A Ten-Day Language That Still Runs the Web

Lex Fridman opens with Brendan Eich as the creator of JavaScript, co-founder of Mozilla, and CEO of Brave Software. Eich did not program much in high school. A friend had a Commodore PET; after *Star Wars* they tried a BASIC animation of the Death Star trench run, and Eich mostly helped with the math. What he actually loved were the HP RPN calculators of the mid-1970s — heavy, scientific, built like gold bricks. He aimed at physics, read a lot of science fiction, and then noticed that warp drives were not arriving on his timetable.

At Santa Clara University he hacked on computers while studying physics and dodged the engineering department's Fortran-on-punch-cards course. Pascal was the turning point. It was wordy Algol-family code that distinguished functions, which return a value, from procedures, which do not — old-fashioned structured programming, but it taught him procedural abstraction. Niklaus Wirth, Pascal's creator, was a writer and teacher whose courses asked students to build a computer, a compiler, and an operating system from scratch. Eich also wanted Unix on homemade hardware. He chose National Semiconductor's 1632, a complex-instruction chip that never came up cleanly. RISC won. The lesson stayed with him: a beautiful technical pick is worthless if the platform never ships.

After three years he left physics for math and computer science because Silicon Valley was going go-go for the Apple II and the IBM PC, while theoretical physics, in his view, had drifted into untestable models. He spent seven years at Silicon Graphics, then followed a friend, Jeff Weinstein, to MicroUnity, a 1990s super-startup trying a new fab, analog and digital circuits on one huge chip, and a software-upgradable set-top box. Jim Clark later needled him with the multiplication principle: ten 10-to-1 bets is one in ten billion. MicroUnity did not work. It did give Eich compilers, protocol stacks, and memory models he would need at Netscape.

Eich passed on Netscape in 1994 and joined in April 1995, in time for the August IPO that kicked off the dot-com era. Mosaic, in 1993, had been the rock in the road. Until then his stack was email, Usenet, FTP, and the old internet protocols. Marc Andreessen mailed a list saying pages should hold images; Eric Bina had already written the code. Tim Berners-Lee later told Eich they had another way of doing it. It did not matter, because Mosaic shipped. That convinced Eich of a networked-world law: getting on first matters more than being right, the same survival logic Richard Gabriel framed as "worse is better" in the Unix-versus-Lisp fight. The New Jersey farmers beat the MIT cathedral.

Netscape's browser had already taken Mosaic's market with images, tables, frames, and plugins, but pages were still dead documents. Management wanted a programmable browser. Eich had been recruited to put Scheme in it — Guy Steele and Gerald Sussman's elegant dialect — and he still jokes that the slide is Bruce Willis crawling through the *Die Hard* vents. The Sun Microsystems deal killed Scheme. Bill Joy, the Berkeley Unix and Sun founder Eich admired, wanted the Java VM in Netscape, including the 16-bit Windows 3.1 build. Microsoft had already tried to buy Netscape for too little in late 1994; Jim Barksdale and Jim Clark told them to pound sand. Then Gates turned Microsoft around, and everyone inside Netscape felt the clock speed up.

There was still room for a companion language. Joy and Andreessen had watched Microsoft's stack: C++ for expensive component authors, Visual Basic for glue. Java would be the serious compiled language for salaried experts. JavaScript would be for designers, CPAs, amateurs — a demotic way to wire components together. Andreessen liked the name Mocha; marketing tried LiveScript; the Java trademark license arrived in December 1995. There was no open req on the client team, so Netscape hired Eich onto the server team for a month of HTTP work. In early May he finally moved to the client side and told Andreessen they could not wait.

Management said make it look like Java, which from a distance looks like C: curly braces, the expression and statement grammar, even Java's bitwise operators and unsigned right shift, because Java had no unsigned integers. Primitive types — doubles, strings, booleans, objects — had to reflect between the two heaps if the languages were going to trade data. Eich insisted on first-class functions anyway. Early browsers were single-threaded; most users were not ready for mutexes; you cannot block the UI, so you need callbacks that run later. He did not want Scheme's `call/cc`. He wanted functions you could pass and return. Java would not get decent lambdas until Java 7 or 8. Event names like `onclick` came from HyperCard's on-event syntax. People still hate `onmouseover`.

