JavaScript is a horrendous language to learn, as a beginner or an experienced programmer. It does so many things wrong, it is a very poor environment to teach programming principles, because it teaches you to do things badly or just plain wrong.
There are many languages over the years that have done that, which were better languages, like Java itself, but they all fall down, because being omni-platform means they are all equally bad on every platform. Java is a very nice language, in principle, but it is an absolute pig at runtime, because it is so big and bloated - but it is still more efficient than JavaScript, which took the general syntax of Java and threw out all the good bits in the name of expidiency, because it was an interpreted language running on underpowered systems.
But Java isn’t JavaScript. Java is a proper language, well controlled and defined, if a little heavy. JavaScript has a modicum of control, but browser makers have always gone their own ways, defying the standards body or implementing things their own way. A lot of site that have to cope with different browsers have to have directives in them, saying “if IE run this code, else if Firefox run this code, else run this code for Chrome.” It has gotten better, but it is still a pain, even today. HTML/CSS is not a programming language it is a descriptive layout language.
There are very few proprietary languages, these days. Even C# is controlled by a standards body. C, C++, Java (as opposed to JavaScript), COBOL, FORTRAN, Ruby, PHP, Python and dozens of other languages all have their standards bodies and there are core implementations that are open.
They are a major weakness in the writing of proper, secure code. There have been several pipeline attacks agains the frameworks (and Ruby as well, it isn’t just JavaScript that is a security nightmare) in recent months.
The frameworks are so complex and intermingled, that a security flaw somewhere flows through the whole framework. Finding the maintainer is difficult and not everybody uses the latest code and those that use the code rarely bother to perform tests on it, because they assume that it has already been thoroughly tested and any changes added are controlled. This is a dangerous, and false, assumption, as has been oft demonstrated, especially in recent months, with code being slipped in to attack Russian developers, for example.
I’m not saying attacking Russian developers, in the current situation, is good or bad. The point being, the attacks could easily be targeted at American developers, Christian developers, Muslim developers, anyone who the writer of the module has a grudge against.
If a developer walks away from his module, nobody is left to maintain it and ensure it works properly, but it is still used by millions of websites. Again, this problem has cropped up a few times in the last 12 months, with modules suddenly stopping working and bringing the rest of the framework crashing down with it.
With controlled projects, with proper testing and controls, with finished code being thorougly tested, before it can be released, this is less likely to happen and problems will be flagged up earlier. These JS frameworks are called in real time, if someone posts faulty code, it is diseminated very quickly, with no central control on its release.
On the other hand, some sites make local copies of the frameworks and don’t update them, when severe security vulnerabilities are disclosed, leaving their sites vulnerable.
There is no perfect way of doing this, even in other languages, but the current situation of websites being written by inexperienced programmers with no experience about writing secure code, using frameworks and libraries on blind trust is a recipe for disaster.
This is a fundamental issue for the industry as a whole, but the proliferation and lack of control in JS, along with its very poor security credentials means it is a huge risk for everyone. This is one of the main reasons why Crockford was saying JS needs to be replaced by a modern language, designed to cope with modern problems - especially security - and building on the lessons learnt about everything wrong with languages built 20-30 years ago.
JavaScript isn’t full stack, though, it still needs HTML and CSS, and it still needs a back-end written in a suitable language.
JavaScript is fine for quick and dirty programming for simple solutions, but it really isn’t the sort of language that is really suited to modern, complex web frontends.
I say that as a developer with over 40 years of experience with languages from direct machine code, through various assembly languages, DCL, bash, REXX, AREXX, BASIC, COBOL, FORTRAN, Forth, Brainfuck, 1-2-3 Macros, Excel Macros, 4th Dimension, Pascal, Delphi, BCPL, C, C++, C#, ObjectiveC, Swift, VisualBasic, VBA, VBScript, SQL, Java, JavaScript, Ruby, Python, PHP and many others I can’t remember off hand.
All languages have their good points and their bad points. Some languages are fun, some useful for low level, fast and efficient acces, others for quick prototyping, but not for complete systems. JavaScript was a quick and dirty language, knocked up in a week as a proof of concept and released by Netscape against the developers will, as he believed it was incomplete. It has been continually patched up to get it working better ever since.