4 ms·

I don't remember "untrusted JS" being any sort of problem in the last, say, 10 years? Now I'm sure you can dig up some vulnerabilities, and a select few of the

I don't remember "untrusted JS" being any sort of problem in the last, say, 10 years? Now I'm sure you can dig up some vulnerabilities, and a select few of them may even had (remote) exploits. But I've never run into any problems, and I'm not especially careful, have been around the seedy underbelly of the web, and don't run any anti-virus. Just not clicking on any .exe that suddenly downloads seems to be enough. Being on MacOS rather than Windows may also help, although as far as I can tell, security on Windows today is also far far better than it was a decade or so ago. Considering all that, I can't shake the suspicion that people complaining about JS vulnerabilities to defend their use of ad blockers are just searching for justification.

bad_user 8y ago
Obviously. Which is why we also have browser extensions that work around paywalls. People are cheap and don’t want to pay for content, it’s as simple as that.
jamieweb 8y ago
Try visiting a popular tabloid news website and use the dev tools to see where it is loading content from. The number of horrendous tracking/ads/spam domains you'll see rushing by is unbelievable.
clarry 8y ago
Not "JS vulnerabilities", but things that waste memory & cpu cycles and in worst case exploit your PC for things like bitcoin mining. Also consider that most browser vulnerabilities -- not "JS vulnerabilities" -- are virtually impossible to exploit without JS.