3 ms·
This is a great point, and something I often wonder about as well. I think it's reasonable to think that only a compromised site or site run by someone with ill
by haswell 11y ago
This is a great point, and something I often wonder about as well. I think it's reasonable to think that only a compromised site or site run by someone with ill-intent would pose any real risk. And in such a scenario, it's going to get out pretty quickly that the site is compromised/dangerous.
While this doesn't help that theoretical set of initial victims, it just doesn't feel like a credible risk worthy of too much worry, especially for information from higher profile sites with reputable backing.
Perhaps the solution here is better mechanisms for validating what a script can do - "script is attempting to access xyz, allow? y/n".
- jeffcox 11y agoLittle Snitch serves this purpose to some extent on OS X. If the malicious hidden script invoked a remote server I'd get a popup asking if I would like to allow it.
- hueving 11y agoAssuming the script didn't inject malware in a way that allowed traffic bypassing little snitch.
- stcredzero 11y agoAnd in such a scenario, it's going to get out pretty quickly that the site is compromised/dangerous. If a perpetrator is smart, the malicious script is going to be hidden a few invocation layers deep, and will only remain up for short intervals. A naive or stupid perpetrator is going to get caught quickly. But the medium is such that a smart one can hope to evade detection.