3 ms·
I think your last statement highlights the real issue here. Everyone is afraid of malicious javascript. I don't know why they're conflating that with http inj
by chocolatebunny 9y ago
I think your last statement highlights the real issue here. Everyone is afraid of malicious javascript. I don't know why they're conflating that with http injection.
The most straightforward thing to do would be to disable javascript on non https sites by default or warn if a nonhttps site has javascript. Most of the old sites we want to keep around don't have javascript in them (or much javascript in them).
Ideally people should only be enabling javascript on sites they trust (and are running https for "real" "trust") but having a trusted whitelist for enabling javascript brings back your big brother arguments.
- yzmtf2008 9y agoIt's not just javascript though, we've seen ISP (or other malicious actors in the network) inject ads, of even place the entire HTML content of the site into an iframe.
- r00fus 9y agoBingo. This is why it matters to Google. Ad injection could impact their bottom line.
- innagadadavida 9y agoThis is a malware injection problem and it should be possible for google to create signatures of JavaScript from different websites and have chrome verify it and block it. Penalizing all http users is heavy handed and google should not go down that path.