5 ms·

I use NoScript, which disables scripting (JavaScript and Flash plugins) by default in Firefox, but allows me to easily enable it for scripts which come from the

I use NoScript, which disables scripting (JavaScript and Flash plugins) by default in Firefox, but allows me to easily enable it for scripts which come from the domain of the site, or for all scripts on the page. My general policy is: if I'm linked to an article, I should be able to read it without enabling JS. If I'm linked to a video, I should be able to watch it only enabling the Flash plugin. If these assumptions are violated I become offended and I usually press Back, unless I have a very good reason to need to see that content. I am not offended by web applications which require Javascript, as long as they're linked to by a source I trust. I won't enable Javascript for domains which I know only serve ads. I also won't enable Javascript if I think I'm on a "sketchy" page -- a page which I believe might have malicious code.

roryokane 16y ago
You’re saying you won’t enable JavaScript unless necessary. But why? What are you afraid of JavaScript doing? Issuing an endless supply of alert boxes? Changing the background color of the page every second? Slowing your computer to a crawl with an infinite loop? I don’t know any sites that do that. I know JavaScript can be used to facilitate the display of ads, but AdBlock can handle that without blanket disabling JavaScript. What’s the worst that JavaScript might actually do, based on the sites that are out there?
- theycallmemorty 16y ago
  There are more subtle ways to be annoying with JS these days. eg. Popping up a new window every time you highlight some text in an article. Or slowing the page load down while it highlights the key words on the page and turns them into annoying semi-popup links.
- lincolnq 16y ago
  Every browser exploit in the last few years that I've heard about requires Javascript enabled, except for history sniffing trickery.
  - m0tive 16y ago
    This is the main reason I also use NoScript. Just today I saw two very tech savvy friends get caught out by a Facebook clickjacking attack. With javascript off on untrusted domains, it didn't work for me.
  - sant0sk1 16y ago
    Wasn't there a recent study that concluded that Flash was the source of over 90% of all vulnerabilities last year?
    - lincolnq 16y ago
      I'm not sure, but NoScript also blocks Flash for me, so the outcome is the same.
    - angelbob 16y ago
      Sure, but Flash is also straightforward to disable. It's not even installed by default in most browsers.
    - code_duck 16y ago
      Flash and Acrobat were in the top 5, but I don't think Flash can take credit for a full 90%.
- india 16y ago
  For me it's mostly sites tracking way too much information at my end. It just creeps me out. Consider the kind of information tracked by google[1]. There is no way to dodge stuff like that other than noscript. [1] http://entertainment.slashdot.org/comments.pl?sid=629659&cid=24399331 http://entertainment.slashdot.org/comments.pl?sid=629659&#38...
- jessor 16y ago
  XSS should be noted here, too.
- bd 16y ago
  What’s the worst that JavaScript might actually do, based on the sites that are out there? I'm using NoScript since I barely escaped from being infected by quite sophisticated malware few years ago. Innocent site (local public transport) had had injected single malicious line into its content management system (most probably after untargeted "fishing for vulnerabilities" botnet scan). This one line was JavaScript include which in turn triggered series of jumps to servers all over the world (mostly China and Russia). In the process, multiple layers of heavily obfuscated JS code were both loading hidden frames loaded with ads (presumably for click / impressions fraud) and trying to load hidden PDF embeds which contained a payload of hidden executables for infecting your local computer (exploiting Acrobat Reader security holes). I only found out because Acrobat is such huge resource hog that I noticed and managed to kill it in a task manager before it finished loading. I was using up-to-date Firefox and up-to-date antivirus AND I had disabled Acrobat plugin. Upon inspection, malicious code appeared to be cross-platform and multi-target, using vendor specific JS extension. I remember besides Acrobat it was also targeting Silverlight (and this was in time when it was very new technology).
- adamdecaf 16y ago
  Infecting malware, exploiting holes in the browser, storing data via local/session/appCache, tracking me (google analytics), loading flash, displaying ads, redirecting me to see an ad before the content... The list goes on and on, sure you can do most of these without javascript, but by that point I've moved on and blacklisted your site. Is it better to be overly secure, or underly secure?
tcdent 16y ago
If I'm linked to a video, I should be able to watch it only enabling the Flash plugin. You do realize that due to a patent ruling a few years ago, these days almost all Flash content is placed after load with JavaScript to circumvent ActiveX's click-to-interact restriction. How often are you able to enable only Flash to view your content?
- lincolnq 16y ago
  Not often. But I can usually enable scripting for only the domain where the video is served (youtube.com) and then enable the one instance of Flash which looks like the content.
ciupicri 16y ago
What happens with libraries downloaded from the Google mirror?

