4 ms·
w.r.t Firefox I use a plugin these days called NoScript.[https://addons.mozilla.org/en-US/firefox/addon/722 https://addons.mozilla.org/en-US/firefox/addon/722]
by nishantmodak 17y ago
w.r.t Firefox I use a plugin these days called NoScript.[https://addons.mozilla.org/en-US/firefox/addon/722 https://addons.mozilla.org/en-US/firefox/addon/722] - Allows active content to run only from sites you trust
Finding it very useful!
- tptacek 17y agoNoScript is great, and it may reduce the attack surface of your browser, but it's not a panacea. If you look at the history of browser attacks, they're not overwhelmingly Javascript-based.
- invisible 17y agoBut it does reduce popups to 0, which reduces those fake "you have 5 viruses! Scan now" programs that fill up the whole screen (and probably cause a portion of malware).
- tptacek 17y agoAgain, just to be perfectly clear: assume that any time you browse with any mainstream browser to any malicious website, your browser could probably be popped. Especially if your adversary can bankroll $100,000-$200,000 of security research. That's the number I'd put on this attack. Maybe a reliable IE clientside bumps the number up north of $200,000, because folk wisdom puts the actual value of a reliable IE in the six figures. I don't know. I know what a year of time from someone who can find these bugs costs.
- julio_the_squid 17y agoThe equivalent salary for a top-notch engineer in China is about 12-25% of the US rate, however.
- tptacek 17y agoThat does not necessarily imply that Chinese vulnerability researchers are proportionally cheaper... yet.
- mscarborough 17y agoExcept we don't know who did this work, the research could have been done anywhere.
- tedunangst 17y agoAre there NoPNG and NoGIF and NoHTML plugins too?