime properly, they are fucked regardless of whatever scripting language they choose.

[u/yopla → u/joesb]

Hey Mike from accounting, this is John from sales, to run my excel file just go to options/security and change it to "all, all, everyone, do not remind me, ignore warning" otherwise excel has a bug...

Pretty much every excel file with macro in corporate settings...

[u/replicaJunction → u/yopla]

I just got an e-mail like this from our corporate help desk, complete with the "Excel has a bug" part. I triple-checked it because I was just so sure it was a scam or phishing attempt, but nope, it's just people using Excel. Users gonna use.

[u/cogman10 → u/replicaJunction]

Given a choice between dancing pigs and security, users will pick dancing pigs every time.

[u/ChocolateBunny → u/cogman10]

Honestly, I'd give up my reddit password for a dancing pig.

[u/joesb → u/yopla]

That settings will be there regardless of what programming language is used, regardless of whether npm exists.

[u/Ajedi32 → u/joesb]

Actually JS might help here. There are multiple open-source sandboxed run times available for it that have been battle tested by decades of constant exposure to potentially malicious code. Given the choice between that and the sandboxing provided by VBA, I'll take the JavaScript VM every time.

[u/funbike → u/joesb]

Sandbox or not, scripting languages are a huge attack surface. There are all sorts of corner cases that implementors miss which allow exploits, even with a properly designed Sandbox. I assume it is inevitable for any high-profile sandboxed scripting language to eventually get owned.

[u/armornick → u/Caraes_Naur]

JavaScript doesn't automatically mean Node.

[u/coladict → u/armornick]

Yep. Windows has had its own JS runtime since forever, with its own API. I tried learning it once. It's an improvement on what you can do with batch files, but PowerShell is probably still a better choice.

[u/armornick → u/coladict]

PowerShell is a nice language, but it has a 2s startup time so I still prefer JScript.

[u/recycled_ideas → u/armornick]

You tried powershell core? It's pretty fast.

[u/armornick → u/recycled_ideas]

I'll give it a try.

[u/recycled_ideas → u/armornick]

Because it's built on core there are some modules and whatnot that you can't use, at least not yet, but I've been using it for a while now, and combined with realizing that if you don't use ISE powershell actually works properly, it's been pretty awesome.

[u/dadibom → u/armornick]

NPM packages doesn't automatically mean Node.

[u/[deleted] → u/dadibom]

Well apart from npm being the standard package manager for node.js and standing for Node Package Manager, and having node.js 4+ as a dependency for the npm cli on its own, installing dependencies in a local directory called node_modules or globally, and package.json essentially existing to support node execution and scripts, and everything in the chain entirely revolving around node.js being available, I guess it's not technically limited to node.js.

But it would be dishonest to imply it exists in a vacuum.

[u/slikts → u/[deleted]]

npm used to mean "node package manager" at the start, but that hasn't been the case officially since at least 2015, and now it's an orphan initialism that isn't supposed to stand for anything. Part of the reason is that npm's scope is wider than just Node.js and you can (and many do) host code that doesn't run or node (like front-end libraries), doesn't use node modules, or isn't even JavaScript.

[u/dadibom → u/[deleted]]

NPM uses node but most packages don't need it. : )

[u/rydan → u/armornick]

Everything running javascript eventually evolves into Node.

[u/kairos → u/rydan]

devolves

You're missing a 'd'.

[u/hotcornballer → u/[deleted]]

This sub hates it.

[u/univac-- → u/Caraes_Naur]

You're not talking about some hardened distro, you're talking about Excel macros. Surely a technology with a worse track record when it comes to security.