Andreessen also wanted the script sitting in the page. SGML people called that heresy. A guru wrote angry mail demanding marked sections; Eich replied that marked sections were not in HTML and browsers did not support them. He hid the code from Netscape 1.1 and other old clients inside an HTML comment nested in the new `script` tag, then changed those delimiters' meaning in Netscape 2 so the same bytes were live code. He still calls it a two-way comment-hiding hack. Without it, he says, JavaScript could not have bootstrapped: Netscape 2 had no separate script files, only inlined scripts. Evolution, he likes to say, is closer to endosymbiosis than to cathedral design.

The demo window was about ten days from a Thursday evening through the next Monday. He did not sleep enough. He had no time for a garbage collector, so he used arenas — object pools — that simply ran out of memory. After the sprint he added reference counting in a hurry, because games and event-driven allocation exhausted the pools. Counting in unsafe C overflowed into leaks and underflowed into use-after-free. That was a remote-code-execution hole: stuff the heap with forged strings, underflow the count, keep a handle on the object, and call through a fake function table. Netscape 2 shipped into a season of frantic security dot-releases. The thing he is proud of from those ten days is still the first-class functions. Scheme made it in, in spirit.

In the ten days, `==` between objects of different dynamic types said no. Then internal early adopters wanted to match a number against a stringized database field. He agreed, trying to please them and drive adoption. Implicit conversions broke what equivalence the operator had left — NaN was already a mess — and people still roast him for it. That sloppiness came *after* the sprint. His tweeted lesson is that when people ask you to make a language sloppier and add a cute feature, the answer should be no. Wirth, one of his heroes, had said the essence of design is leaving things out. He did not hold the line.

He still argues that the alternative to the rush was not a prettier language. It was Visual Basic Script occupying the slot, and that would have been worse. Web compatibility then froze the early mistakes; you cannot reach back and rewrite ATP metabolism. You preserve what still works and stack new features on top, the way biology does, and the way he spent about twenty years doing inside the standards body. HTML itself is forgiving in a way XML never was. Microsoft even ran XML through IE's HTML error corrector to make it usable. Pure XML was never going to take over a web that already behaved like a living system.

User innovation helped even while he was under rigid change control. Bill Dortch's 1996 mountain-art gallery, still in the Web Archive, was a single-page app with a local object database that looks like JSON avant la lettre. People were already computing in the page and talking to the server through a hidden frame — Ajax before the name. Eich cites Eric von Hippel: throw a language to lead users, even without open source, and they will tell you what it needs to become. Java applets stayed trapped in a plugin rectangle. LiveConnect glued the heaps together, then the plugin became optional, then Sun mismanaged Java as a distribution vehicle, then Microsoft kicked it out of Windows and replaced a Java mail object in Outlook Web Access with what became `XMLHttpRequest`.

Netscape took JavaScript to Ecma International because that European body had already forced parts of the Windows 3.1 API into a standard. Microsoft sent strong people anyway, including Sean Katzenberger, who did much of the first draft and told his bosses to stop interrupting him. Sun sent Guy Steele, a giant brain with Scheme in his pocket; Richard Gabriel wrote clause 4, an introduction to what the language was. Java was a Sun trademark so aggressive it sent cease-and-desist letters to people named Jovanovic, so the standard was ECMAScript. People still say JavaScript in speech and ES plus a number for versions — a number that does not match the year. Edition 1 was finished in 1997 in Nice, over bouillabaisse. Edition 3 landed in 1999. At a late meeting Eich and Katzenberger independently spotted a fencepost bug, locked eyes, and the anger at Eich's tardiness evaporated.

Then Microsoft took the web, the antitrust case punished the company, Netscape dissolved into AOL, and the committee went quiet. A next-generation design — JavaScript 2 — went to another MIT-trained engineer and showed up only in mutated form in Microsoft's ASP stack, where it died, and in Flash as ActionScript 3. ES4, done with Adobe, tried to bring classes, types, and modules into the language. The committee split. One camp said too big, incremental improvements, no new syntax. ES4 was mothballed; ES5 in 2009 was the smaller increment, with strict mode and useful APIs. The parts people liked from ES4 were transplanted into ES6, finalized in 2015: classes, modules, arrow functions, `let` and `const`, Promises. Eich had wanted some of those functional forms since 1996. They took almost twenty years.

