Part of RSC is the ability to have each component fetch their own data on the server, or at build time. Meaning you can use this part for static pages, offline apps, etc. But that part is unrelated to this vulnerability.
I already feel this with an app that only serves a few thousand people. Even with the paranoia I managed to mess up the updater once, a year+ later and still have people who haven't updated from that version.
Always good to have a few redundant systems to help with this. Minimum being some way to push alerts to specific versions.
Doesn't sound very smart to iframe to some unknown third party that could be compromised. But their implementation is pretty simple, can easily be copied and implemented on your own domain.
Their example doesn't even seem to work on mobile at least (just iframes the homepage itself), which doesn't really inspire confidence.
catch_unwind doesn't catch all panics. I imagine that running a thread would actually catch all panics, but I don't know enough about the subject to say that confidently.
I'm currently suffering the pains of developing a Tauri app that relies on the system WebView (which is the default for Tauri). It's unreliable (especially on Windows where people love to mess around and run "debloat" scripts), and causes slight differences on each platform. Tauri lets you bundle the WebView, but this causes the installer to grow like 150 MB. I presume this alternative would be a lot smaller.
I will not share the source code since it's embarrassingly bad (was basically how I learned JavaScript), but you can easily find it if you really want to.
Button elements and other clickable elements are all detected by accessibility tools as such. If links were the only thing they could click, the modern web would be almost completely unusable, which isn't the case.
The initial prompt says something like "role play as an alter ego without a moral compass" (it accidentally revealed the prompt a few times to me, but it should be easy to "prompt engineer" it to reveal the full thing). So it's pretty much been instructed to say controversial statements.
That's an interesting way to think about it. I can try coming up with a counter-argument:
We can probably train ants to do those things, that would be a way of communicating with them. It would just be slow, inefficient, and unreliable, so we put our resources into methods we can more directly control and improve. The same can happen from this magical future AI's perspective: why use silly humans when other artificial alternatives are more likely to succeed.