roryokane 16y ago

You’re saying you won’t enable JavaScript unless necessary. But why? What are you afraid of JavaScript doing? Issuing an endless supply of alert boxes? Changing the background color of the page every second? Slowing your computer to a crawl with an infinite loop? I don’t know any sites that do that. I know JavaScript can be used to facilitate the display of ads, but AdBlock can handle that without blanket disabling JavaScript. What’s the worst that JavaScript might actually do, based on the sites that are out there?

theycallmemorty 16y ago
There are more subtle ways to be annoying with JS these days. eg. Popping up a new window every time you highlight some text in an article. Or slowing the page load down while it highlights the key words on the page and turns them into annoying semi-popup links.
lincolnq 16y ago
Every browser exploit in the last few years that I've heard about requires Javascript enabled, except for history sniffing trickery.
- m0tive 16y ago
  This is the main reason I also use NoScript. Just today I saw two very tech savvy friends get caught out by a Facebook clickjacking attack. With javascript off on untrusted domains, it didn't work for me.
- sant0sk1 16y ago
  Wasn't there a recent study that concluded that Flash was the source of over 90% of all vulnerabilities last year?
  - lincolnq 16y ago
    I'm not sure, but NoScript also blocks Flash for me, so the outcome is the same.
  - angelbob 16y ago
    Sure, but Flash is also straightforward to disable. It's not even installed by default in most browsers.
  - code_duck 16y ago
    Flash and Acrobat were in the top 5, but I don't think Flash can take credit for a full 90%.
india 16y ago
For me it's mostly sites tracking way too much information at my end. It just creeps me out. Consider the kind of information tracked by google[1]. There is no way to dodge stuff like that other than noscript. [1] http://entertainment.slashdot.org/comments.pl?sid=629659&cid=24399331 http://entertainment.slashdot.org/comments.pl?sid=629659&#38...
jessor 16y ago
XSS should be noted here, too.
bd 16y ago
What’s the worst that JavaScript might actually do, based on the sites that are out there? I'm using NoScript since I barely escaped from being infected by quite sophisticated malware few years ago. Innocent site (local public transport) had had injected single malicious line into its content management system (most probably after untargeted "fishing for vulnerabilities" botnet scan). This one line was JavaScript include which in turn triggered series of jumps to servers all over the world (mostly China and Russia). In the process, multiple layers of heavily obfuscated JS code were both loading hidden frames loaded with ads (presumably for click / impressions fraud) and trying to load hidden PDF embeds which contained a payload of hidden executables for infecting your local computer (exploiting Acrobat Reader security holes). I only found out because Acrobat is such huge resource hog that I noticed and managed to kill it in a task manager before it finished loading. I was using up-to-date Firefox and up-to-date antivirus AND I had disabled Acrobat plugin. Upon inspection, malicious code appeared to be cross-platform and multi-target, using vendor specific JS extension. I remember besides Acrobat it was also targeting Silverlight (and this was in time when it was very new technology).
adamdecaf 16y ago
Infecting malware, exploiting holes in the browser, storing data via local/session/appCache, tracking me (google analytics), loading flash, displaying ads, redirecting me to see an ad before the content... The list goes on and on, sure you can do most of these without javascript, but by that point I've moved on and blacklisted your site. Is it better to be overly secure, or underly secure?

tcdent 16y ago

If I'm linked to a video, I should be able to watch it only enabling the Flash plugin. You do realize that due to a patent ruling a few years ago, these days almost all Flash content is placed after load with JavaScript to circumvent ActiveX's click-to-interact restriction. How often are you able to enable only Flash to view your content?

lincolnq 16y ago
Not often. But I can usually enable scripting for only the domain where the video is served (youtube.com) and then enable the one instance of Flash which looks like the content.

ciupicri 16y ago

What happens with libraries downloaded from the Google mirror?