TypeScript, led at Microsoft by Anders Hejlsberg of Turbo Pascal, Delphi, and C#, is a superset: the shortest JavaScript program is still a TypeScript program. You add annotations file by file and get tool-time warnings, not runtime enforcement. Eich thinks that is beneficial now. Microsoft has to guess at future syntax for modules and decorators, then reconverge when the standard moves, and he thinks they have generally played fair while keeping TypeScript as proprietary control of the ball. Frameworks are a related evolutionary filter. jQuery, from John Resig, crushed the 1990s DOM — APIs designed for Java and JavaScript that took a constructor and three dances — into one line. The standards later absorbed `querySelector`. Eich's attitude is that whatever truly adds value will stick and the rest should die. Protecting stragglers only slows the ecology.

Steve Jobs banning Flash on the iPhone was the death blow, but the web still had to become competitive: video, WebGL, web audio, canvas. Mozilla's path was a typed subset of JavaScript with no new syntax. Alon Zakai's Emscripten compiled C and C++ to JS. Dave Herman, a type theorist Eich recruited from Northeastern, and Luke Wagner, the compiler engineer, codified the fast subset as asm.js. Types are casts in dominator positions in the control-flow graph. Those bitwise operators inherited from Java punch doubles into integers. A compiler that emits the operators in the right places can type-check and compile in linear time, skip the garbage collector, and hit deterministic performance. In four days at Epic they ported Unreal Engine by pressing compile. In fall 2012 they demoed it; at GDC 2013 people watched Unreal Tournament in a browser window with no plugin, no Flash, no Java, at 30 frames a second on then-current hardware.

Until that proof, people still wanted Google's Portable Native Client as the thing that would kill Flash. Eich's line is meet the new boss, same as the old boss: process isolation dressed as a plugin. After asm.js, agreement came in spring 2015 on a binary syntax that loads into the same JavaScript VM — two source languages, one compiler pipeline. That is WebAssembly. Binary matters on mobile because even gzipped JavaScript still inflates in memory so a parser can chew the eight-character `function` keyword Eich now wishes he had shortened. Fast JITs themselves were older karma: Smalltalk and Self VMs at Anamorphic, then HotSpot at Sun, then Lars Bak's V8 team in Aarhus rewriting the engine four times and hating JavaScript's quirks enough to build Dart. Mozilla answered with TraceMonkey; Apple with SquirrelFish Extreme. 2008 was the year JavaScript got fast enough that developers noticed.

Asked why JavaScript became the most popular language, Eich points at first-class functions, a C-like operator hierarchy kept simple enough, and twenty years of listening inside a single-threaded event loop. Nick Thompson wrote that Java's experts did not care about average programmers building dynamic web apps; Eich was in there doing several jobs to keep a "Mickey Mouse" language alive. People love it the way a captain has to love a ship that will kill you if you do not — *Serenity*, not a sonnet. Classes did not ruin it, he says: Smalltalk and Python have classes. The social structure is the unusual part. C++ committees are rarified grey hairs; JavaScript includes PayPal, Salesforce, and a younger crowd that does not need credentials. Fridman analogizes C++ to Wall Street and JavaScript to WallStreetBets. Eich would not overdraw it, but he likes that the language lets people in.

Distribution, Eich says, is why Internet Explorer won, not taste. Apple forces Safari too. After the IPO, Netscape management bought companies to go head-to-head with Microsoft, burned out the first-floor team, and let newcomers who had not built browsers take a turn. Netscape 4 was supposed to be 3, shipped late and Windows-first. Microsoft's versions followed the classic copy curve: one is trash, two is threatening, three tells you the ending, four is good — and IE4 came free with Windows, which is tying. They also did dynamic HTML. Ram Shriram, then Netscape's head of sales, got off the phone ashen: a customer said Microsoft would pull its Windows license if Netscape stayed the default. That bullying barely showed up in the antitrust case. Microsoft was convicted anyway, then let IE5 and IE6 rot with security bugs while others added tabs and popup blocking.

