3 ms·

my argument is that there should be no need for the average user to install noscript to prevent injection from third party "secure" domains. the default should

my argument is that there should be no need for the average user to install noscript to prevent injection from third party "secure" domains. the default should be to deny loading them in the first place. there should be a "yesscript" for those who want to assume the risk.

pdkl95 11y ago
I completely agree - Javascript is cool, but it's also a security risk that needs to be limited. For the moment, unfortunately, we're stuck running noscript (or similar).
Silhouette 11y ago
But how do you know which resources from a separate domain are third party ones, and which are from (for example) a dedicated CDN run by the same people who operate the site you're visiting and fundamental to its normal operation? For now, there are still performance-related reasons you might want to do this, and many high volume sites do.
- pdkl95 11y ago
  You don't know - which is why javascript needs to be whitelist-only, no exceptions. > performance-related reasons Security is always more important than performance. It's irresponsible to sacrifice security simply to make page loads faster. Some of these problems can be worked around in the future with authenticated hrefs (such as with a hash-check aka subresource integrity).
  - Silhouette 11y ago
    Security is always more important than performance. It's irresponsible to sacrifice security simply to make page loads faster. And where does functionality fit in, in your black and white world? It's easy to make a lot of things perfectly secure, but if in doing so you give up the essential functionality that made those things useful in the first place, what have you really achieved? If you make JS whitelist-only, no exceptions, then you will break the web for huge numbers of people on huge numbers of sites they value, because JS is useful. Those people aren't going to thank you for keeping them safe, they're going to say your browser doesn't work, and then they're going to use someone else's browser that does work instead. In reality, security is nearly always a sliding scale, and the best results are nearly always achieved by balancing security against other factors like performance and functionality to keep the user as safe as possible while still providing whatever it is they actually want.
CaptSpify 11y ago
There is a yesscript! https://addons.mozilla.org/en-US/firefox/addon/yesscript/ https://addons.mozilla.org/en-US/firefox/addon/yesscript/ But your point stands. That should be done in the browser by default
- leeoniya 11y ago
  except it's kinda pointless because it does exactly what noscript does - it selectively blacklists specific scripts. the desired behavior is: when on https, auto-blacklist everything except current and sub-domains.

pdkl95 11y ago

I completely agree - Javascript is cool, but it's also a security risk that needs to be limited. For the moment, unfortunately, we're stuck running noscript (or similar).

Silhouette 11y ago

But how do you know which resources from a separate domain are third party ones, and which are from (for example) a dedicated CDN run by the same people who operate the site you're visiting and fundamental to its normal operation? For now, there are still performance-related reasons you might want to do this, and many high volume sites do.

pdkl95 11y ago
You don't know - which is why javascript needs to be whitelist-only, no exceptions. > performance-related reasons Security is always more important than performance. It's irresponsible to sacrifice security simply to make page loads faster. Some of these problems can be worked around in the future with authenticated hrefs (such as with a hash-check aka subresource integrity).
- Silhouette 11y ago
  Security is always more important than performance. It's irresponsible to sacrifice security simply to make page loads faster. And where does functionality fit in, in your black and white world? It's easy to make a lot of things perfectly secure, but if in doing so you give up the essential functionality that made those things useful in the first place, what have you really achieved? If you make JS whitelist-only, no exceptions, then you will break the web for huge numbers of people on huge numbers of sites they value, because JS is useful. Those people aren't going to thank you for keeping them safe, they're going to say your browser doesn't work, and then they're going to use someone else's browser that does work instead. In reality, security is nearly always a sliding scale, and the best results are nearly always achieved by balancing security against other factors like performance and functionality to keep the user as safe as possible while still providing whatever it is they actually want.

CaptSpify 11y ago

There is a yesscript! https://addons.mozilla.org/en-US/firefox/addon/yesscript/ https://addons.mozilla.org/en-US/firefox/addon/yesscript/ But your point stands. That should be done in the browser by default

leeoniya 11y ago
except it's kinda pointless because it does exactly what noscript does - it selectively blacklists specific scripts. the desired behavior is: when on https, auto-blacklist everything except current and sub-domains.