AOL's acquisition was a decent exit because otherwise Netscape was going out of business. Executives proposed an open-source escape pod: in *A New Hope* the gunner will not shoot the pod because there are no life forms aboard. Mozilla launched in 1998. The codebase was a hairball. The crypto module was an electronic munition; they could not ship 1024-bit SSL. Tim Hudson and Eric Young, outside the reach of Commerce and the NSA, stuffed what became OpenSSL into the tree — maybe the best hack of the first months. Mozilla ran as a pirate ship without a legal entity. Most people were still Netscape employees under another org chart. The first engineering manager left; Eich became acting manager, his first management stint. Mitchell Baker, the lawyer who had written the Netscape and Mozilla public licenses, came back from maternity leave and offered to manage. Jamie Zawinski quit a year in, calling the project a failure because it had not restarted the browser market. Eich says it never could have: Netscape was still shipping old code while Mozilla was tearing down to green field for developers.

They modularized with an open-source COM variant (reference counting, vtables), scripted those components from JavaScript, and built a portable UI in XUL instead of tables or XML. Dave Hyatt, Joe Hewitt, Chris Waterson, and Blake Ross — Ross still a high-school intern — did the work. In 2001 Mitchell called: she had been laid off. The next week's community call, she was still there. Paid staff, Red Hat outsiders, and Netscape employees who had come up through the community simply kept her. The weakest Netscape engineers were the ones who hated competing with better programmers in public. Loyalty, Eich says, can outrun the corporate-open-source border in a way no ordinary company structure allows.

Mozilla 1.0 in 2002 came off a roughly six-week train Eich roadmapped, the cadence browsers still use. The suite still had mail, news, and an editor, plus AOL's AIM and ICQ buttons — NASCAR badges on a race car. Hyatt and Ross extracted a browser-only app, Mozilla Browser, simpler, one job, extensions for the rest. Hyatt was the senior hacker: native Mac tabs in Camino, five iterations of a school assignment while a classmate waited for the platonic program. He left for Apple in 2001 as a founding Safari engineer and kept blogging about how to do tabs until someone told him it was proprietary. Opera had had them. Names were legal trouble. Phoenix Technologies blocked Phoenix; an Australian open-source database screamed Mad Max-style about Firebird; Firefox, a red-panda nickname, finally stuck. It shipped in 2004 into Web 2.0: Wikipedia, Craigslist, Gmail, Google Maps, JavaScript plus images dragging a map. A Microsoft engineer later told Eich on a plane they should have killed Firefox in the cradle with popup blocking and tabs. They were slow. Big-company product lines are harder to turn than a green-field browser.

The money was the default search deal. Around 2004 Sergey Brin sent Fritz Schneider; both sides saw that search and the browser need each other, which is why search engines still want their own browsers. Users rarely change a default that is not awful. Mozilla knew by 2006 that Google was building Chrome. The early demo was not the fast JavaScript engine still being rewritten in Denmark. It was the sad tab: load Flash, Flash dies, the whole browser does not. Process isolation, from a GreenBorder-influenced design, was a real security step Firefox did not yet have. Larry Page, talking about the Firefox relationship and WebKit, told Eich not to worry about Firefox — build your own browser, have your own opinion. Chrome launched softly in 2008. Firefox grew until about 2011, then fell as Chrome rose. The second browser war was still about distribution and defaults, with Firefox's largest funder also its competitor.

The Yahoo experiment showed the ceiling on default value. In mid-December 2014 Firefox switched the default to Yahoo. Marissa Mayer had talked about rebuilding search; Carol Bartz had already laid the team off toward Google and Microsoft. Users reset the default. Traffic leaked for a year. Yahoo, by the leaked terms Danny Sullivan wrote about, kept making fixed payments for traffic that was not staying. Eich's cold reading: defaults are worth money equal to user laziness, and only while the substitute is not obviously better. Any business that lives on defaults is racing the user's patience. Advice he gives founders is the same as the history: if you want to ship a language or a product, think about distribution first. IE won on Windows, Firefox on a search check, Chrome on Google's reach. That is structure, not morality.

A cookie is a little storage in the browser, keyed by site, sent back and updated on each response. HTTP in the 1990s was stateless: without a cookie you would log into the bank on every click from the confirmation page to the account view. A Netscape engineer rushed that in 1994, before Eich joined, for credentials. Images also issue requests, possibly to another server, carrying the last cookie and returning an update. A 1x1 pixel — ad tech still says "pixel" — on the *New York Times* and ESPN can assign user 1234 and build a profile. It was not the intent. By the time Eich arrived it was too late to undo. Netscape 3 made scripts able to do the same invisibly. The tracking economy, and some of the richest companies on earth, grew from those accidents. Eich's joke is that all he got was a few crappy T-shirts.

Brave started in 2015 from a blunt premise: third-party cookies, tracking scripts, and malware ads were unintended and are now unsafe, so a browser should block some of them by default. First versus third party is not "different domain." Publishers load benign scripts from unrelated hosts. Brave built a research team for mixed human and machine-learning blocklists. Apple was doing Intelligent Tracking Prevention locally around the same time. Safari's older rule — block third-party cookies from sites you have never visited — was a real privacy move while Steve Jobs was alive, and it had a hole: visit the tracker once and you are allow-listed. AppNexus had ad clicks bounce through its own domain to plant a first-party cookie. Safari closed that; Brave keeps iterating. Fingerprinting is harder. Thirty-two sites with one bit of storage each are 32 bits, four billion identifiers, a super cookie. The fight has no end state.

Speed is a side effect you can feel. Ad-tech scripts chain into a programmatic waterfall of requests. Block them and Brave is faster than Chrome, cheaper on data plans, easier on battery because the radio does less work. Google engineer friends told Eich the slow sites would fix themselves. He surveyed pages; most look like that. Google cannot take over every publisher's stack. AMP tried to bribe them with search-carousel placement and, in Eich's telling, made publishers look like guest posts under a Google URL and frame — bad for brand, and an antitrust problem besides. Privacy, for users, is not a $3 product. It is a default. Try a browser that blocks by default and see whether the page still works.

Blocking is defense. Eich wanted to reconnect the money brands and agencies already spend with publishers, minus the middle. The *Guardian* once bought its own inventory for a month, put a pound in, and got 30 pence back — 70 percent gone to intermediaries. The App Store takes 30 and leaves 70. Old cable superstations kept about 85. Fraud makes it uglier: a fake *New York Times* gets the click from a bot, the real paper gets nothing, the exchange still takes a fee. Malware rides the same pipe as JavaScript loaders in ads on real publisher pages. Brave's Basic Attention Token is a three-sided market — users, creators, advertisers. Ads are matched locally from a daily catalog with lightweight on-device learning. Brave does not see history, searches, or scroll depth. Advertisers buy anonymous attention. Seventy percent of gross ad revenue goes to the user, who can withdraw or tip sites and YouTube channels.

The first prototype ran on Bitcoin in 2016–2017. Congestion and fees made a $5 buy cost about $4.50, a miserable on-ramp even with an embedded Coinbase widget. Ethereum added smart contracts for the three-way split. Then regulation: OFAC, anti-money-laundering, know-your-customer. Brave's default does not know who the user is; revenue is imputed to the browser and steered to identified creators. Withdrawals require identity. Eich is a crypto pragmatist. Peer-to-peer without a two-day wire is beautiful, and a revenue split they facilitate still needs licenses. He wants the matching and the blind-signature impression confirmations — David Chaum's idea — in web standards so more than one browser can run the protocol. Google will standardize "trust tokens" built on the same cryptography, he says, and not use them for ad confirmation, because that would blow up the business.

If Brave somehow had 95 percent of the internet, he would demand a recount. The point is to put pieces in standards and compete on trust and on the user's deal. Patron and sponsorship already exist for creators; they are centralized, take about 5 percent, and can censor. A browser-mediated version at 3 percent would be harder to silence. He also tells people learning to code to pick several tools, not one hammer: a dynamic language for prototypes, C or Rust for metal and memory safety — he co-sponsored Rust at Mozilla because he was tired of remote-code-execution bugs — Go for server networking, Python or array languages for linear algebra. JavaScript as a first language puts something on screen fast; Python's syntax errors catch beginners earlier. If you design a language or an API, when early users ask you to loosen it, start with no.

Eich's reading of Google's innovator's dilemma is structural. Publishers are not very technical; they depend on a thicket of ad-tech vendors. Kill those scripts overnight and you torch your own customers. The Privacy Sandbox and FLoC are Googley: differential privacy noise to hide you in a crowd. Noise, he says, can be stripped over time; an adversary pulls you back out. He does not expect Apple, Brave, and Mozilla to salute and adopt it. If Google is smart, it might divest something like DoubleClick to buy regulatory peace. Antitrust is back in the U.S. and Europe. Microsoft almost split after Judge Thomas Penfield Jackson ordered a breakup without a remedies hearing; the appeals court sent it back; Microsoft settled rather than become an OS company and an Office company. The real antitrust damage, Eich argues, is years of distraction. Microsoft ran back to proprietary lock-in and Windows Vista, which flopped.

Social networks, like search, are a centralized algorithm over a friend-of-a-friend graph. You should own the relation and the posts. His unbuilt idea: the browser already sees every network you use; it could keep the graph, merge Facebook and Twitter friends into one view, and still find someone if they are banned on one platform and alive on the other. Browsers were captured by central powers mainly through search. Larry Page said years ago that handing over the query was a privacy trade for better results, a good deal early and a worse one after Google crowded its own page. Eich thought Parler's deplatforming was egregious and selective: Twitter is full of violent threats and did not lose its servers. It looked like insiders removing a newcomer, "sort of like the hedge funds shorting GameStop." He is not a no-moderation absolutist. Wave the free-speech flag hard enough and the worst people colonize the product and kill the business. What he wants is user-first subsidiarity: you compose your own networks and the cost of a ban or a move stays low.

Netscape was already dead, or AOL-dead, by the time the U.S. v. Microsoft remedies landed. Mozilla, not the judgment, put a browser back on the field. Tools that let users own friendships and route around takedowns matter more, in his view, than waiting for a breakup that arrives after the window has closed. A few percent opting out is enough. That is the same stubborn-minority story as Firefox, as public blockchain, as the WallStreetBets squeeze he reads as hackers against oligarchy — Hegel's cunning of reason, not street warfare.

Fridman asks whether he would still start in Silicon Valley. Eich arrived as a teenager in 1976. He thinks the Golden State is in crushing lockdown debt, with the highest taxes, unmanaged forests that burn, unplanned roads, and trolley rights-of-way in Los Angeles that oil, auto, and rubber interests helped erase — Elon Musk going underground because the surface corridors are gone. Housing is not getting built. The magic was freedom for young people to try bold things despite the costs, plus Stanford, angels, and a federal story that includes ARPANET, not a libertarian fairy tale. Fabs left; labor and environmental arbitrage sent manufacturing where laws were cheaper. Remote work first delighted Googlers who would not have to move for a team change, then the other shoe: keep the Midwest hometown, lose the Bay Area pay. Geographic arbitrage moved from the company to the worker. He expects more mobility and smaller valleys in Austin, Miami, and elsewhere, not a clean end of civilization. America, he says, is a commercial republic of thirteen colonies and leftover subsidiarity, however eroded.

Does he think about mortality? Not much. He is a Roman Catholic and not afraid of death. He understands people who are — missing a faith that death is transcended, or childless, or late and sure they missed the work that endures. He quotes Terence: nothing human is alien to me. Legacy is children and grandchildren first, then web standards, Firefox, and Brave, which he will not oversell. Brave's claim is that you can keep proving, for decades, that a few percent of lead users can tilt a market the moneyed interests did not want opened. Firefox already showed the browser market could be restarted when everyone said it could not. You do not need everybody. You need stubborn minorities. That, for him, is an American pattern that is not a hard revolution: rights and duties, pragmatic until the oligarchy gets abusive, then a minority willing to put life, fortune, and sacred honor at stake. A little code can still change the world.

The practical residue of the three hours is the same test he used in 1995. Can users see a result immediately, and can the thing survive in the installed base that already exists? First-class functions in a single-threaded browser mattered more than pretty syntax and more than the equality operator he regrets. Those ten days are still running in every device with a web stack. Ugly, early, and on the first ship still beats the cathedral that missed the window. Design's hard move is refusal. Distribution's hard move is owning a default long enough to matter, then not depending on a patron who is building your replacement. A healthy ecology culls. A few percent who opt out can still move the cost structure of the rest.